# Privacy Policy

> **Draft — not yet reviewed by counsel.** Published for review; not in effect.

**Effective date:** 

We wrote this to be read. Streamliner is an app for iPhone, iPad and Mac that lets a person get work done by chatting with an assistant that uses the tools they are given. It can be used in two very different ways, and they have two very different privacy stories. Most of this page explains which is which, what we hold in each, and what we don't see.

If something here isn't clear, use the form on our [support page](/support) or write to us at the address under *Contact*.

## The short version

- **On this device (free)**: no account, and **nothing about your work is stored on our servers**. Your streamlines, keys and chats stay on your devices and, if you turn it on, your own iCloud. The assistant talks straight from your device to your AI provider with your own key. Our servers see you only when you choose to use something they serve, such as opening a shared link or sending us a report, and then only what any website receives (see *What we receive from free use*).
- **Organization accounts (hosted)**: an organization uses Streamliner for its own work. We host its setup, its people's sign-ins and the record of its chats **on the organization's behalf**. The organization decides how long its chats and files are kept; a few operating records (usage, refusals, the activity log) are kept for fixed periods set out below. The organization brings its own AI provider key.
- **Some things don't reach us**: what you type into secure forms, your voice, and the scanner's camera frames. The calls the assistant makes to your organization's systems go straight from your device; in an organization, what those systems answer becomes part of the requests our relay passes to the AI provider and of the organization's chat record. Your sign-ins to those systems stay on your device, with narrow exceptions described below.
- **We don't** sell personal information, share it for advertising, run ads, track you across apps or sites, or put analytics or crash-reporting libraries in the app. **We don't train AI models** on what you send, and we don't give it to anyone to train theirs.
- **The AI provider** (Anthropic today) receives what the assistant needs to answer you. You are asked before anything you write goes to it, and you can change your answer at any time.
- **What we can't see or control**: the systems a streamline connects to, streamlines made by other people, and what an AI provider does with what it receives. Their own policies govern them, and checking them is part of choosing to use them.

## Who we are, and what this policy covers

Streamliner is published by **Manolab, LLC**, [a STATE limited liability company] ("Manolab", "we", "us"). This policy covers:

- the **Streamliner app** for iPhone, iPad and Mac;
- the **hosted service** we run for organization accounts at streamliner.work: sign-in, the model relay, configuration hosting, the chat record, file uploads, usage records and links shared through Discover;
- this **website**, streamliner.work.

It does **not** cover:

- **your organization's own systems** and the servers a streamline connects to (often called MCP servers). They receive the calls the assistant makes for you, under your organization's (or that server's operator's) own policies;
- **AI providers** such as Anthropic, which process what is sent to them under their own terms and privacy policies;
- **streamlines published by other people or organizations**, including ones you open from a link or import from a file;
- **Apple**, which runs the App Store, iCloud, Sign in with Apple and your device's operating system.

When you use Streamliner as a member of an organization, that organization's own privacy notice also applies to you. For most of what is described under *Organization accounts* below, the organization, not Manolab, decides how your information is used.

## Two places, two different stories

Streamliner shows each place by name: **On this device**, and the name of each organization you belong to. Your device can hold several at once, and they are kept apart: an organization's setup, sign-ins and chats are separate from your own and from every other organization's.

One feature crosses that line on purpose. On a device an owner has approved for publishing, an owner or admin can use the **Concierge** (the built-in assistant in *On this device*) to open and change that organization's setup. See *AI providers* for where that information goes.

### On this device (free)

When you choose *Use on This iPhone (Free)* (or iPad, or Mac), there is no Streamliner account and no sign-in, and nothing about your work is stored on our servers.

- **Your streamlines and chats** are files on your device. You choose how long chats are kept (*Keep chats for*: until you delete them, a year, 90 days or 30 days).
- **Your AI provider key** is kept in your device's Keychain. It is sent only to that provider, with each request (and to your iCloud Keychain if you turn on key sync). It never goes into a chat, never to the assistant, and never to us. When you save a key, the app checks it with the provider in a way that spends nothing.
- **The assistant's requests** go straight from your device to the AI provider, under your own account with that provider. They don't pass through our servers.
- **Your sign-ins to the servers your streamlines use** are kept in your device's Keychain, on that device only. They never sync, and never reach the assistant.
- **The Concierge** works the same way: on your device, with your key, straight to the provider.
- **iCloud sync is off until you turn it on.** The switches for keys, streamlines and chats are set on each device separately; turning on streamlines or chats also syncs your list of organizations, unless you turn that off. Synced streamlines and chats go to your own private iCloud database, most of it in fields Apple encrypts with keys only your devices hold (for Apple IDs with two-factor authentication, Apple's default); keys go through iCloud Keychain. Your sign-ins to servers never sync. *Remove from iCloud…* deletes what is in your iCloud without touching your devices. iCloud is Apple's service, under your Apple ID and Apple's privacy policy, and nothing in it reaches us.

### What we receive from free use

Nothing about your work. But our servers, and Apple on our behalf, do see a little when you choose to use something they serve:

- **Opening a shared link.** When you open or get a streamline someone shared by link, the app (or your browser) fetches it from streamliner.work. Like any website, our service and our host, Cloudflare, receive the technical details of that request (such as your IP address and the address requested). We don't keep them with anything about you.
- **A web sign-in that finishes in a browser.** Sign-ins to a server's own sign-in page normally finish inside the app. If one finishes in a browser outside the app instead, the browser opens a page on streamliner.work carrying a one-time sign-in code, which the page hands back to the app without storing or logging it. The code is useless without a secret held only on your device.
- **Issue reports** you choose to send (see *Issue reports*).
- **Crash reports and feedback from Apple.** If you allowed *Share with App Developers* in your device's settings, or you send feedback from TestFlight, Apple may give us crash reports, usage statistics or your feedback, under Apple's own policies. Crash reports can contain technical details about your device and the app's state.

### Organization accounts: hosted for your organization

An organization account is created for an organization (a company, a team, a nonprofit), today by arrangement with us, and it uses Streamliner under its own agreement with us. Its owners and admins configure its streamlines, invite people, choose its AI provider and supply its own provider key. When you join one, Streamliner and our hosted service process information about you **on the organization's behalf**.

In the language of data protection law, **the organization is the controller** (or "business") of this information, and **Manolab is its processor** (or "service provider"). We process it to run the service for the organization, under our agreement with it, and not for our own purposes. If you have questions about what your organization keeps, who in it can read your chats, or how long it keeps them, ask your organization first. We will help it answer you.

## What we hold for organization accounts, and why

Everything below exists only for organization accounts.

### Who you are in the organization

- **Your name and email address**, from your invitation, from the organization's own directory of its people, or from Sign in with Apple (which may give us a private relay address instead of your real one). *Why:* to know which member you are, to send you sign-in codes, and to show admins who their members are.
- **Your membership**: your access level (owner, admin or member), the job roles your organization gave you, when you joined and last signed in, and how. *Why:* to decide which streamlines and tools you can use.
- **Invitations**: the email or username an invitation was made for, the name, level and roles it gives, who made it and when, and whether it was used. The invitation code itself is stored only as a one-way hash. An invitation stops working after seven days.
- **Networks**: if your organization limits a streamline to its own networks (its store Wi-Fi, office or VPN), the list of allowed network address ranges, and which people or roles each applies to.

### Signing in and staying signed in

- **Sign-in codes** sent by email are valid for 10 minutes and are kept only as hashes. Sign-in emails are sent through Cloudflare's email service.
- **Sign in with Apple**: we check the identity token Apple gives the app and keep the stable identifier Apple assigns you for our app, plus the name and email Apple shares, if any.
- **Sessions**: each device you sign in on has a session with a device name and platform (for example *iPhone, iOS*), when it started and when it was last used. Refresh tokens are stored only as hashes. A session ends when you sign out, when an admin signs you out, after 30 days without use, and in any case after 90 days. *Why:* to keep you signed in safely, and to let you and your admins see and end the sessions on each device (*Signed-in devices*).
- **We don't store your IP address or location with your account or sessions.** To limit abuse, we keep short-lived counters of sign-in attempts keyed by a one-way hash of an email address or IP address, which expire within hours. When your organization restricts a streamline to its networks, the address your request comes from is compared with the allowed ranges at the moment of the request, and not kept.
- **Password sign-in to your organization.** Some organizations sign their people in to Streamliner with the username and password of their own system. The sign-in card sends your password over an encrypted connection to our service, which passes it once to that system and returns the resulting session to your device. **Neither the password nor that session is stored or logged by our service**, and the password never reaches the assistant. We keep your username as your sign-in identity.

### Your organization's setup

- **The organization's configuration**: its streamlines, their instructions, the servers and tools each may use, which AI model each uses, templates, forms, appearance, and the rules about who may use what. Parts of it (such as a streamline's instructions) are private and never reach members' devices; an owner's or admin's device can read them only after an owner approves that device, and the organization's own systems can read them with its server key.
- **The organization's AI provider key**, sealed in our store, used only to call the provider for that organization's chats, and never shown again to anyone after it is saved (admins see only its last four characters and who set it when).
- **Publishing keys**: when an owner or admin publishes changes from the app, their device makes a signing key that never leaves the device. We keep its public half, its label and platform, its status and who approved it.

### The assistant's requests (the model relay)

In an organization, your device sends each request for the assistant to our **model relay**. The relay checks that you may use that streamline (membership, roles, networks and daily limits), adds the streamline's private instructions, and passes the request to the AI provider with the **organization's** key. The provider's answer streams back to your device through the relay, which reads only the token counts.

A request contains what the assistant needs to answer in context: what you wrote, the conversation so far (including the results of the tools it used for you), any files you attached, and the streamline's instructions. **The relay doesn't keep a copy of requests or answers.** What it records is usage (below).

### The record of your chats (organization transcripts)

A chat in an organization is the organization's record of the work, like any other business record. After each turn, your device sends the chat's new events to the organization's store: your messages; the assistant's replies; the steps it took, including steps that were refused, and **the results the tools returned** (for example, the customer record a search found); the cards it showed and the buttons you tapped; codes you scanned; the names of files you attached; and whether you dictated a message.

**Values you enter in secure forms are never in it**, only their outcomes (such as *Card ···· 4242 captured*). Other sensitive information can be: if someone types it into the chat, or a system returns it as a tool result. The app warns you when something you type looks like a card or Social Security number, and our service refuses to store a batch that looks like it contains one, but these checks can't catch everything.

- The organization's **owners and admins can read these records**, including the chats of a specific person, and every time one of them opens a person's chat, it is entered in the organization's activity log. The organization's own systems can also read them with a server key it controls.
- They are kept for **as long as the organization sets** (365 days after a chat's last activity unless it chooses otherwise; it may choose to keep them until its account is deleted), then deleted by a daily process.
- Your device keeps its own copy only for a short window the organization sets (two days unless it chooses otherwise). Deleting a chat from your device doesn't delete the organization's record.

### Files you attach

In an organization, files you attach in a chat (photos, PDFs, text files, if the streamline allows them) are uploaded once to our upload store so the relay can pass them to the AI provider with each request that needs them. Before upload, photos are made smaller and their location and camera details are removed. Uploads are kept for **seven days after they were last used** (an organization can set between 1 and 30 days), then deleted by a daily process, which can run behind on a very busy account; a small marker that the file existed is kept for 30 more days so an old chat can say *expired* instead of failing. A tool that needs the file gets a link that works for 15 minutes.

On this device (free), attachments stay on your device and go only to the AI provider and the servers you use.

### Usage records

For every assistant request in an organization, we record **how many tokens** were used (input, output and cache), by which person (and their roles), in which streamline and chat, with which model, when, and how many files were attached, plus an estimated cost. **Never message text.** *Why:* to enforce the daily limits the organization sets and to show its admins what each streamline costs. Detailed records are kept for 90 days; daily totals for about two months, then monthly totals for as long as the account exists.

**Refusals.** When one of your organization's systems refuses a step because you lack permission, your device reports which tool was refused and the refusal code (never the content), so admins can see who is turned away where. These records are kept for 90 days.

### The activity log

What owners, admins and the organization's own systems change is recorded in the organization's activity log: invitations, changes to access levels and roles, suspensions and removals, sign-outs, model key changes (never the key), publishing, device approvals, links shared through Discover, and every time an admin opens a person's chat. Each entry says who did it, what, to whom and when, and never contains a secret, code, key or token. The log is kept for **two years**. Separate records of publishing-device and model-key changes are currently kept for as long as the account exists [counsel: until they are pruned at two years like the log].

### Links shared through Discover

An organization's owners and admins can share a streamline by link. A shared streamline is **public to anyone who has the link**: what it contains (its name, description, instructions, the servers it connects to, its quick phrases and appearance), and the organization's name as its publisher, are stored unencrypted at an unguessable address that is never listed. The app leaves out keys, roles, network rules and limits. Which organization shared which link, and who in it shared it, is kept privately with the organization's other data. Stopping a link removes it from our service; copies people already saved on their devices remain theirs. See our [Publisher Terms](/terms/publishers).

### How all of it is protected

- Everything we hold for an organization is stored on Cloudflare and **encrypted with a key that belongs to that organization's account alone**, on top of Cloudflare's own encryption. Each object is bound to its place, so it can't be moved to another account and read. The exceptions are streamlines shared by link, which are public by design.
- The organization's configuration is **signed**, and the app checks the signature, so someone who broke into our storage couldn't quietly change where your sign-ins are sent.
- On iPhone and iPad, chats are protected by the system's data protection; on the Mac, they sit in the app's own sandboxed container (protected by FileVault when it is on). Sign-ins are kept in the Keychain, on that device only. When you leave an organization, sign out, or your access ends, the app removes that organization's chats, sign-ins and setup from the device.
- **The limit, stated plainly.** To use an organization's private instructions and AI key, our service must be able to decrypt them, and the same is true of its chat records. They are **not end-to-end encrypted**. So an organization trusts its host (Manolab, and Cloudflare under us) as it would any hosted service. We access an organization's content only when needed to run and secure the service, to give support the organization asks for, or when the law requires it, and we limit that access to the people who need it.

No method of storing or sending information is perfectly secure. If we learn of a security breach affecting information we hold for an organization, we will notify that organization without undue delay, so it can notify the people affected as the law requires. If a breach affects information we control ourselves (such as issue reports), we will notify the people affected and the authorities as the law requires.

## What stays out of our servers

In either place:

- **What you enter in secure forms**: card numbers, Social Security and other ID numbers, dates of birth, license numbers, PINs. Where a streamline offers a secure form, it sends these from your device straight to your organization's (or the server's) own system. The assistant learns only the outcome.
- **Web pages a streamline links you to** (for example, a payment page) open in your browser, which the app can't see into.
- **The calls the assistant makes** to your organization's systems and to the servers a streamline uses go straight from your device to those systems, with your own sign-in. (What those systems answer is part of the conversation; in an organization it passes through our relay to the AI provider and is kept in the organization's chat record.)
- **Your sign-ins to those systems** (tokens and sessions) stay on your device, with the two narrow exceptions above: a password sign-in to your organization, and a web sign-in that finishes in a browser.
- **Your voice.** Dictation is turned into text on your device by Apple's on-device speech recognition; no audio is recorded, kept or sent. Only the words become your message (an organization's record notes that the message was dictated). Spoken replies are made on the device too.
- **The scanner's camera frames.** Barcodes and QR codes are read on your device; only the code's kind and value are sent.
- **Payment details.** If you ever buy something in the app, Apple handles the payment; we never see a card or payment method.

## What we don't do

- **We don't sell personal information**, and we don't "share" it for cross-context behavioral advertising, as California law uses those words.
- **We don't run advertising** in the app or on this site, and we don't use your information to target ads anywhere.
- **We don't track you** across other companies' apps or websites. The app declares no tracking and no tracking domains to Apple.
- **We don't put analytics, telemetry or crash-reporting libraries in the app.** The app includes no third-party software development kits. (Apple's own crash reporting, if you allow it, is described above.)
- **We don't train AI models** on anything you or your organization send through Streamliner, and we don't give it to anyone to train theirs. Whether an AI provider may use what it receives is set by its terms with you or your organization (see *AI providers*). If we ever wanted to change this, we would ask first, and the change would apply only to information sent after you agreed.
- **We don't store anything about your work from free use on your own device.**
- **We don't keep the assistant's requests and answers in the relay.** The organization's chat record is kept because the organization wants it, for as long as it chooses.
- **We don't see what you enter in secure forms.**
- **We don't hold a service account that can do more than you.** The assistant acts with your own sign-in, and your organization's systems decide what it may do.
- **We don't store your location or your IP address** with your account.
- **We don't record your voice**, and we don't keep camera images from the scanner.
- **We don't use the contents of your organization's chats for our own purposes**, such as marketing or product research. We may use counts that contain no content (such as how many requests the service handles) to run the service.

## AI providers, and what is sent to them

Streamliner's assistant is a large language model run by an AI provider. Today that provider is **Anthropic** (Claude). Others may be added; the app names each one before it is used.

**You are asked first.** Before anything you write is sent to an AI provider, the app shows a screen called *Before the assistant answers*, which names the provider, says what is sent and where it goes, and asks you to **Allow** or **Don't allow**. In an organization it still asks you personally: your organization chose the provider, but whether your words go to it is your agreement to give. If you choose *Don't allow*, nothing goes to that provider and the assistant won't answer. You can change your answer at any time in Settings, under **AI providers**. You are asked again if a streamline starts using a different provider. Your answer is stored on your device. The Meridian demo never asks, because its assistant is scripted on your device and sends nothing anywhere.

**What is sent:** what you write; files you attach (photos stripped of location and camera details); the code values you scan; the results of the tools the assistant uses for you (for example, a customer record, an order, a search result); the conversation so far, so it can answer in context; and the streamline's instructions. Ordinary business information, including customers' names, contact details and purchase history, may be in it, because understanding and organizing that information is the assistant's job. Values entered in secure forms are not.

**Under whose agreement:**

- **On this device (free)**, requests go from your device to the provider with **your own key**, under **your own agreement with the provider**.
- **In an organization**, requests go through our relay with **the organization's key**, under **the organization's agreement with the provider**. The organization's arrangement with the provider (for example, how long the provider keeps requests, or whether it has a zero data retention arrangement) governs that processing.
- **One exception: the Concierge.** When an owner or admin uses the Concierge to change an organization's setup, the Concierge sends that setup (including private instructions) to the AI provider **from the device, with that person's own key**, under their own agreement with the provider.

**What the provider does with it** (how long it keeps requests, whether it reviews them for safety, whether it uses them to improve its models) is decided by the provider and your or your organization's agreement with it, not by us. Read its terms and privacy policy and, if you are an organization, choose the account type and settings that fit your obligations. Anthropic's are at [anthropic.com/legal](https://www.anthropic.com/legal).

**The assistant can be wrong.** It can misread what you wrote, misread a tool's result, or say something untrue. Streamliner holds the steps a streamline marks as irreversible until you tap to confirm, and draws what is done from the systems' own results rather than from the assistant's words, but you should still check what matters. See our [Terms of Service](/terms).

## The systems a streamline connects to

A streamline does its work through servers (MCP servers) and APIs that belong to your organization or to other companies. **We don't run them and we can't see into them.** When the assistant uses a tool, your device calls that server directly with your own sign-in, and the server receives what the tool needs (often including information you gave in the chat), keeps its own records, and applies its own rules and policies.

- In an organization, the organization chose those servers and is responsible for them.
- On this device, **you** chose them. Before connecting a server, check who runs it, what it will receive, and its privacy policy.
- Sign-in pages for those systems belong to them; your password there goes to them, not to us.

## Streamlines from other people

You can import a streamline from a file someone sends you, or get one from a link someone shares. A streamline decides which servers your chats reach and which instructions the assistant follows, so **a streamline from someone else can send your information to places that someone chose.**

- **For a streamline shared by link**, Streamliner shows who shared it, checks that it hasn't been altered since it was signed, and shows what it connects to before you get it.
- **A streamline imported from a file has no such check**: it is added as it is.

In neither case do we vet the publishers, their servers or their policies. Check them before you use a streamline, especially before giving it anything personal or confidential.

## Issue reports

You can report a bug or suggest a feature from the app (**Report an Issue**) or from our support page. A report carries:

- what you type: a title, a description and, if you choose, a screenshot (re-encoded with its hidden details, such as a location, removed);
- **your name and email only if you enter them**; leave both blank and the report is anonymous;
- the app's version and build number, the platform and operating system version, your device's model, and your language and region setting;
- the reference of the chat open when you report, if any, so we can find it if we need to, but **none of its content**.

It never carries your chats, keys or sign-ins. Reports go through Manolab's issue-reporting service, which runs on Cloudflare, uses your IP address to limit abuse and passes it to Cloudflare's Turnstile check, which tells people from automated abuse. The report becomes an issue in a private issue tracker we keep on GitHub; a screenshot is kept by the reporting service at an unguessable address linked from the issue. Reports are not public. Don't put anything in a report you wouldn't want our team to read. To have a report removed, or your name or email taken off it, ask us (see *Contact*).

## This website

streamliner.work uses no advertising or analytics cookies and runs no analytics or tracking pixels. Cloudflare, our host, may set a strictly necessary security cookie to tell people from automated traffic. If you choose a theme, the choice is remembered in your browser's own storage and never sent to us. The report form on the support page loads Cloudflare's Turnstile check, run by Cloudflare under its own privacy policy. Like any website, our host processes the technical information every web request carries, such as your IP address, to deliver the page and protect it from attack. We don't allow third parties to collect information about you across sites through our pages.

**Do Not Track and Global Privacy Control.** Because we don't track you across sites or sell or share your information, we treat these signals as already honored: there is nothing for them to switch off.

Pages for a streamline shared by link (at `/s/…`) show only what its publisher shared.

## Who we share information with

We share information only as this policy describes:

- **Service providers** who run parts of the service for us, under contracts that limit their use of it: Cloudflare (hosting, storage, email delivery, abuse protection) and GitHub (issue reports). See the [subprocessor list](/privacy/subprocessors).
- **The AI provider** your organization (or you) chose, with the content described above, under your or its agreement with that provider.
- **Your organization**, for information in its account: its owners and admins can see its members, their sessions and usage, its activity log and its chat records.
- **Apple**, where you use Apple's services (Sign in with Apple, iCloud, the App Store).
- **When the law requires it**: to respond to valid legal process, after checking it is valid and, where we can, telling the organization or person concerned first. For an organization's data, we will direct a request to the organization where we can.
- **To protect people and the service**: to investigate fraud, abuse or security incidents, or to protect the rights, property or safety of our users, the public or us.
- **If our business changes hands**: in a merger, acquisition or sale of assets, information may pass to the new owner. We will tell organization owners (and anyone else we can reach) before the transfer, and the new owner will be bound by this policy for the information it receives.

## How long we keep information

| What | How long |
|---|---|
| Anything about your work from free use | We hold none. On your device and iCloud: as long as you choose. |
| Organization chats on your device | The organization's setting (two days unless it chooses otherwise); removed when you leave, sign out or your access ends |
| Organization chat records (transcripts) | The organization's setting (365 days after last activity unless it chooses otherwise; or until the account is deleted) |
| Attached files | 7 days after last use (the organization may set 1 to 30), then a content-free marker for 30 days |
| Detailed usage records | 90 days |
| Usage totals | Daily totals for about two months, then monthly totals for as long as the account exists |
| Refusal records | 90 days |
| Activity log | 2 years (records of publishing-device and model-key changes: as long as the account exists) |
| Sign-in sessions | Until signed out; at most 30 days without use and 90 days in all |
| Email sign-in codes and other one-time sign-in steps | 15 minutes or less |
| Abuse-prevention counters | Hours |
| Invitations | They stop working after 7 days; the record stays until it is used, withdrawn or the account ends |
| Membership, directory and setup | For the life of the organization's account, or until the organization removes you |
| Links shared through Discover | Until the organization stops sharing them |
| Issue reports | Until the issue is closed, plus up to [two] years, unless you ask us to remove them sooner |

**When an organization's account ends**, we delete its hosted data as our agreement with it provides, within [N] days of the end of any grace period it sets out, and confirm the deletion to an owner in writing. [Counsel: once the automated process ships, add: "Deletion first destroys the account's own encryption key, which makes anything left behind unreadable, and then the data itself. We keep only a record that the account existed and when it was deleted."]

**When you leave an organization** in the app, the app signs this device out and removes the organization's data from it. Your membership ends when the organization removes you, so ask it to. When it does, your membership and sessions end. The organization's records of your past chats, usage and activity stay under its control and retention, because they are its business records.

## Your rights

Your rights depend on who decides how the information is used.

### Information Manolab controls

This is: issue reports, this website, our business contacts, and the running and securing of the service. For this information, wherever you live, you can ask us to:

- tell you what personal information we hold about you, and give you a copy;
- correct it if it is wrong;
- delete it;
- stop or limit using it, or object to how we use it;
- withdraw a consent you gave.

We won't treat you differently for asking. We answer within 45 days (we will tell you if we need longer, as the law allows), and if we decline, you can appeal by replying to our answer.

### Information held for an organization

For information in an organization's account, **we act as the organization's service provider**. Send your request to your organization. If you send it to us, we will forward it to the organization (with your permission) and help it respond, as our agreement with it requires, and we won't respond to it ourselves except as the organization directs or the law requires. You can see and end your own signed-in devices yourself, in the Vault under *Signed-in devices*.

**Deleting your sign-in.** Today you can ask us to delete your Streamliner sign-in (your email, Apple identifier and sessions) through the contact details below; we will confirm when it is done and how long it took. Your organization's records of your work stay under its control. [Counsel: replace with the in-app path once *Delete my sign-in* ships.]

### If you use Streamliner only on your own device

We hold nothing about your work, so there is nothing for us to give, correct or delete. Your streamlines, keys and chats are on your devices and in your iCloud, under your control: delete them in the app, and use *Remove from iCloud…* to remove them from iCloud.

### People in the European Economic Area, the United Kingdom and Switzerland

For information Manolab controls, this is why we use it and on what legal basis:

| Purpose | Information | Legal basis | How long |
|---|---|---|---|
| Fixing what you report | Your report, its diagnostics, and your name and email if you give them | Our legitimate interest in fixing and improving the product; your consent for the optional name and email | As in the retention table |
| Delivering and protecting this website and the service | Request details such as IP address | Our legitimate interest in keeping the service available and secure | Hours to days, in our host's logs |
| Your sign-in identity and sessions, where we use them to secure the service | Email, Apple identifier, session details | Performing our contract with you or your organization; our legitimate interest in security | As in the retention table |
| Complying with the law | What a valid legal request concerns | Legal obligation | As the law requires |

Giving us your name or email in a report is optional; without them, we can't reply to you. We don't make decisions about you based solely on automated processing. We have not appointed a data protection officer. [Counsel: decide whether an EU/UK representative is required under Article 27 and add its details.] For information we hold for an organization, the organization's legal basis applies.

You have the rights of access, rectification, erasure, restriction and portability, and the right to complain to your local data protection authority.

**Your right to object.** Where we rely on our legitimate interests, you can object at any time, on grounds relating to your situation, and we will stop unless we have compelling legitimate grounds or need the information for legal claims.

### Residents of California and other US states with privacy laws

California, Colorado, Connecticut, Virginia, Texas, Oregon and other states give residents rights over their personal information, including to know, access, correct and delete it, to obtain a portable copy, and to opt out of its sale, of sharing for targeted advertising, and of profiling with legal or similarly significant effects. **We don't sell or share personal information, don't use it for targeted advertising, and don't use it for such profiling**, and we don't use sensitive personal information to infer characteristics about anyone. [Counsel: Manolab may not meet these laws' thresholds today; decide whether to keep this section as a voluntary commitment.]

For information Manolab controls, in the last 12 months we collected these categories, from you or your device, for the purposes above, and disclosed them only to the service providers listed under *Who we share information with*:

- **Identifiers**: name and email address (only if you give them in a report), and the technical identifiers of requests.
- **Internet or other electronic network activity**: request details, and the diagnostics in a report.

For information held for an organization, the organization's own notice at collection applies. It typically covers: identifiers (name, email, member and session identifiers, the Sign in with Apple identifier); network activity (usage records, refusal records, session times, device name and platform); professional information (your organization, access level and roles); the content of your chats and attachments; and account sign-in credentials (passwords pass through once and aren't stored; codes are kept only as hashes).

You, or an agent you authorize, can use these rights through the contact details below. We will verify your request (usually by confirming an email address you gave us) before acting on it. If you are not satisfied with our answer to an appeal, you can contact your state attorney general.

## International transfers

Manolab is in the United States, and our service runs on Cloudflare's global network. Information may be processed in the United States and other countries whose laws differ from yours.

- **For an organization's data**, where the law requires a transfer mechanism (for example, for information from the EEA, the UK or Switzerland), we rely on the European Commission's Standard Contractual Clauses (with the UK's addendum and the Swiss amendments), set out in our data processing agreement with the organization.
- **When you send us an issue report from outside the US**, you send it to us in the United States. [Counsel: name the mechanism relied on for this controller data; Manolab is not certified under the Data Privacy Framework.]

## Children

Streamliner is a tool for work and for adults. It is **not directed at children**, and you must be at least 18 (or the age of majority where you live) to use it. We don't knowingly collect personal information from anyone under 18, and never knowingly from a child under 13. If you believe a child has given us personal information, contact us and we will delete it.

## Changes to this policy

When we change this policy, we will update the effective date at the top and keep earlier versions [published on this site]. If a change is material, we will tell you before it takes effect, in the app or by email to organization owners. A change that would let us use information in a way *What we don't do* rules out applies only to information collected after the change, and only with your consent.

## Contact

Questions, requests, or something on this page you think is wrong:

- **Email:** [privacy contact email, to be set up]
- **The form on our [support page](/support)** (say it's a privacy request; leave out anything sensitive)
- **Post:** Manolab, LLC, [postal address]

We read every message.

**Manolab, LLC**