Privacy Policy

Information we handle

• Accounts: names, usernames, contact details supplied by you or your office, office membership, roles, password hashes, invitations, and password-reset records.
• Office work: tasks, agendas, events, notes, people and contact records, photographs, casework, office positions, floor messages and observations, watchlists, saved articles, and drafts. These records may contain information about staff, constituents, meeting participants, and other people.
• Correspondence: messages entered by staff or forwarded to an enabled office intake address, including subjects, bodies, sender and forwarder details, message identifiers, and thread history. Rejected intake may leave sender, recipient, time, and rejection-reason records.
• Calendar feeds: the feed address supplied by your office and the event information it makes available. A private feed address may itself grant access to calendar information; share only a feed your office has authorized.
• Zoom: the account connection, meeting content, and event information described below.
• Operation and security: session information, request and error metadata, rate-limit counters, service-health records, photo-access logs, and offboarding receipts. Hosting services may also process IP addresses, browser information, and request timestamps.

How information is used and accessed

We use this information to authenticate users, organize office work, deliver enabled integrations, respond to support and privacy requests, prevent misuse, and maintain service reliability. Shared office records are available to authorized members of that office according to their permissions. Saved items and private drafts belong to the individual account. Authorized Allogy operators may access information when needed to support, secure, or administer the service or handle an approved request.

We do not sell office information, use it for targeted advertising, or use it to train general-purpose AI models. We may disclose information when your office directs us to, to the service providers below to operate Gardner, or when required by law. A disclosure required by law remains subject to applicable legal protections.

Zoom and meeting information

An office administrator can authorize a Zoom connection through Gardner. An explicitly configured pilot account may also be linked to its designated office by an Allogy operator. Incoming events must match an active office connection or that configured pilot account; unmatched events are discarded.

Gardner may receive cloud-recording transcripts, available AI Companion transcripts, and AI Companion summaries, depending on your Zoom settings and permissions. We store meeting identifiers, topic and time, transcript text, available summary content, and related event metadata. Event payloads can include names, email addresses, recording metadata, and download locations. The webhook download token is removed before the event payload is stored. OAuth connections also store the Zoom account identifier, connecting account email, and access and refresh tokens.

Gardner retrieves transcript text, not meeting audio or video files. Your office is responsible for authorizing recording, transcription, and sharing and for giving participants the notices and choices required by its policies and applicable law.

Service providers and AI

• Vercel hosts Gardner and stores uploaded photos in private object storage.
• Neon provides Gardner’s managed PostgreSQL database.
• Resend handles invitation and password-reset email and enabled inbound email, including the message content and addressing needed for delivery.
• Zoom and your calendar provider process the integrations your office enables under those providers’ own terms and settings.
• GNews, Congress.gov, the House Clerk, and news publishers supply public information. Custom news queries are sent to GNews; do not put private office or constituent information into a news search. Opening a source link takes you to that publisher’s site.

Gardner’s own generative AI features are turned off for this pilot. It does not currently send office content to Anthropic for those features. Zoom AI Companion is a separate Zoom feature and may still generate transcripts or summaries before Gardner receives them. Before enabling Gardner AI processing, we will explain the provider, information sent, purpose, and relevant data-handling terms and obtain office authorization.

Cookies, browser storage, and security

Gardner uses a session cookie to keep you signed in. Browser storage holds preferences, custom news topics, and any locally saved chat history. These local copies may remain on a device until cleared; deleting server records cannot remotely erase browser storage or files you have downloaded. Use your browser’s site-data controls to clear them. This pilot does not use advertising cookies or third-party audience analytics.

Gardner uses HTTPS, access controls, and office-level separation. Passwords are hashed. Zoom OAuth tokens and transcript text receive application-level encryption before database storage. This additional encryption does not cover every field, such as meeting metadata and summary payloads. No service can guarantee complete security.

Retention, leaving an office, and deletion

Office records remain while needed for the office’s use and agreed retention requirements. Suspending an office stops access and intake and removes Gardner-held Zoom tokens and calendar-feed addresses; it retains existing office work until an authorized permanent-deletion request is approved. Suspension alone does not erase records.

Deleting a staff account removes its login, profile, private drafts and saved items, reset links, and related private account records. Shared office work remains, with account attribution and assignments removed where supported. Names or other references inside free text and correspondence are not automatically rewritten; requests covering that content need a separate review with the office.

Our target is to complete a verified, authorized deletion request within 30 days. We will explain any legal or office retention hold, what can be deleted, and the expected completion date. Applicable legal deadlines and existing contractual commitments still apply. This notice does not reduce commitments already made for information collected under an earlier notice.

An approved office purge removes the office’s active Gardner records and photos. We retain limited identifiers, deletion receipts, and suppression hashes needed to document the action and prevent deleted accounts or intake from reappearing. Backups and recovery copies may remain until their retention periods expire; deletion from the active service is not a promise of immediate erasure from every backup. We will identify remaining copies and their applicable retention when handling a deletion request.

Removing a Zoom connection deletes Gardner’s stored credentials and attempts to revoke the grant at Zoom. It does not itself delete stored meetings. You can also remove the app in Zoom; contact us to remove an operator-configured pilot binding. Deletion in Gardner does not delete source records or retained copies held by Zoom, email or calendar providers, or your office. Those require the relevant provider or office process.

Requests and changes

Contact support@allogy.com to ask about access, correction, export, deletion, or other privacy rights that apply to you. We verify identity and authority and coordinate office-controlled records with the office. Include your office and request type, but do not email passwords or sensitive case details. We can arrange an appropriate way to exchange necessary information.

We will update the date on this notice when it changes and notify participating offices of material changes before new uses of office information begin. See our pilot terms and support page for more information.