T1U

Privacy Policy

How we handle personal information

T1U is an AI-powered business operating system: CRM+, Finance+, HR+, NeoMind™, and the rest of our modules process data you choose to connect. This policy applies worldwide and covers our marketing sites, authenticated workspaces, AI features, APIs, cookies, and third-party integrations. It supplements our Terms of Service and Cookie Statement.

Last updated: October 9, 2026

Our Privacy Principles

Security, transparency, and control — across CRM+, Finance+, NeoMind™, and every surface where T1U touches your data

Data Security

Enterprise-grade encryption and security measures protect your data

Transparency

Clear communication about how we collect, use, and protect your information

User Control

You have full control over your personal data and privacy settings

Compliance

Designed for global teams: GDPR, UK GDPR, and many other regional privacy laws

On this page

PrinciplesGoogle & OAuthChatGPT1. What we collect2. How we use data3. Sharing4. Security5. Your rights6. Retention7. Transfers8. Legal basis9. Cookies10. Children11. California12. DNT13. Automation14. Third parties15. Breach16. Complaints17. Controller vs processor18. AI & NeoMind19. Marketing20. US state laws21. Subprocessors22. Changes23. Worldwide24. Contact

T1U Privacy Policy

Google Sign-In, Google Workspace, and Google API data

This page is our public privacy policy. It explains how we access, use, store, and share Google user data when you use Google Sign-In or connect Gmail, Google Drive, Google Calendar, or other Google APIs—only as needed to provide the features you enable, subject to your permissions and the requirements below (including Limited Use).

Limited Use. T1U's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for serving ads, and we do not sell Google user data. We use Google-sourced data only to provide or improve T1U features that are clearly disclosed in the product and tied to the permissions you grant (for example: sign-in with Google; optional Gmail, Google Drive, or Google Calendar connections for email, files, or scheduling inside your workspace).

What we may access. Depending on the scopes you approve, this can include account identifiers (such as your Google email and name for login), email metadata and content (when you connect Gmail), files and folders (when you connect Google Drive), and calendar events (when you connect Google Calendar). We request the minimum scopes needed for each feature.

Storage and subprocessors. Data from Google APIs may be stored on our infrastructure and subprocessors (e.g. cloud hosting, databases, logging, and security tools) solely to operate the service, as described in this policy and any applicable data processing agreement with your organization.

Your control. You can disconnect Google integrations in T1U settings and revoke T1U's access anytime in your Google Account under Third-party apps with account access. Revocation stops new access; we retain or delete data according to Section 6 (Retention) and your organization's administrator settings.

Use any of these equivalent URLs on your OAuth consent screen or for Google verification (they all resolve to this policy): https://www.t1u.com/privacy, https://www.t1u.com/privacy-policy, https://www.t1u.ai/privacy, https://www.t1u.ai/privacy-policy.

1. Information We Collect

We collect information you provide directly, data generated when you use T1U, and limited information from integrations you enable. If you use T1U on behalf of a company, your employer may also upload or connect data about employees, customers, or operations—that content is typically controlled by your organization, not T1U.

Account and identity

  • Name, work email, phone (if provided), role, and company affiliation
  • Authentication identifiers (e.g., SSO subject IDs) and security logs
  • Billing contact details and payment metadata (card data is handled by payment processors)

Content and usage

  • Records you create in modules (CRM, HR, Finance, Projects, Support, etc.)
  • Files, attachments, comments, and collaboration metadata
  • Product telemetry: feature usage, session duration, clicks, and in-app navigation
  • Technical logs: IP address, device type, browser, approximate location from IP, timestamps

Support, sales, and marketing

  • Messages you send via forms, email, chat, or scheduled demos
  • Marketing preferences, campaign engagement, and webinar attendance

Integrations. When you connect third-party services (including Google for sign-in, Gmail, Drive, or Calendar; Microsoft; Slack; and others), we receive OAuth tokens and synced content according to the scopes and permissions you grant. Each provider processes data under its own policies; our use of Google user data is further limited as described in the Google & OAuth section above.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process transactions and send related communications
  • Provide customer support and respond to inquiries
  • Send important updates about our services
  • Personalize your experience and recommendations
  • Analyze usage patterns to improve our platform
  • Ensure security and prevent fraudulent activity
  • Comply with legal obligations

Google user data. Where you connect Google services, we use that data only for the user-facing features you enable (such as reading or sending email, syncing files, or showing calendar availability). We do not use Google user data for third-party advertising or to train generalized machine-learning models unrelated to providing T1U to you, except as permitted under the Google API Services User Data Policy (for example, security and abuse prevention, or with your separate consent where allowed).

ChatGPT and connected AI assistants

If you connect ChatGPT (OpenAI) to T1U and sign in, ChatGPT can read personal data in that signed-in user's T1U workspace. The same categories can be read by another assistant you connect the same way, such as Claude. ChatGPT does not receive another company's workspace, and it does not receive a workspace you have not authorized.

What ChatGPT can read after you allow the connection, limited to records that signed-in user can already access in T1U:

  • CRM records: account and company names, contact names, work email addresses, phone numbers, job titles, deal names, stages, amounts, activities, and tasks
  • Email subjects, snippets, and participant addresses from mailboxes that user has connected
  • Calendar event titles, times, and attendees from calendars that user has connected
  • File and knowledge-search snippets from that workspace

Creating a contact, deal, or task, or drafting an email, stays behind a confirmation step in T1U. Drafting an email does not send it. We do not sell this data. OpenAI processes what you ask ChatGPT to retrieve under OpenAI's own terms; T1U sends it only because you authorized that assistant for your workspace. You can disconnect ChatGPT in the assistant and by revoking the T1U authorization.

3. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share information in these limited circumstances:

  • Service Providers: With trusted third-party service providers who assist in operating our platform
  • Legal Compliance: When required by law or to protect our rights and users
  • Business Transfers: In connection with mergers, acquisitions, or asset sales
  • With Consent: When you have given explicit consent to share specific information
  • ChatGPT and connected assistants: When you sign in and allow ChatGPT (OpenAI), or another assistant you connect the same way, we share the signed-in user's workspace data named above so that assistant can answer your request. That includes CRM contacts (names and work emails), deals, email snippets, and calendar events the user can already see.

Information received from Google APIs is not sold. Any transfer to subprocessors is for providing or improving T1U features, security, or compliance, consistent with the Google API Services User Data Policy.

4. Data Security

We implement comprehensive security measures to protect your information:

  • End-to-end encryption for data in transit and at rest
  • Regular security audits and penetration testing
  • Access controls and authentication mechanisms
  • Employee training on data protection best practices
  • Controls designed to align with widely used frameworks (e.g. SOC 2–style and ISO 27001–style practices); additional assurance materials may be available to customers under NDA
  • Regular backups and disaster recovery procedures

5. Your Privacy Rights

You have the following rights regarding your personal information:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete information
  • Deletion: Request deletion of your personal information
  • Portability: Request a copy of your data in a structured format
  • Restriction: Request limitation of how we process your information
  • Objection: Object to processing based on legitimate interests
  • Withdrawal: Withdraw consent for processing based on consent

To exercise these rights, contact us at privacy@t1u.ai or support@t1u.ai.

6. Data Retention

We retain your personal information only as long as necessary for:

  • Providing our services to you
  • Complying with legal obligations
  • Resolving disputes and enforcing agreements
  • Legitimate business purposes

When information is no longer needed, we securely delete or anonymize it.

When you disconnect a Google integration or revoke OAuth access, we stop collecting new data from that connection; deletion of previously synced content may follow your workspace retention rules or your deletion request, subject to legal holds and backup cycles described above.

7. International Data Transfers

T1U operates globally, and your information may be transferred to and processed in the United States and other countries where we or our subprocessors operate. We use appropriate safeguards required by applicable law, which may include:

  • Standard Contractual Clauses (SCCs) approved by the European Commission for EEA transfers
  • The UK International Data Transfer Agreement / Addendum where relevant for UK data
  • Adequacy decisions, derogations, or other mechanisms recognized in Switzerland and elsewhere
  • Contractual or statutory mechanisms in Asia-Pacific, Latin America, and other regions where required
  • Your explicit consent where that is the valid basis for a transfer under local law

If you are in a jurisdiction that restricts cross-border transfers, contact privacy@t1u.ai and we will explain the mechanism that applies to you.

8. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, and Switzerland, we process your personal data based on the following legal grounds:

  • Contractual Necessity: Processing necessary to provide our services under our Terms of Service
  • Legitimate Interests: Processing for business operations, fraud prevention, and service improvement
  • Consent: Where you have given explicit consent for specific processing activities
  • Legal Obligation: Processing required to comply with applicable laws and regulations
  • Vital Interests: Processing necessary to protect your vital interests or those of another person

9. Cookies and Tracking Technologies

We use cookies and similar technologies including:

  • Cookies: Small text files stored on your device
  • Web Beacons: Small graphic images for tracking user activity
  • Local Storage: Browser storage for preferences and session data
  • Pixels: Code snippets for analytics and advertising

For detailed information, please review our Cookie Statement.

On www.t1u.com and our public marketing pages, analytics and marketing scripts (such as Google Analytics 4 or Meta Pixel) are designed to load only after you make a choice in our cookie banner or Cookie Preferences, except for strictly necessary infrastructure — as described in the Cookie Statement.

10. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at support@t1u.ai or privacy@t1u.ai.

If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly.

Minimum ages for lawful consent vary by country (for example, 13 in some US contexts, 16 in many EEA countries for information society services unless member state law specifies otherwise). We apply the higher standard where required by local law.

11. California Privacy Rights (CCPA/CPRA)

California residents have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to Know: Request information about personal data collected, used, disclosed, or sold
  • Right to Delete: Request deletion of personal information
  • Right to Opt-Out: Opt-out of the sale or sharing of personal information
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Limit: Limit the use and disclosure of sensitive personal information
  • Right to Non-Discrimination: Exercise rights without discriminatory treatment

We do not sell personal information in the traditional sense of exchanging data for money. To exercise your rights, contact us at privacy@t1u.ai or support@t1u.ai.

12. Do Not Track and Global Privacy Control

Some browsers support Do Not Track (DNT) or Global Privacy Control (GPC) signals. Because there is no consistent industry standard for how to respond to DNT, we rely on our cookie controls, product settings, and applicable law (including opt-out rights related to cross-context behavioral advertising or targeted advertising where required) rather than treating DNT as a universal opt-out.

You can manage non-essential cookies through our cookie banner and preference center linked from the site footer, and adjust marketing subscriptions via links in our emails.

13. Automated Decision Making and Profiling

We may use automated processing and profiling to:

  • Personalize your experience and recommendations
  • Detect and prevent fraud and security threats
  • Improve our AI and machine learning models
  • Optimize platform performance and features

You have the right to object to automated decision-making and request human review of decisions that significantly affect you.

14. Third-Party Links and Services

Our platform may contain links to third-party websites and integrate with third-party services. We are not responsible for the privacy practices of these third parties. We recommend reviewing their privacy policies before providing any personal information.

Third-party integrations include:

  • Cloud storage providers (Google Drive, Dropbox, OneDrive)
  • Communication tools (Slack, Microsoft Teams)
  • Payment processors (Stripe, PayPal)
  • Analytics and observability (for example Google Analytics on our marketing sites when you opt in, and product telemetry as described in your order or documentation)

15. Data Breach Notification

In the unlikely event of a data breach that affects your personal information, we will:

  • Notify affected users within 72 hours of becoming aware of the breach
  • Inform relevant supervisory authorities as required by law
  • Provide details about the breach and steps being taken
  • Offer guidance on protective measures you can take
  • Implement additional security measures to prevent future breaches

16. Right to Lodge a Complaint

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with a supervisory authority:

  • EU/EEA: Your local data protection authority (EDPB directory: edpb.europa.eu)
  • UK: Information Commissioner's Office (ico.org.uk)
  • Switzerland: Federal Data Protection and Information Commissioner (FDPIC)
  • Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
  • Canada: Office of the Privacy Commissioner (OPC); Quebec residents may also contact the CAI (Commission d'accès à l'information)
  • Australia: Office of the Australian Information Commissioner (OAIC)
  • California: California Privacy Protection Agency / Attorney General (as applicable)

Other countries maintain similar regulators (for example Singapore PDPC, Japan PPC, South Korea PIPC, India Data Protection Board of India when operational). We encourage you to contact us first at privacy@t1u.ai or support@t1u.ai so we can address your concern.

17. Business Accounts: Controller and Processor Roles

When you use T1U for your employer or another organization, that organization is typically the controller of personal data it uploads (for example employee, customer, or vendor records). T1U processes that data as a processor or service provider to deliver the subscription, following instructions from the customer and our Data Protection Terms where applicable.

T1U acts as a controller for its own operational data, such as billing, security, product analytics, and marketing to prospects, separate from customer content stored in workspaces.

18. AI Features (Including NeoMind)

AI-assisted features may process prompts, selected records, and file excerpts you submit to generate summaries, drafts, classifications, or recommendations. Depending on configuration, prompts or outputs may be logged for abuse prevention, debugging, or model improvement under contractual safeguards.

  • Do not submit secrets, credentials, or highly sensitive personal data unless your admin has approved such use.
  • Your organization’s administrator may restrict or disable AI capabilities for the workspace.
  • Outputs may be inaccurate; you should verify before relying on them for compliance or external disclosure.

19. Marketing Communications

We may send product updates, event invitations, and educational content. You can opt out of marketing emails anytime via the unsubscribe link or by writing to support@t1u.ai. Transactional messages about security, billing, or legal notices may continue even if you opt out of marketing.

20. Other United States State Privacy Laws

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, and others as enacted) may have rights to access, delete, correct, or opt out of certain processing. Submit requests using the same channels listed in the Contact section. We will verify your request consistent with law and may need additional information to confirm your identity.

21. Subprocessors and Infrastructure

We use vetted service providers for hosting, databases, authentication, email delivery, analytics, customer support tooling, security monitoring, and model inference. Categories include cloud infrastructure (e.g., compute and storage), payment processors, and communications APIs. A current list is available to enterprise customers under NDA or as published in-product, and we notify customers of material changes where our agreements require.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

  • We will post the updated policy on our website
  • We will update the "Last updated" date
  • For material changes, we will notify you via email or platform notification
  • Your continued use constitutes acceptance of the updated policy

23. Worldwide Use and Regional Privacy Laws

T1U is intended for businesses and professionals globally. Privacy rules differ by country and sometimes by state or province. This policy is designed to meet or support common expectations in many regions. It is not a substitute for legal advice in your jurisdiction. Where local law gives you rights or obligations beyond what we describe here, we will comply with applicable law.

European Economic Area, United Kingdom, and Switzerland. Sections 5, 7, 8, and 16 describe GDPR-style rights, transfer safeguards, legal bases, and supervisory authorities. The UK GDPR and Swiss FADP align closely; UK and Swiss residents may exercise the same categories of rights through the contacts in Section 24.

United States. Section 11 (California) and Section 20 (other state laws) describe rights for many US residents. Federal sector-specific rules may also apply to certain data types or industries.

Brazil. If the Lei Geral de Proteção de Dados (LGPD) applies, you may have rights such as confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, and revocation of consent where processing is consent-based. You may lodge a complaint with the ANPD.

Canada. Subject to PIPEDA and provincial laws (including Quebec's Law 25 where applicable), you may have rights to access, correction, and withdrawal of consent in appropriate circumstances. Contact us or the Office of the Privacy Commissioner of Canada.

Australia and New Zealand. Where the Australian Privacy Act or New Zealand Privacy Act applies, we support access and correction requests and handle complaints in line with applicable principles. You may contact the OAIC or the New Zealand Privacy Commissioner.

Singapore, Japan, and South Korea. The Singapore PDPA, Japan Act on the Protection of Personal Information (APPI), and South Korea Personal Information Protection Act (PIPA) may grant you rights to access, correct, or delete personal data and to withdraw consent or object in defined cases. Contact privacy@t1u.ai for region-specific requests.

India. Where India's Digital Personal Data Protection Act, 2023 (DPDPA) applies, data principals may have rights including access, correction, erasure, grievance redressal, and nomination. Contact us to exercise those rights; you may also use the Board of India mechanism when available under law.

China and other jurisdictions. If you are in mainland China or other regions with specific cross-border or localization rules, additional requirements may apply to how data may be stored or transferred. Enterprise customers should coordinate with their legal and compliance teams and with T1U (via legal@t1u.ai) for contractual arrangements.

Latin America and others. Laws in Argentina, Mexico, Colombia, and other countries may provide similar access, correction, and objection rights. Use the contacts in Section 24; we respond consistent with applicable law.

Representative and language. T1U primarily operates from the United States. This policy is published in English; where local law requires a translation or a local representative, enterprise agreements may specify those arrangements.

24. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

Privacy: privacy@t1u.ai

Support: support@t1u.ai

Legal & data protection (enterprise, DPA): legal@t1u.ai

Questions About Privacy?

Our privacy team is here to help answer any questions about how we protect and handle your data.

Email privacy · Request a copy

Data protection

Encryption and access controls

Global privacy

EU, UK, US, Brazil, APAC, and more

Transparent

Clear practices and rights