Privacy Policy

This Privacy Policy explains how Assistance collects, uses, shares and protects personal data when you use our website at 41assistant.com, the Assistance web app, the Assistance desktop app, and the Assistance Companion browser extension (together, the Services). It also explains the choices and rights you have.

If you use the Services through an organization (for example, a Team plan administered by your employer), that organization may have its own policies about your use of the Services. Questions about how your organization uses your data should go to your organization's administrator.

1. Who we are

The controller of your personal data is PT Sintaks Solusi Kreatif, Jakarta ("Assistance", "we", "us").

• Contact for privacy questions and requests: [email protected]

2. How the Services handle your data — the short version

• Your desktop data stays on your computer. Files, folders, the built-in browser, credentials you store for your assistants, and conversations that are not synced are kept locally by the desktop app.
• Bring your own key (BYOK). When an assistant uses your own model provider key, the desktop app sends prompts directly from your computer to that provider. We do not receive that content.
• Credit mode. When you use Assistance credits (modes such as Auto, Fast and Max), your prompts and the model's responses pass through our gateway to the model provider we route to. We do not store this content after the response is delivered, and it is never written to our logs. We keep usage metadata (for example, token counts and timestamps) to enforce your plan limits and bill correctly.
• Sync is optional. If you turn on sync for an assistant, its conversations and settings are stored on our servers so you can use them on the web. Secrets are never synced.
• We do not sell your personal data and we do not use your conversations to train AI models.

3. Personal data we collect

3.1 Data you give us

• Account data: your email address, name and profile picture when you sign in with Google, or your email address when you sign in with an email link; your language and account settings.
• Team data: team names, member roles, invitations, seats, and team settings. If your team uses its own model provider key ("team BYOK"), the key is stored encrypted on our servers and is only used by our gateway.
• Billing data: your plan, subscription status, invoices and order history. Card and e-wallet details are entered on our payment provider's page and are never received by our servers; we store only a payment token, the payment method type and a masked identifier (for example, the last four digits).
• Synced content (only if you enable sync): conversations, assistants (instructions and settings), skills, routines and memories of the assistants you sync, and messages you send from the web app.
• Communications: messages you send us, for example to [email protected].

3.2 Data collected automatically

• Security and session data: IP address, approximate country, device and operating system names, browser type, sign-in times, and active sessions. We use this to keep your account secure (for example, to show your active devices and let you sign them out) and to prevent abuse.
• Audit logs: security-relevant events such as sign-ins, two-factor authentication changes, seat and plan changes, and payments. Audit logs never contain the content of your conversations.
• Team audit logs of assistant actions (only if your team turns them on): for each action your assistants take, the tool, the permission decision and the rule behind it, a short target (such as a website address or file name), the assistant, and the time. They never contain conversation content, files, command text or secrets.
• Usage metadata: for credit mode, the mode used, token counts, usage units, cost, and timestamps. This metadata does not include prompt or response content.
• Bot challenge signals: when you sign in, Cloudflare Turnstile checks that you are a person, using signals from your browser and device.
• Cookies and similar technologies: see our Cookie Policy.

3.3 Data from third parties

• Google sign-in: your Google account's email address, verified-email status, name and profile picture.
• Payment provider: payment status, payment method type and masked details, and fraud-check results.
• Referrals: if someone invites you with a referral code, we record the link between the two accounts to award referral credit.

3.4 Connected apps and Google user data

Connectors (for example, Gmail, Google Drive or Google Calendar) let your assistants work with other services on your behalf. Connector access tokens are stored on your computer by the desktop app, and the data an assistant reads through a connector is processed on your device and sent only to the model provider your assistant uses (or through our gateway in credit mode, as described in section 2).

Assistance's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalized AI or machine-learning models, we do not sell it, and we do not use it for advertising.

4. How we use personal data and our legal bases

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR. Under Indonesia's Personal Data Protection Law (UU PDP), we rely on the equivalent bases (performance of a contract, legal obligation, legitimate interest and consent).

Where we rely on legitimate interests, you can object as described in section 8.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Automated abuse checks (such as bot challenges or rate limits) may temporarily block an action; you can contact us if you believe this was a mistake.

5. How we share personal data

We share personal data only as described here.

• Service providers (sub-processors) that process data on our behalf under contracts that require them to protect it:

When we add a payment provider for international payments (for example, a merchant of record that collects sales tax/VAT), or change a sub-processor, we will update this list.

• Your team. If you belong to a team, the team's owners and admins can see your name, email, role, seat, and how much usage you consumed. They cannot see your conversations or your IP addresses. If your team turns on centralized audit logs, the team's owners and admins can also see the log of actions your assistants (bots) perform while you are signed in to your team account — which tool ran, whether it was allowed, asked or blocked and by which rule, a short target such as a website address or file name, the bot and when — from the desktop app and cloud runners. The app tells you when your team has turned this on. These logs do not include the content of your conversations, files, command text or secrets.
• Model providers you choose. In BYOK mode, your desktop app sends content directly to the provider you configured; that provider's own terms and privacy policy apply.
• Legal reasons. We may disclose data if required by law or a valid legal request, or to protect the rights, safety and property of our users, the public or Assistance.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.

6. International transfers

We are based in Indonesia and our service providers operate in several countries, so your personal data may be processed outside the country where you live, including outside the European Economic Area. When we transfer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we use safeguards such as the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents). For transfers from Indonesia, we follow the transfer requirements of UU PDP, including ensuring an adequate level of protection or appropriate safeguards. You can ask us for a copy of the relevant safeguards at [email protected].

7. How long we keep personal data

When you delete your account, any active subscription stops renewing and we delete or anonymize your personal data, except data we must keep by law or to resolve disputes, prevent fraud and enforce our agreements.

8. Your rights

Depending on where you live, you have rights over your personal data, including the rights to:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• delete your data (you can delete your account in your account settings);
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability — receive data you gave us in a structured, machine-readable format;
• withdraw consent at any time, without affecting processing that happened before;
• under UU PDP, also to postpone or limit processing, and to claim compensation for breaches as provided by law;
• complain to a data protection authority — in the EU, the authority where you live or work; in Indonesia, the authority responsible for personal data protection.

To exercise your rights, email [email protected] from the email address on your account. We may need to verify your identity. We respond within the time required by applicable law (for example, within one month under the GDPR). If you use the Services through a team, some requests may need to go through your team's administrator.

9. Security

We protect personal data with measures appropriate to the risk, including encryption in transit (TLS), encryption of secrets at rest (such as two-factor secrets, team provider keys and payment tokens), storing only hashes of session and login tokens, revocable sessions, optional two-factor authentication, and restricted access to production systems. No system is perfectly secure; if a personal data breach affects you, we will notify you and the relevant authority as required by law.

10. Children

The Services are not directed to, and may not be used by, anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or in the Services before they take effect. The effective date at the top shows when this Policy last changed.

12. Contact

PT Sintaks Solusi Kreatif Jakarta, Indonesia Email: [email protected]