Privacy Policy

1. Information We Collect

Account Information

Email address, name, and optionally business name and logo collected at signup.

Documents & Content

Contracts, proposals, invoices you create, including client information added to them.

Payment Information

Payment processing is handled by Stripe. We never store your full credit card number. Transaction records are kept for your dashboard and accounting.

Time Tracking & Task Data

Time entries, task descriptions, project assignments, productivity data, and focus mode sessions when you use our time tracking and task management features.

AI Conversations & Memories

Messages you send to Accordio's AI assistant, AI-generated responses, and persistent memories the AI stores about your preferences, work style, and business context to provide personalized assistance. You can view and delete these memories at any time.

Integration Data

When you connect third-party services (such as Notion, Todoist, Asana, or others), we receive and store data synced from those platforms, such as tasks, projects, and calendar events, only as needed to provide our service.

Usage Data

Pages visited, features used, device information, and interaction patterns collected through analytics services to improve the product. See Section 15 for details on cookies and tracking.

Biometric Data

Accordio does not collect, use, or store biometric data (such as fingerprints, facial recognition data, or voiceprints).

2. How We Use Your Information

• Providing and maintaining all platform features
• Processing payments and payouts through Stripe
• Sending important notifications (contract signed, payment received, deadline reminders)
• AI-powered features including contract generation, suggestions, and the AI assistant
• Syncing data with third-party tools you connect (Notion, Todoist, Asana, etc.)
• Delivering messages through connected messaging platforms (Telegram, Slack, WhatsApp)
• Time tracking, task management, and productivity insights
• Customer support
• Product improvement based on aggregated usage patterns
• Fraud prevention and rate limiting

3. AI & Your Data

Accordio uses AI for contract/proposal creation, an intelligent assistant (AGI COO), and productivity features. Our AI is powered by the following providers:

• Anthropic Claude — Primary AI model for document generation, chat, and business intelligence
• Google Gemini — Secondary AI model used for specific features
• Brave Search — Web search capabilities for AI-assisted research

How your data interacts with AI:

• Document content is sent to AI providers for suggestions and generation
• Your business context (contracts, clients, projects) may be provided to the AI assistant for personalized help
• AI stores persistent memories about your preferences and work style to improve assistance over time
• Content sent to AI providers is not used to train their models
• AI conversations are stored on our servers for context continuity
• You can view, manage, and delete AI memories and conversation history at any time
• AI-generated content (contracts, proposals, suggestions) is not legal advice

4. Who We Share Data With

We share data with the following service providers (sub-processors) as necessary to operate Accordio:

Core Infrastructure

• Supabase — Database, authentication, file storage, and real-time features (PostgreSQL hosted infrastructure)
• Vercel — Web application hosting, edge functions, and web analytics
• Upstash — Serverless Redis for rate limiting and caching (no personal data stored)

Payments

• Stripe — Payment processing, payouts, escrow, and Stripe Connect for freelancer accounts

AI Providers

• Anthropic — Primary AI model (Claude) for document generation, AI assistant, and business intelligence
• Google AI — Secondary AI model (Gemini) for specific features
• Brave Search — Web search for AI-assisted research and information retrieval

Communications

• Resend — Transactional emails (contract notifications, payment receipts, etc.)

Analytics & Monitoring

• PostHog — Product analytics for understanding feature usage and improving the product (EU-hosted)
• Google Analytics — Website traffic analysis and marketing attribution
• Sentry — Error monitoring and crash diagnostics to maintain service reliability

We do not sell your personal data. Data may also be shared if required by law, to protect our rights, or in connection with a business transfer (merger, acquisition, etc.).

5. Third-Party Integrations

Accordio allows you to connect third-party productivity and project management tools to centralize your workflow. Integrations are optional and initiated by you.

Available Integrations

• Notion — Tasks, pages, and project data
• Todoist — Tasks and to-do items
• Asana — Projects and task management
• ClickUp — Tasks and workspace data
• Linear — Issues and project tracking
• Trello — Boards, lists, and cards
• Jira — Issues and project data

How Integration Data Works

• Integrations use OAuth 2.0 – we never see or store your third-party passwords
• We only access the scopes and data you explicitly authorize
• Synced data (tasks, projects, events) is stored on our servers to provide cross-platform features
• You can disconnect any integration at any time from Settings, which stops future data syncing
• Previously synced data is deleted within 30 days of disconnecting
• Each integration’s own privacy policy also applies to data on their platform

6. Messaging & Desktop App

Messaging Platforms

Accordio's AI assistant can be accessed through messaging platforms. When you use these features:

• Telegram — Messages sent to the Accordio bot are received via the Telegram Bot API
• Slack — Messages in connected Slack workspaces are received via the Slack API
• WhatsApp — Messages are received through Twilio’s WhatsApp Business API

Message content is processed by our AI to provide responses and execute actions (creating contracts, logging time, managing tasks). Messages and conversation context are stored on our servers. Each messaging platform's own privacy policy applies to data on their platform.

Desktop App (Accordio AGI)

Our macOS desktop app provides quick access to the AI assistant and time tracking. The desktop app:

• Communicates with the same Accordio API as the web app
• Stores authentication tokens locally on your device
• Time tracking data and AI conversations are synced to your Accordio account
• No additional data is collected beyond what the web app collects
• You can sign out at any time to remove local authentication data

7. Data Security

• All data transmitted over HTTPS (TLS encryption)
• Database encryption at rest (Supabase/PostgreSQL)
• Row-level security (RLS) policies for access control
• OAuth 2.0 for all third-party integrations – no passwords stored
• API rate limiting to prevent abuse (via Upstash Redis)
• Regular security audits
• SOC 2 compliant infrastructure providers

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR. If the breach is likely to result in a high risk to you, we will also notify you directly without undue delay. We will comply with all applicable data breach notification requirements under US state laws, including any state-specific notification timelines.

8. Your Rights

• Access — Request a copy of all your data
• Correct — Update inaccurate information
• Delete — Request account and data deletion
• Export — Download your contracts, documents, and time entries
• Opt-out — Unsubscribe from marketing emails
• AI Memories — View, manage, and delete AI memories stored about you
• Integrations — Disconnect any third-party integration at any time

Contact: privacy@accordio.ai

9. California Residents (CCPA/CPRA)

California residents can:

• Know what personal information is collected and how it's used
• Delete personal information (with exceptions)
• Opt-out of the “sale” or “sharing” of personal information
• Receive non-discrimination for exercising rights
• Correct inaccurate information
• Limit the use of sensitive personal information

We do not sell personal information. We share data with service providers solely to operate Accordio, which is not considered a "sale" under the CCPA/CPRA.

"Do Not Sell or Share My Personal Information"

As stated above, we do not sell or share your personal information for cross-context behavioral advertising. If you wish to exercise your right to opt out, you may email us at privacy@accordio.ai with the subject "Do Not Sell or Share."

Global Privacy Control (GPC)

We honor Global Privacy Control (GPC) signals sent by your browser as a valid opt-out request under the CCPA/CPRA and other applicable US state privacy laws that require recognition of universal opt-out mechanisms.

Email privacy@accordio.ai with "California Privacy Request". We'll respond within 45 days.

10. Other US State Privacy Laws

If you reside in a US state with a comprehensive consumer privacy law (including but not limited to Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Indiana, Iowa, Tennessee, Delaware, New Hampshire, New Jersey, Kentucky, Nebraska, Maryland, Minnesota, and Rhode Island), you may have the following rights under your state's law:

• Right to know and access your personal data
• Right to correct inaccurate data
• Right to delete your personal data
• Right to data portability
• Right to opt out of targeted advertising, profiling, or the sale of personal data
• Right to non-discrimination for exercising these rights

We do not sell personal data or use it for targeted advertising. We honor Global Privacy Control (GPC) signals as a valid universal opt-out mechanism where required by state law.

To exercise your rights, email privacy@accordio.ai with "State Privacy Request" and your state of residence. We will respond within the timeframe required by your state's law (typically 45 days).

If we deny your request, you may appeal by contacting us at the same email address. We will process your appeal within the timeframe required by your state's law.

11. European Economic Area & Switzerland (GDPR)

Legal bases for processing:

• Contract Performance — Providing services you signed up for
• Legitimate Interest — Security, fraud prevention, product improvement, analytics
• Legal Obligation — Tax and financial regulations
• Consent — Optional marketing, analytics cookies, third-party integrations

Your GDPR rights include:

• Access, correct, or delete data
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Not be subject to solely automated decision-making with legal or significant effects (see Section 13)

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection supervisory authority if you believe your data is being processed unlawfully. A list of EU/EEA data protection authorities is available at edpb.europa.eu.

Data Protection Contact: privacy@accordio.ai

12. United Kingdom (UK GDPR)

If you are located in the United Kingdom, your personal data is protected under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data Use and Access Act (DUAA) effective February 5, 2026. In addition to the rights listed in Section 11, the following UK-specific provisions apply:

Legal Bases for Processing

We process your data under the same legal bases as outlined in Section 11 (contract performance, legitimate interests, legal obligation, and consent), applied in accordance with UK GDPR requirements.

International Transfers from the UK

When your data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (UK IDTA) or UK Addendum to the EU Standard Contractual Clauses, as approved by the UK Information Commissioner's Office (ICO), to ensure adequate protection. See Section 14 for more details.

Automated Decision-Making

Under the reforms introduced by the DUAA, you have the right to be informed about and to challenge decisions made solely by automated means that have a significant effect on you. See Section 13 for details on how we handle automated decision-making.

Your UK-Specific Rights

• All rights listed in Section 11 (access, correction, deletion, portability, objection)
• Right to meaningful information about the logic of automated decisions
• Right to request human review of automated decisions that significantly affect you

Right to Lodge a Complaint

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

13. Automated Decision-Making

Accordio uses AI and automated systems in the following ways:

• AI-generated content — Contracts, proposals, and suggestions are generated by AI as drafts for your review. No document is sent or finalized without your explicit action
• AI assistant — Provides business insights, reminders, and recommendations based on your data. These are suggestions, not binding decisions
• Fraud prevention — Automated systems may flag or rate-limit suspicious activity to protect the platform
• Analytics — Aggregated usage patterns help improve the product but are not used to make individual decisions about you

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects on you without human involvement. If you believe an automated decision has significantly affected you, you have the right to:

• Request an explanation of the logic involved
• Request human review of the decision
• Express your point of view and contest the decision

Contact privacy@accordio.ai to exercise these rights.

14. International Data Transfers

Data is processed in the United States where most of our service providers operate. PostHog analytics data is processed in the EU.

Transfer Safeguards

We ensure that international data transfers are protected using the following mechanisms:

• EU-US Data Privacy Framework (DPF) — Where applicable, we rely on our service providers’ participation in the EU-US Data Privacy Framework for transfers from the EEA to the US
• Standard Contractual Clauses (SCCs) — We enter into EU Commission-approved Standard Contractual Clauses with service providers that process data outside the EEA, where the DPF does not apply
• UK International Data Transfer Agreement (UK IDTA) — For transfers from the UK, we use the UK IDTA or the UK Addendum to the EU SCCs, as approved by the ICO
• Swiss-US Data Privacy Framework — For transfers from Switzerland, we rely on the Swiss-US DPF or equivalent safeguards

When you connect third-party integrations, your data may also be processed in the locations where those services operate, subject to their own privacy policies. You may request a copy of the transfer safeguards we rely on by contacting privacy@accordio.ai.

15. Cookies & Tracking

Essential Cookies (Required)

• Authentication cookies (Supabase) — Keep you logged in and maintain your session
• Payment security cookies (Stripe) — Fraud prevention and secure payment processing

Analytics

• PostHog — Product analytics to understand how features are used and improve the platform. Hosted in the EU. Collects page views, feature usage, and session data
• Google Analytics — Website traffic analysis and marketing attribution. Uses cookies to track visits and user behavior across sessions
• Vercel Analytics — Anonymous, aggregated web performance metrics with no cookies or individual tracking

Error Monitoring

• Sentry — Captures error reports and crash diagnostics to keep the service reliable. May include technical context like browser type and URL, but not personal content

Global Privacy Control (GPC)

We recognize and honor Global Privacy Control (GPC) signals sent by your browser. When we detect a GPC signal, we treat it as a valid opt-out request for the sale or sharing of personal information and for targeted advertising, as required by applicable US state laws.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect your ability to use Accordio.

16. Data Retention

• Account data — Retained while your account is active
• Contracts & Documents — Until you delete them
• Payment records — 7 years (legal requirement)
• Time tracking entries — Until you delete them or close your account
• AI conversations — Until you delete them or close your account
• AI memories — Until you delete them individually or close your account
• Integration sync data — Deleted within 30 days of disconnecting the integration
• Messaging history — Until you delete it or close your account
• Analytics data — Retained in aggregated form; individual data follows provider policies
• After account deletion — All data removed within 30 days, except payment records (7 years)

17. Children's Privacy

Accordio is designed for business professionals and freelancers. We do not knowingly collect data from anyone under the age of 18. If we learn that we have collected personal data from a minor, we will delete it promptly.

18. Changes to This Policy

Significant changes will be notified via email or in-app notification at least 14 days before they take effect. Minor clarifications and formatting changes take effect immediately when posted. The "Last updated" date at the top of this page reflects the most recent revision.

19. Contact Us

General inquiries: hi@accordio.ai

Privacy requests: privacy@accordio.ai

Website: www.accordio.ai

By using Accordio, you agree to this Privacy Policy.

© 2026 Deduxer SRL. All rights reserved.