1. Who We Are
ChiefofStaff is operated by:
Sonnet Advisors
Contact: craig@sonnetadvisors.com
Sonnet Advisors is the data controller responsible for decisions regarding the processing of Personal Data under this Privacy Policy.
The application is hosted on secure cloud infrastructure.
2. Scope
This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you use:
- The ChiefofStaff mobile or web application
- Associated services and integrations
- Website and customer support communications
This Policy applies globally, including users in the United States, European Union (EU), European Economic Area (EEA), and United Kingdom (UK).
3. Data We Collect
We collect only the data necessary to provide the Service.
A. Account Information
- First and last name
- Email address
- Organisation name
- Account credentials
- Profile image (if uploaded)
B. Voice Data
- Voice recordings (temporary, processed for transcription and immediately deleted after transcription)
- Transcriptions of voice commands (retained up to 30 days or until account termination)
C. Task and Execution Data
- Tasks and reminders
- Internal team assignments
- Meeting notes
- Email summaries
- Calendar events
D. Internal Contacts
The App does not access or import device phone contacts.
Users may manually create internal contacts consisting of:
- First name
- Last name
- Email address
Contacts are created only when:
- The user manually enters them, or
- The user gives a voice command and confirms creation in a permission popup.
Clear in-app disclosure explains how contact data is stored and used.
E. Integration Data (If Connected)
If you connect Google or Microsoft accounts, we may process:
- Email content and metadata
- Calendar events
- Contact names and email addresses from integrated accounts
We access only the data necessary to provide core functionality (summarisation, task creation, scheduling).
F. Technical Data
- Device type
- IP address
- Log data
- Usage analytics
- Security event logs
4. How We Collect Data
We collect data through:
- Direct user input
- Voice microphone (with explicit permission)
- Integration APIs (Google/Microsoft, if enabled)
- Automated system logs
We do not scrape, purchase, or import phone contact lists.
5. Legal Bases for Processing (GDPR)
For EU/EEA/UK users, processing is based on:
| Data Type | Legal Basis |
|---|---|
| Account data | Contract performance |
| Voice transcription | Contract + Consent |
| Email/calendar integration | Consent + Contract |
| Internal contacts | Contract |
| Security logs | Legitimate interest |
| Compliance records | Legal obligation |
Users may withdraw consent for integrations at any time by disconnecting accounts.
6. How We Use Personal Data
We use data solely to:
- Provide the intent orchestration service: turning your instructions into executed work
- Transcribe and process voice commands
- Summarise emails
- Create and manage tasks
- Manage calendars
- Enable team collaboration
- Provide customer support
- Ensure security and fraud prevention
- Comply with legal obligations
We do not:
- Sell personal data
- Use email or calendar content for advertising
- Build marketing profiles from sensitive integrations
- Use integration data for data mining
Sensitive data from email and calendar integrations (including email content, calendar events, and associated metadata) is used exclusively to provide the core Service functionality described above. This data is not used for marketing, advertising, or any form of use-based data mining, either by us or by any third-party service providers, subprocessors, or analytics partners.
7. Google User Data
What ChiefofStaff does with it
If you connect a Google account, ChiefofStaff reads your Gmail messages, creates and sends drafts, and reads and creates events on your primary Google Calendar, only when you ask it to in a message or voice note. ChiefofStaff's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Artificial intelligence
To understand your request and write the reply, the text of your message, and any mail or calendar content needed to answer it, is sent to OpenAI in the United States, under enterprise terms that forbid OpenAI from using it to train any model. ChiefofStaff does not use Google user data to train, develop or improve any artificial intelligence or machine learning model, its own or anyone else's.
No other use
Google user data is not sold, not used for advertising, and not read by people, except with your explicit consent for a specific support request, where necessary for security, or where the law requires it.
Storage and deletion
Your conversation history, the text of each request and reply including any reply that quotes mail or calendar content, is kept for 24 hours by default, or for up to 30 days where your organisation sets a longer period, and is then deleted automatically. You can clear it yourself at any time. Separately, the automation system that carries out each request keeps a working record of it, which can include the same content, for no more than 14 days, and then deletes it automatically. Clearing your conversation history does not remove these records early. Disconnecting your Google account revokes ChiefofStaff's access at once. You can ask for your data to be deleted at any time by writing to privacy@chiefofstaff.pro.
8. Data Retention
| Data Type | Retention Period | Deletion Trigger |
|---|---|---|
| Voice recordings | Immediately deleted after transcription | Automatic |
| Transcriptions | Up to 30 days | Automatic deletion or account termination |
| Conversation history | 24 hours by default, up to 30 days if your organisation sets it | Automatic deletion, or when you clear it |
| Processing records of each request | Up to 14 days | Automatic deletion |
| Account data | Duration of subscription | Account deletion |
| Task and execution data | Duration of subscription | Account deletion |
| Integration data | While integration is active | Disconnection or account deletion |
| Security logs | Up to 12 months | System rotation |
Upon account termination, personal data is deleted or anonymised within a commercially reasonable timeframe unless retention is legally required.
9. International Data Transfers
All data is hosted in the United States.
For EU/EEA/UK users, transfers are safeguarded by:
- Standard Contractual Clauses (EU 2021/914)
- UK International Data Transfer Addendum (where applicable)
- Technical and organisational security measures
- Contractual safeguards with subprocessors
10. Automated Decision-Making
The Service uses AI to process commands and summarise information.
The Service does not make decisions producing legal or similarly significant effects without human involvement.
Users retain full control over actions taken based on AI-generated outputs.
11. Your Rights
EU/EEA/UK Users
You have rights to:
- Access
- Rectification
- Erasure
- Restrict processing
- Data portability
- Object to processing
- Lodge complaints with supervisory authorities
California Residents (CCPA/CPRA)
You have rights to:
- Know what personal information is collected
- Request deletion
- Correct inaccurate data
- Opt out of sale (we do not sell data)
Requests may be submitted to: privacy@chiefofstaff.pro
12. Security Measures
We implement:
- Encryption in transit
- Role-based access control
- Limited internal access
- Secure U.S. infrastructure
- Contractual subprocessor safeguards
13. Subprocessors
We may use third-party service providers to host or support the Service.
A current list of subprocessors is available upon request at: privacy@chiefofstaff.pro
All subprocessors are contractually required to provide appropriate data protection safeguards.
Third-party service providers and subprocessors are contractually prohibited from using data accessed through Google and Microsoft integrations (including email content, calendar events, and contacts) for any purpose other than providing the Service. They may not use this data for marketing, advertising, targeted profiling, or use-based data mining.
14. Data Protection Officer
We have not appointed a Data Protection Officer as our processing activities do not require one under Article 37 GDPR.
15. EU and UK Representatives
Where required under Article 27 GDPR and UK GDPR, we will appoint a representative within the EU and United Kingdom and publish their contact details here.
16. Contact Us
For questions about this Privacy Policy or to exercise your rights, contact us at:
privacy@chiefofstaff.pro