Privacy

When you join the early-access list we store your name, work email, company, and what you told us about your needs. When you create a workspace we store what you enter during onboarding, what our research step reads from your public website, and the settings you choose.

When you connect a tool, we store an access token for that tool, encrypted, and we read only what the connected employee needs for the task at hand.

uBumi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we access. Your Google account's email address and basic identity, to know which account you connected, and the events on your Google Calendar: their titles, times, descriptions, meeting links, and attendees. Workspaces that connected Google before September 2026 may also have granted Gmail access until they reconnect; that access is used only for reading and labelling mail, saving drafts for your review, and sending messages you approved.

How we use it. Only to provide the features you switch on: finding free time and booking appointments, preparing briefs before meetings, joining meetings and sending you the recap, reminding people of appointments, and creating the events you or your callers ask for. We do not use Google user data for advertising, we do not sell it, and people at uBumi do not read it except with your permission for support, for security, or where the law requires.

We do not sell or rent Google user data, and we do not share it for advertising. We transfer it only to the service providers below, only the part each one needs, and only to deliver the features you have switched on. Each acts on our instructions.

We may also disclose data where the law requires it, or to a buyer of the business under the same commitments, in which case we would tell you first.

uBumi does not use Google user data, whether raw, aggregated, anonymized, or derived, to create, train, or improve any AI or machine-learning model, ours or anyone else's.

To do the work you ask for, uBumi sends the relevant Google user data to the AI providers named above (OpenAI through its commercial API, Retell AI for phone calls, and Recall.ai for meeting transcription). We call these services directly, not through any aggregator or model marketplace. We do not permit them to use Google user data to train or improve their models: we use their business services rather than consumer products, every optional data-sharing setting in our OpenAI organization is switched off, and we do not fine-tune any model on customer data. If we add another AI provider, it will be listed here first.

uBumi does not run self-hosted or offline models.

When you connect a YouTube channel, uBumi uses YouTube API Services to upload to it. By connecting a channel you also agree to the YouTube Terms of Service, and Google's own handling of your information is described in the Google Privacy Policy.

What we access. The name and id of the channel you authorise, so that we upload to the right one, and the video and description you approved. We do not read your channel's analytics, subscribers, viewers, or comments.

How we use it. Only to upload video you have approved to the channel you connected, and to show you in the product which channel that is. Nothing is uploaded that you have not seen and approved.

What we store and where. The channel's name and id, and an access token, encrypted. Held with Supabase in the United States (us-west-2), on the same terms as every other connection described on this page.

What we do not do. We do not sell YouTube data or share it for advertising. We do not use it to create, train, or improve any AI or machine-learning model. We do not allow third parties to serve content in uBumi, and we do not store, access, or collect information from your device beyond what is needed to run the site.

Revoking access and deletion. Disconnecting YouTube on the Integrations page revokes our access and deletes the stored token. You can also revoke it yourself at any time from the Google security settings page. Anything we hold is deleted when you disconnect, or when you ask us to delete the workspace.

Questions or complaints about how we handle YouTube data: support@ubumiai.com.

What we access. The identity of the TikTok account you authorise — its nickname and the posting options your account allows, such as who may watch a video and whether comments, duets, and stitches are permitted — and the video and caption you approved.

How we use it. Only to post content you have approved to the account you connected. We read your account's permitted posting options so that the approval screen offers the choices TikTok actually allows on that account, rather than guessing. uBumi operates no TikTok account of its own and posts to no account other than the one that authorised it.

Approval. Nothing is sent to TikTok until you have seen that specific post and approved it, including its audience, its interaction settings, and whether it is disclosed as commercial content. Approving a post may schedule it for later; scheduling never replaces approval.

What we store and where. The account nickname and an access token, encrypted, with Supabase in the United States (us-west-2).

What we do not do. We do not sell TikTok data or share it for advertising, and we do not use it to create, train, or improve any AI or machine-learning model.

Revoking access and deletion. Disconnecting TikTok on the Integrations page deletes the stored token and stops all posting. You can also remove uBumi's access from your TikTok account settings. Anything we hold is deleted when you disconnect, or when you ask us to delete the workspace.

Questions or complaints about how we handle TikTok data: support@ubumiai.com.

In transit and at rest. All connections use TLS 1.2 or higher. The database and file storage are encrypted at rest with AES-256.

Access tokens. Google and other connection tokens are additionally sealed with AES-256-GCM under a key held only by the application, are never shown in the product, and are never sent to AI providers.

Least access. We ask Google only for the permissions a feature needs. Each workspace's data is isolated from every other workspace. Access to production systems is limited to the people who operate uBumi, and every action taken on your behalf is recorded in an audit log you can read.

Minimum sharing. Each provider receives only the fields a task needs, and meeting audio and video are not kept: Recall.ai keeps only the transcript and deletes it from its side after 48 hours.

Retention and deletion. Disconnecting Google on the Integrations page revokes our access at Google and deletes the stored token. You can ask us to delete a workspace and everything in it at any time.

Data is stored with Supabase in the United States (us-west-2). The providers listed above process it in their own infrastructure under their business terms.

You can disconnect any tool in one click on the Integrations page, which also revokes our access at the provider. You can ask us to delete a workspace and everything in it, or ask what we hold about you, at any time by writing to support@ubumiai.com.

uBumi is operated by 2342874 Ontario Inc, Brampton, Ontario, Canada. That company is responsible for the personal information described on this page. Privacy questions and requests: support@ubumiai.com.