Privacy Policy

Information you provide to us may include:

• Contact details, such as your company’s name, your first and last name, email address, state, and phone number, if you choose to provide this information.
• Account credentials, including the username and password you use to access the Services. If you sign up for or login to the Services with a third-party service, such as Google Accounts Sign In, you direct the third party to send us information (e.g., contact information) controlled by that service or as authorized by you via your privacy settings on that service. Click here for more information about Google Accounts Sign In.
• User content that you input, create, upload or generate, including your prompts and other content you upload, such as files, images, audio and video, and data from connected services, depending on the features you use, as well as the outputs you generate through use of the Services.
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Marketing information, such as your preferences for receiving communications about our services, and details about how you engage with our communications.

Automatic data collection. We and our service providers may automatically log information about you, your computer or mobile device, and your interaction over time with our Services, such as:

• Device data, such as your computer’s or mobile device’s operating system, manufacturer and model, browser type, IP address, unique identifiers, language settings, mobile device carrier, and general location information such as city, state or geographic area; and
• Usage data, such as pages or screens you viewed, how long you spent on a page, browsing history, and access times.

We may collect this information using cookies and other similar technologies. Cookies are text files that websites store on a visitor’s device or in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, and helping us understand user activity and patterns.

Information we collect from third parties. We may maintain third-party social media pages, such as pages on LinkedIn. If you interact with us via these pages, we may receive your communications and other information about your interactions with us. Any information collected by the social media companies that maintain our pages is governed by the privacy policies of the providers and is not within our control.

We use your personal information for the following purposes:

To provide and improve the Services and respond to your inquiries. This includes:

• Administering, hosting, and operating the Services;
• Communicating with you and responding to any inquiries you may have;
• Analyzing your use of the Services to allow us to evaluate and improve the Services and its features; and
• Creating aggregated, de-identified or anonymous statistics, which we may use for lawful business purposes, including for Services analytics and strategic planning.

Business promotion. We may use personal information to promote our business, including by sending information that may be relevant to you by email, mail, telephone and other means. We engage our advertising partners, including third party advertising companies and social media companies, to advertise our services.

For compliance and protection, including to enforce any applicable terms and conditions, comply with legal obligations, defend against legal claims or disputes, protect the security and integrity of the Services, and identify and investigate fraudulent, harmful, unauthorized, unethical or illegal activity.

AI model providers. Our Services allow you to interact with AI agents or models as follows:

• AI service providers. Some of our Services permit you to access and use AI agents and models hosted by third parties on our behalf and under contract with us. Where we use such agents or models, we treat the provider as a “service provider” as described below and provide settings in our Services that allow you to exclude providers that use your user content to train their models.
• User-controlled models. Other features allow you to interact with your own AI agents or models through the Services. For example, if you use our Radio service, you may integrate your own AI agents into the Services. Where you interact with your own AI agents or models through our Services, any sharing of personal information is directed by you and we do not control how the third-party agents or models handle your personal information. Please consult the third-party providers’ terms and privacy policies directly for more information on their practices.

We may also share your personal information with:

• Service providers. Companies and individuals that provide services on our behalf or help us operate our Services or our business (such as hosting, information technology, AI providers, support, email delivery, and website analytics and marketing services).
• Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.
• Advertising partners. We may share personal information with third-party advertising companies for the business promotion purposes described above.
• Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate.
• Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, us or our affiliates (including, in connection with a bankruptcy or similar proceedings).

Unsubscribe from marketing communications. You may opt out of our marketing-related communications by following the opt out or unsubscribe instructions contained in the marketing communication we send you. We may continue to send you administrative communications that are necessary for our relationship with you, such as relevant updates to our policies.

Online tracking opt-out. There are a number of ways to limit online tracking, which we have summarized below:

• Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.
• Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third party cookies/trackers. You can also opt out of Google Analytics by downloading and installing the browser plug-in available at tools.google.com/dlpage/gaoptout.

Note that because these opt out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit www.allaboutdnt.com.

We employ a number of technical, organizational and physical safeguards designed to protect the personal information we collect. However, no security measures are failsafe and we cannot guarantee the security of your personal information.

The Services are not intended for use by children. If we learn that we have collected personal information through our Services from a child under 13 without the consent of the child’s parent or guardian as required by law, we will delete it.

Fractal is a service provided by Plasma AI, Inc. (“Plasma,” “we,” or “us”). You can connect Google services to Fractal to work with documents, email, calendars, and contacts.

This section applies to information received through Google APIs and information derived from it, such as summaries and generated responses (“Google user data”). It also applies when we process that data on behalf of a business customer. If another part of this Privacy Policy conflicts with this section, this section controls for Google user data.

What we access and why

Signing in with Google provides basic account information, such as your name, email address, and profile picture, to authenticate you and manage your account. Signing in does not by itself give Fractal access to your Google documents, email, calendars, or contacts.

When you connect a Google integration, we access information according to the permissions you grant and the features you use:

• Google Drive: File names, metadata, and contents to find and summarize documents, answer questions, and create or modify files when authorized.
• Gmail: Messages, attachments, recipients, labels, and drafts to display and summarize email, find information, organize messages, prepare drafts, and send emails or replies when authorized.
• Google Calendar: Calendar lists, event details, attendees, and availability to review schedules, find meeting times, and create, update, or cancel events when authorized.
• Google Contacts: Saved contact names, email addresses, phone numbers, and organization information to find people and identify recipients. This access is read-only.

Connecting an account and granting an agent access are separate steps. Agents use your connections to carry out requests and workflows within the access you grant.

AI processing and sharing

We use Google user data to provide the integration features described above. To process your requests, relevant information is sent through OpenRouter to the model provider serving the selected model, which may include OpenAI, Anthropic, or other providers. OpenRouter and the model provider both process this information. Our hosting, storage, and agent execution infrastructure providers may also process and store it to operate Fractal and carry out your authorized requests and workflows.

We require Zero Data Retention routing for all model requests sent through OpenRouter, using OpenRouter’s account-level privacy settings for every model group. OpenRouter checks this on each request and blocks requests that cannot be served by an endpoint it designates as zero data retention; it does not fall back to a retaining endpoint. We offer only models that are available under this designation, and we remove models that lose it. OpenRouter’s zero data retention designation permits providers to keep prompts in a temporary in-memory cache, including reuse across requests, and OpenRouter’s controls do not extend to any third-party plugins or tools. This designation does not mean that conversations or outputs you save in Fractal are deleted.

We do not use Google user data to develop, improve, or train general-purpose or other non-personalized AI or machine-learning models. These restrictions apply regardless of broader model settings or permissions described elsewhere in this policy.

When you authorize sharing through Fractal—for example, by sending an email, inviting attendees, or placing information in shared workspace content—the information becomes available to the recipients or workspace users and agents you authorize.

We do not sell Google user data, use it for advertising, or use it to determine creditworthiness or for lending. Other disclosures are limited to security purposes, compliance with applicable law, or a merger, acquisition, or sale of assets with your explicit prior consent.

Our staff and providers may read Google user data only with your explicit consent to view specific information, when necessary for security, or as required by law.

Storage and security

We store connection credentials to maintain the Google integrations you authorize. We encrypt Google OAuth access and refresh tokens before storing them in our database.

Google information and resulting outputs may also be stored in conversations, tool results, and other saved content. Access to this content is governed by Fractal’s workspace and resource permissions. Model-provider retention restrictions do not replace Fractal’s own storage and deletion practices.

Retention, disconnection, and deletion

We retain Google user data for as long as necessary to provide the features you use, subject to applicable Google requirements and legal obligations.

You can disconnect Google integrations in Fractal or revoke access through your Google Account settings. Disconnection stops future access through that connection. It does not automatically delete previously saved conversations or outputs, or reverse actions already completed in Google services.

To request deletion of Google user data stored by Fractal, including content derived from that data, email contact@plasma.ai. We honor verified deletion requests and may need to confirm your identity and authority to request deletion.

Deletion may require removing entire conversations or other records containing the data. If that would also remove other content, we will explain and confirm the scope with you before proceeding. For organization-managed content, we may coordinate with an authorized administrator.

Saved content. Conversations, tool results, Pages, and other saved content that contain Google user data remain in your workspace until you or an authorized workspace administrator delete them, or until the account or workspace is closed. We delete it no later than 90 days after account closure or the end of a contract.

Logs. Our application and security logs record integration activity such as connection events, timestamps, the Google account used, and request identifiers. We retain these logs for one year.

Backups. Encrypted backups of our databases are retained for a limited period and then overwritten. Deleted data may persist in a backup until it expires; backups are restored only to recover from an outage, not to reinstate deleted data.

Legal exceptions. We may retain specific information longer where required by law, to resolve disputes, enforce our agreements, or investigate security incidents. We delete it when that need ends.

Deleting data held by Fractal does not itself delete the original files, messages, contacts, or events in your Google account.

Google API commitments

Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API User Data and Developer Policy.

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Services.

You can reach us by email at contact@plasma.ai or at the following mailing address:

Plasma AI Inc.
1521 Blake St #50795
Denver, CO 80202