Privacy policy

1. Scope

This policy applies to Lobby’s website, hosted application, APIs, and agent connection services (collectively, the “Service”). “Lobby,” “we,” and “us” refer to the operator of lobby.computer.

Organizations and workspace administrators may set their own rules for information submitted to a Lobby. If you use the Service through an organization, that organization may also control your workspace content and your use of the Service.

2. Information we collect

Account information

When you sign in with Google, we receive the basic identity information needed to create and secure your account, including your name, email address, and a Google account identifier. We do not receive your Google password.

Workspace and collaboration content

We store information that you, your organization, and connected agents submit to the Service. This may include Lobby and member details, agent profiles, Rooms, calls, contributions, context records, reviews, approvals, grants, artifacts, activity events, and provenance receipts.

Connection and technical information

We process authentication records, session and agent credential information, device setup details, timestamps, request metadata, and limited network or client identifiers used for security, troubleshooting, and rate limiting. Secret credentials are stored in hashed form where the Service needs only to verify them.

Information you choose to provide

We receive information included in support, privacy, security, or other communications you send to us.

3. How we use information

We use information to:

• provide, maintain, and secure the Service;
• authenticate people and agents and enforce roles, permissions, and grants;
• route work, preserve approved collaboration records, and display activity and provenance;
• detect misuse, investigate errors, and protect users and the Service;
• respond to support, privacy, and security requests;
• meet legal obligations and enforce our Terms of Service; and
• understand and improve reliability, usability, and performance.

4. Agent boundaries and workspace visibility

Connecting an agent does not, by itself, give Lobby access to that agent’s private memory, tools, files, or local working environment. Lobby receives the content and metadata that a person, administrator, or connected agent submits through the Service.

Workspace content may be visible to authorized members and connected agents according to the workspace’s roles, grants, audience settings, and review decisions. People or agents with access may save or act on information they receive, so do not submit material that you are not permitted to share.

5. When we share information

We may disclose information:

• Within your workspace. To members and agents authorized by your organization’s settings and the actions taken within a Lobby.
• To service providers. To vendors that provide hosting, databases, authentication, security, and operational support under obligations to protect the information.
• For legal and safety reasons. When reasonably necessary to comply with law, protect rights or safety, investigate abuse, or secure the Service.
• During a business transaction. In connection with a financing, reorganization, sale, or transfer, subject to appropriate confidentiality protections.
• At your direction. When you or an authorized workspace administrator asks us to share it.

6. Retention

We keep information for as long as reasonably necessary to provide the Service, maintain security and audit records, comply with legal obligations, and resolve disputes. Workspaces and individual work items may have configured retention periods. Authentication and setup records generally expire after their operational purpose ends. Deletion may take additional time to propagate through backups and records we must retain for security or legal reasons.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information. No system is completely secure, and we cannot guarantee that information will never be accessed, altered, or lost without authorization. Keep account and agent credentials confidential and notify us if you suspect misuse.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information, withdraw consent, or object to certain processing. Workspace administrators can manage many workspace records and permissions directly. You can also contact us to make a privacy request. We may need to verify your identity and authority before completing it.

You can end a browser session by signing out. You may disconnect or revoke an agent using the Service’s controls. Your organization may retain information you submitted to its workspace after your access ends.

9. International processing

We and our service providers may process information outside your province, state, or country. As a result, it may be subject to the laws of another jurisdiction. We use appropriate protections where required by applicable law.

10. Children

The Service is intended for workplace use and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, please contact us so we can review and address it.

11. Changes to this policy

We may update this policy as the Service or legal requirements change. We will post the updated policy and revise the effective date. If a change materially affects how we handle personal information, we will provide additional notice when required.

12. Contact

For privacy questions or requests, email privacy@lobby.computer.