Configure privacy & data

When you integrate the Configure SDK or API into your application: You act as a data controller for your end users. Configure processes data on your behalf as a data processor .

we collect and store identity information (such as name, email, bio, occupation, interests, and location)

Your phone number is stored as an irreversible cryptographic hash, together with its last four digits so that you can recognise your account.

Gmail — account information, senders and recipients, subjects, dates, labels, and selected message snippets or bodies.

we also record your browser's user-agent string and a hashed form of it, together with a hashed form of your IP address.

For developers using the Configure API or SDK, we collect API keys, agent configurations, and usage metrics.

Verify your identity via phone OTP

Build and maintain your persistent user profile across agents and applications

Use AI to extract facts, preferences, and context from conversations, authorized connected tools, and what you and your assistants explicitly send

We use these records only to detect suspicious sign-in activity on your account.

Profile data is retained for as long as your account exists, or until you request deletion

Server logs are retained for up to 90 days

Your data is processed and stored in the US.

we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to provide adequate safeguards for international data transfers.

We use third-party service providers for identity verification, AI model inference, application hosting, OAuth integration management, caching, and static site delivery.

Configure provides deletion controls for stored profile information and chat history; you can also contact us to request erasure

Access your personal data and obtain a copy of the information we hold about you

Rectify inaccurate or incomplete data

Erase your data ("right to be forgotten")

Port your data to another service in a structured, machine-readable format

Restrict processing of your data in certain circumstances

Object to processing based on legitimate interest

Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

You must not sell, license, sublicense, rent, lease, or trade user profile data.