Privacy Policy

Draft dated 7 November 2026

1. Scope and contact

This notice covers the Direction website and workspace. Privacy questions and requests can be sent to aryaanrizvi.business@gmail.com. Where your employer or another organisation manages your workspace, that organisation determines why employee and project information is entered and who should have access. Contact your workspace administrator about those decisions.

2. Information processed

Direction processes account and membership information such as email addresses, names, roles, invitations, and onboarding status. Workspace information can include team profiles and images, projects, tasks, assignments, deadlines, updates, comments, approved knowledge, and uploaded files.

For Company Brain, information processed includes questions, conversation context supplied with a question, relevant knowledge extracts, generated answers, embeddings used for retrieval, and usage counts. Some answers and embeddings are cached on the server. Messages you send to our contact email are also processed to respond to you.

The service uses sign-in and session records. Hosting providers may process technical request information, such as IP addresses and error logs, to operate and protect their infrastructure.

3. Purposes

Information is used to authenticate users, manage workspace access, display team work, support collaboration, answer questions about approved knowledge, enforce usage limits, respond to enquiries, and maintain the service. Direction does not record screens or automatically monitor employee computer activity.

4. Who receives information

Workspace members can see content according to the workspace’s access controls. Administrators manage membership and can review workspace records. Direction’s operator may need access to investigate support or security issues.

Railway provides application hosting and storage. When Company Brain is used, OpenAI receives text needed for embeddings and responses, including questions, supplied conversation context, and relevant approved content. The application requests that generated responses not be stored through the API’s response-storage feature; this does not mean the provider has no separate retention obligations or practices. Where Google sign-in is enabled, Google processes authentication and provides identity information to Direction.

Data may also need to be disclosed to comply with a legal requirement or address a security incident. Direction does not include advertising trackers or sell workspace information as part of the current service.

5. Cookies and browser storage

Essential cookies maintain sign-in sessions and protect the authentication flow. Browser storage may retain application preferences and temporary interface state. Blocking essential cookies may prevent sign-in. The current public website does not include third-party advertising or analytics scripts.

6. Storage, security, and transfers

Workspace records and uploaded content are stored on the hosting service. Access checks restrict workspace data, and production sign-in uses secure session cookies. No service can guarantee complete security.

Hosting and AI providers may process information outside Singapore. The final service arrangements must confirm relevant locations, contracts, and safeguards for overseas processing. Do not assume that all data remains in Singapore.

7. Retention and deletion

The current application does not apply a comprehensive automatic deletion schedule to workspace records, uploaded content, or AI caches. Removing a user’s access does not delete their shared contributions. Retention periods and any backup deletion windows must be agreed before a production rollout.

Contact us and your workspace administrator to request an export, correction, or deletion. Requests may require identity and authority checks. Some records may need to be retained for legal obligations or unresolved disputes; we will explain any applicable limits.

8. Your requests

You can contact aryaanrizvi.business@gmail.com to request access to or correction of personal data, raise a privacy concern, or withdraw consent where consent is the basis for processing. We will explain the consequences where a request affects our ability to provide the service and coordinate with the organisation managing your workspace where appropriate.

9. Updates

The date at the top identifies this draft. Material changes to the final notice will be communicated through the website or workspace as appropriate.