Privacy Policy

Last updated September 3, 2026

This Privacy Policy describes how Confidant AI Inc ("Confidant", "we", "us", "our") collects, uses, and discloses information about you when you access or use our messaging assistant, our websites, and related services (collectively, the "Services").

The Services are architected so that the substance of your interactions is processed within a session that runs in confidential computing hardware and is encrypted with keys we cannot access. This Policy describes both what is held within that session and the limited categories of information that are necessarily processed outside it.

Changes to this Privacy Policy

We may revise this Privacy Policy from time to time. If we make material changes, we will post the revised Policy with an updated revision date and, where required by applicable law or where the change materially affects how we process your information, provide notice through the Services. Your continued use of the Services following the posting of a revised Policy constitutes your acceptance of it.

Collection and use of information

We collect a limited set of information from a limited set of sources, and we use it to provide, secure, and improve the Services; to verify eligibility and control access to an invitation-only service; to complete the tasks you direct the Services to perform on your behalf, which may include engaging third parties on your behalf; to communicate with you; to comply with applicable legal obligations; and to protect our rights and the rights of our users. We do not sell your information, and we do not disclose your information to registered data brokers or to third parties who resell information to others.

Information you directly provide us

• Your mobile telephone number. You provide your number to verify eligibility and to establish your account. We use it to send a one-time verification code, to identify your account, and to route your messages to your session. We retain a keyed cryptographic hash of the number rather than the number itself; the number is processed in transit and is not written to our directory in a readable form.
• Inputs to the Services. The messages, instructions, documents, credentials, payment details, addresses, and other materials that you submit to the assistant ("Inputs"), and the responses, instructions, and materials the assistant generates from them ("Outputs"). Inputs and Outputs are processed and stored within your session, as described below.
• Correspondence. Information you provide when you contact us, such as your email address and the contents of your message.

Information collected through your use of the Services

• Message metadata. The messaging platform through which you reach the Services transmits your number and message content to us so that we can route them. We record the fact of delivery and operational identifiers, and we do not log message content.
• Account and invitation records. An opaque account identifier, the account that invited you, and the number of invitations issued and used. Records of an in-progress registration, which include the keyed hash described above, expire automatically within fifteen minutes.
• Task and action data. Information the assistant obtains or produces in the course of carrying out a task you directed, including information from websites and services it accesses on your behalf. This information is processed and stored within your session.

Information held within your session

Your conversation history, the assistant's memory of your preferences, and the record of work performed for you are stored in per-user encrypted storage. The encryption keys for that storage are released only to a session that presents a hardware attestation demonstrating that it is running our published software. Neither we nor the operator of the underlying infrastructure can read that storage from outside such a session.

Information we do not collect

We do not require or collect your name, your email address, or a password in order to create an account. This website does not use cookies, and we do not use analytics, advertising, or cross-site tracking technologies on it. We do not knowingly collect information from anyone under 18 years of age.

Disclosure of your information

We may disclose your information to the following categories of third parties, subject to this Privacy Policy:

• The messaging platform. Messages to and from the assistant are transmitted through the WhatsApp Business platform, which is operated by Meta Platforms, Inc. and is not end-to-end encrypted between you and us. Meta processes message content and your number under its own terms and privacy policy.
• Communications providers. Twilio Inc. transmits the one-time verification code and receives your number for that purpose.
• AI model providers. The assistant generates Outputs by transmitting Inputs and task context to a third-party model provider. That provider is currently Fireworks AI, Inc., under terms that prohibit training on the data we transmit. We will update this Policy if that provider changes.
• Third parties with whom the Services interact on your behalf. When you direct the assistant to complete a task, it discloses to the relevant merchant, service, or recipient the information that the task requires, such as a delivery address, a reservation name, or the contents of a message you asked it to send. Those parties process that information under their own policies.
• Infrastructure and security vendors. Microsoft Corporation provides the cloud infrastructure on which the Services run, including the confidential computing hardware in which sessions execute. Cloudflare, Inc. serves our websites and provides the bot-detection challenge presented on the invitation page; it does not process message content or your telephone number.
• Legal and safety. Third parties to whom disclosure is required by law or legal process, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Confidant, our users, or the public. Where we are permitted to notify you, we will.
• Corporate transactions. A successor or acquirer in connection with a merger, financing, reorganization, or sale of assets, subject to this Policy.

Third-party websites and services

The Services access third-party websites and services at your direction, and our website may link to third parties. We do not control those parties and are not responsible for their privacy practices. Their terms and policies govern the information they receive.

Data retention

We retain session storage for the life of your account. Registration records expire automatically within fifteen minutes. Account and invitation records are retained until you delete your account, except that invitation counts attributable to the account that invited you are retained as records of that account. Operational logs are retained for a limited period for security and reliability purposes.

Deletion and your choices

You may delete your account at any time by instructing the assistant, in your conversation, to delete everything. On deletion we remove your session storage and the account records described above, and the keyed hash of your number is removed such that the number is no longer associated with an account. We cannot delete information held by the messaging platform, or information you directed us to provide to a third party; those requests must be made to those parties directly.

Your rights

Depending on your jurisdiction, you may have the right to request access to, correction of, or deletion of personal information we hold about you, to request a copy in a portable form, and not to be discriminated against for exercising these rights. To exercise a right, contact us using the details below. We will verify your request through your account. Because of the architecture described above, the information available to us in response to such a request is limited to the categories listed in this Policy.

Data security

We employ technical and organizational measures designed to protect information, including hardware-based confidential computing for sessions, encryption of session storage under keys released only against attestation of our published software, encryption of data in transit, and least-privilege access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Where a breach affects you and notification is required, we will notify you as required by applicable law.

Children's privacy

The Services are intended for individuals 18 years of age and older. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

How to contact us

Confidant AI Inc. Questions about this Privacy Policy or our privacy practices may be directed to privacy@confidant.ai.