Privacy Policy

Last updated: July 11, 2026

1. Introduction

Agent Mom, Inc., the company behind Cloudette ("we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Cloudette platform and services (collectively, the "Service"). By using the Service, you consent to the data practices described in this Privacy Policy.

Our commitment: Privacy is not a compliance checkbox for us — it is one of Cloudette's core missions. A personal assistant only works if it can be trusted with the details of your family's life, so we design every feature to respect and uphold your privacy to the highest degree: we collect only what a feature needs, access content on demand rather than copying it in bulk, encrypt everything in transit and at rest, never sell your data or use it for advertising, never use it to train generalized AI models, and delete it when you ask. Several sections below describe specific protections for Google user data because Google's policies require that we spell them out — but we hold all of your data, whatever its source, to the same standard: your messages, email, files, photos, call content, credentials, and anything else you entrust to Cloudette.

2. Information We Collect

Information You Provide Directly: Name, email address, phone number (if you opt in to SMS notifications), family size, and any other information you voluntarily submit through registration forms or account settings.

Cloudette connects to Google services only when you explicitly authorize each one, and uses each connection solely to power the corresponding features described below. You can connect or disconnect Google Calendar, Gmail, and Google Drive independently at any time. The specific data and OAuth scopes are:

Google Calendar Data (scopes: calendar.events, calendar.calendarlist.readonly): event titles, dates, times, and durations; event locations and descriptions; attendee names and email addresses; recurring event patterns; event reminders; and the list of calendars on your account. We access this data to display your family schedule, detect scheduling conflicts, calculate travel time between events, list your calendars during onboarding so you can assign each to a family member, and — with your approval — create, modify, or delete events on your behalf.

Gmail Data (scope: gmail.modify): the contents of your email messages (senders, recipients, subjects, bodies, and attachments), your labels, and your drafts. We access this data to search and read messages you ask about, help you triage your inbox, apply or remove labels, archive messages, mark messages read/unread, save attachments, and — with your explicit approval each time — send replies and new messages on your behalf. We never permanently delete your email; message removal only moves messages to Trash, which you can restore.

Google Drive Data (scope: drive): the files and folders in your Google Drive, including their names, contents, and sharing permissions. We access this data to find and read files you ask about, and — with your approval — to create, edit, rename, move, copy, share, or trash files (including Google Docs and Sheets) on your behalf. You may optionally restrict Cloudette to specific folders.

Google Forms Data (scope: forms.body): the content of Google Forms that Cloudette creates for you. We use this only to create new forms (for example, an RSVP or sign-up sheet) at your request.

Connected Account Identification: To show you which Google account is connected and to keep multiple connections separate, we store the email address of each connected Google account. Cloudette does not request access to your broader Google profile.

1Password (Optional): If you connect 1Password, Cloudette retrieves an individual login credential from your own 1Password account only when you ask it to sign in to a website on your behalf, and only for the specific site involved. The credential is used solely to complete that sign-in, and several safeguards apply. The credential is delivered directly to the isolated browser session that performs the sign-in — the AI model never sees it, and it is never shared with our AI service providers; the model works only with an opaque reference. Before anything is entered, Cloudette checks that the destination website matches the website recorded on your 1Password item itself; if they do not match, nothing is filled without your explicit confirmation — this protects you against look-alike phishing sites. Highly sensitive items, such as credit card or banking details, require your fresh confirmation every single time they are used. Credentials are held in memory just long enough to complete the sign-in and are never written to our databases or logs; we store only a record of which sites you have approved for sign-in.

Content You Upload: Documents (PDFs), images, and other files you submit for event extraction and data processing.

Automatically Collected Information: Device information (browser type, operating system), IP address (anonymized for analytics), usage data (features used, pages visited, session duration), and cookies and similar tracking technologies as described in Section 11.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process and manage your account registration
• Connect and synchronize your Google Calendars to display your family's schedule in one unified view
• Detect scheduling conflicts, travel time issues, and overlapping events across multiple calendars
• Create, modify, or delete calendar events on your behalf when you explicitly approve such changes
• Generate AI-powered scheduling recommendations based on your calendar data
• Search, read, and triage your Gmail messages, and — with your explicit approval — send replies and messages, apply labels, archive, and save attachments
• Find, read, create, edit, organize, and share your Google Drive files (including Docs and Sheets), and create Google Forms, when you request it and, for changes, approve it
• Extract events, deadlines, and action items from uploaded documents and images
• Send service-related notifications via email and, if opted in, SMS/text messages
• Place outbound phone calls on your behalf when you explicitly request and approve each call
• Retrieve a login credential from your connected 1Password account and enter it into a website's sign-in page — only when you ask Cloudette to sign in on your behalf, and subject to the safeguards described in Section 2
• Respond to your inquiries, feedback, and support requests
• Analyze usage patterns to improve features and user experience
• Ensure the security and integrity of the Service
• Comply with legal obligations

We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising. Our use of Google user data is strictly limited to providing and improving the user-facing features of the Service as described in this Privacy Policy.

4. Google API Services — Limited Use Disclosure

Cloudette's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This means:

• We only use Google user data to provide and improve the user-facing features of Cloudette that are prominent in the application's user interface
• We do not transfer Google user data to third parties unless it is necessary to provide or improve user-facing features, you provide affirmative consent, it is necessary for security or legal reasons, or as part of a merger or acquisition with prior notice to users
• We do not use Google user data for serving advertisements of any kind
• We do not use Google user data — and do not allow any third party, including the AI service providers described in Section 7, to use it — to develop, improve, or train generalized artificial intelligence or machine-learning models. Google user data is processed by AI models solely to generate responses to your individual requests
• We do not allow humans to read your Google user data unless you have given affirmative agreement for specific content, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data has been aggregated and anonymized for internal operations and no longer contains personally identifiable information

While this section is required by Google's policies and speaks to Google user data specifically, we apply the same Limited Use standard to all personal data you entrust to Cloudette, regardless of its source.

5. How We Store Google User Data

Calendar Data: Calendar event data is cached on our servers to provide real-time conflict detection and scheduling features. Cached data is encrypted at rest and in transit and is refreshed periodically to stay synchronized with your Google Calendar. When you disconnect your Google Calendar or delete your Cloudette account, all cached calendar data is deleted from our servers within thirty (30) days.

Gmail and Google Drive Data: We access your Gmail messages and Google Drive files on demand to fulfill your specific requests; we do not maintain a bulk copy or mirror of your mailbox or Drive on our servers. Message and file contents needed to answer you may appear transiently in your Cloudette conversation history to provide continuity within a conversation; this history is encrypted at rest, is subject to a limited retention window, and is deleted when you disconnect the integration or delete your account.

OAuth Tokens: The access and refresh tokens that authorize Cloudette to reach your Google account are encrypted at rest using envelope encryption with a unique, per-user encryption key managed by a hardware-backed key management service, so that no single key can decrypt any user's tokens. When you disconnect a Google service, the corresponding token is revoked with Google and deleted from our systems.

Security Measures for Google Data: All Google user data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256 encryption. Access to Google user data is restricted to authorized systems and personnel on a need-to-know basis. We maintain access logs and conduct regular security reviews of systems that handle Google user data.

6. SMS/Text Message Privacy

If you opt in to receive SMS/text message notifications from Cloudette:

• Your phone number will be used exclusively to deliver service-related notifications (calendar alerts, reminders, scheduling conflicts, and action item updates)
• We will never send you marketing, promotional, or advertising text messages
• We will never sell, rent, lease, share, or disclose your phone number to any third party for their marketing or any other purpose
• Your phone number is transmitted to and processed by Telnyx, our messaging service provider, solely for the purpose of delivering your notifications. Telnyx processes your phone number under their own privacy policy and in compliance with applicable telecommunications regulations
• We retain your phone number only for as long as you maintain an active account with SMS notifications enabled. Upon opting out or account deletion, your phone number is removed from our messaging systems
• You may opt out at any time by replying STOP to any message, disabling SMS in your account settings, or contacting us at support@agent-mom.com

7. How We Share Your Information

We do not sell, rent, or trade your personal information — including any data received from Google APIs — to third parties for their marketing purposes. Period.

We may share your information only in the following limited circumstances:

• Service Providers: We share data with trusted third-party service providers who assist us in operating the Service (e.g., Telnyx for SMS delivery, Resend for email delivery, Apple Push Notification service and Google Firebase Cloud Messaging for delivering mobile push notifications, Google Maps Platform for location search and travel-time features, cloud hosting providers, analytics services). Push notification titles and bodies may include content derived from your connected accounts, so these push transports act as service providers for that limited content. These providers are contractually obligated to use your data only for the purposes of providing services to us and are bound by confidentiality obligations. Google user data is only shared with service providers to the extent necessary to provide or improve user-facing features of the Service.
• AI Processing: Cloudette's assistant features are powered by large language models provided by Anthropic. Content needed to fulfill your requests — which may include Google user data such as calendar events, email messages, or Drive file contents — is transmitted to Anthropic solely to generate Cloudette's responses to you. Anthropic acts as a service provider under contractual terms that prohibit it from using your data to train its models and that require automatic deletion of request content from Anthropic's systems within thirty (30) days. We do not permit any AI service provider to use Google user data to develop, improve, or train generalized artificial intelligence or machine-learning models.
• Image Generation: When you ask Cloudette to create an image, the text prompt for that image is sent to OpenAI, our image-generation service provider, solely to generate the image. OpenAI processes this content as a service provider under commercial API terms that do not use it to train OpenAI's models.
• Voice Calling: When you ask Cloudette to place a phone call on your behalf and approve it, the call is placed through Bland.ai, our voice-calling service provider. The recipient's phone number and the information needed to conduct the call — which may include content you ask Cloudette to reference from your connected accounts — are shared with Bland.ai solely to place and complete that call. Call audio and transcripts are processed by Bland.ai as a service provider under contractual confidentiality obligations.
• Messaging Channels: If you chat with Cloudette through Telegram, your messages are transmitted through Telegram's Bot API and are handled by Telegram under its own privacy policy, as with any Telegram conversation.
• Actions You Direct: Some features transmit information to third parties that you choose. Browser automation signs in to and interacts with websites you designate — including submitting forms or completing purchases you approve — and scheduled scripts you author may fetch or send data to services you specify. Those third parties handle that information under their own privacy policies.
• Legal Compliance: We may disclose your information if required by law, court order, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

Google Data Specifically: We do not transfer Google user data to any third party except as described above. We do not use Google user data for serving advertisements. We do not allow humans to read your Google user data except with your affirmative consent, for security purposes, to comply with law, or when data has been aggregated and anonymized. We do not sell Google user data, and we never transfer it to data brokers, advertising platforms, or any party for purposes such as determining creditworthiness, lending, or training generalized AI models.

8. Data Security

We implement industry-standard technical and organizational security measures to protect your personal data, including: encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256), access controls and authentication mechanisms, regular security assessments and monitoring, secure data storage with reputable cloud service providers, and employee access restrictions on a need-to-know basis. Google user data receives the same or higher level of protection as all other user data. However, no method of electronic storage or transmission over the Internet is 100% secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

9. Data Retention

We retain data only as long as needed to provide the service, and we tier retention by the type of data:

• Raw content — the messages you send us, forwarded emails, inbound text messages, the file bytes you upload, and any Google data we cache to serve a feature (including your Google Calendar while that integration is connected) — is retained for up to 30 days and then automatically deleted. It is also deleted within 30 days of disconnecting the related integration, deleting your account, or making a verified deletion request.
• Derived information you ask us to remember — the notes, preferences, and profile/goal files that let Claudette act as your assistant — is retained until you delete it or delete your account. Information derived from Google data (such as a saved writing-style profile) is deleted when you disconnect the related Google integration.
• Security and billing records — audit logs, usage/cost records, and file-scan metadata — are retained on a fixed schedule for security, fraud-prevention, and legal-compliance purposes. These records do not contain the contents of your Google data.

When you delete your account, all of the above is deleted, except records we are required to keep for legal or security reasons, which are retained only as long as necessary and then deleted.

10. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete personal data
• Deletion: Request that we delete your personal data
• Portability: Request your data in a structured, machine-readable format
• Withdrawal of Consent: Withdraw your consent for data processing at any time (this will not affect the lawfulness of processing prior to withdrawal)
• Opt-Out of SMS: Reply STOP to any text message or disable SMS notifications in your account settings
• Opt-Out of Communications: Unsubscribe from email communications using the link in any email, or by updating your account preferences
• Revoke Google Access: Disconnect any Google integration (Calendar, Gmail, or Drive) at any time through your Cloudette account settings, or by revoking Cloudette's access directly at myaccount.google.com/permissions. Disconnecting from within Cloudette revokes the associated token with Google immediately; upon revocation we stop accessing your Google data and delete any cached or transiently retained Google data within thirty (30) days

To exercise any of these rights, please contact us at support@agent-mom.com. We will respond to your request within thirty (30) days.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to: maintain your session and authentication state, remember your preferences and settings, analyze usage patterns and improve the Service, and ensure the security of the Service. We do not use cookies for third-party advertising or cross-site tracking. You can control cookie preferences through your browser settings, though disabling cookies may affect Service functionality.

12. Children's Privacy

The Service is designed for use by parents and guardians who are at least 18 years of age. We do not knowingly collect personal information directly from children under the age of 13. Calendar and scheduling data related to children (such as school events, activities, and appointments) is collected and managed solely through the parent or guardian's account. If we learn that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us immediately at support@agent-mom.com.

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including: the right to know what personal information is collected, used, and shared; the right to request deletion of your personal information; the right to opt out of the sale of personal information (we do not sell your data); and the right to non-discrimination for exercising your privacy rights. To exercise these rights, contact us at support@agent-mom.com.

14. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes via email to the address associated with your account, through the Service, or by posting a prominent notice on our website. The "Last updated" date at the top of this policy indicates when it was most recently revised. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at support@agent-mom.com.