Privacy policy

• Account details: your name, email address, company and a protected (hashed) password, and a record of recent sign-in attempts so we can stop password guessing.
• The business’s records that the buyer connects or uploads, with read-only access: for example email conversations, calendar events, spreadsheets, PDFs and photos of paperwork.
• The seller’s answers to their daily questions, typed or spoken, and any corrections they make.
• What Inherit writes from them: the operating manual, answers in Ask, heads-ups and customer introductions.
• An activity record of who did what in a workspace and when (the audit trail).
• Contact details you give us when you book a call, and phone numbers you choose to add for text reminders.

Only to provide Inherit to the workspace it belongs to: to build the manual, answer questions, send reminders and heads-ups, and prepare reports.

We don’t sell data, and we don’t use a business’s records or answers to train Inherit’s or anyone else’s AI models.

Nothing is read until both the buyer and the seller have signed a capture consent naming the kinds of records that may be read. Sources outside that consent can’t be connected.

Either side can leave out email labels, contacts and people. Matching records are skipped, or deleted if they were already read. The seller can see everything that was read from their private link and remove anything personal; removed records are deleted and never read again.

• The buyer who owns the workspace.
• Teammates the buyer invites to the workspace, who see what the buyer sees.
• The seller sees their own questions and answers, how they were written up, and what was read, through a private link.
• A lender or broker, only if the buyer shares the workspace with them, and then only readiness figures: never the records, the manual, or anyone’s answers.

We use a small number of providers to run Inherit, under contracts that limit their use of data to providing their service:

• Anthropic, to read records and draft the manual and answers.
• Our hosting provider, to run the service and store data.
• Resend, to send email; Telnyx or Twilio, to send text messages people have opted into.
• Google, when a business connects Gmail and Google Calendar.

Inherit’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connections are read-only: Inherit never sends, edits or deletes anything in a business’s systems. Data travels over TLS. The business’s records, and the logins used to read them, are encrypted at rest with AES-256 and kept to a single workspace.

• Disconnecting a source deletes its records, along with anything the manual drafted only from them.
• Closing a workspace makes it read-only and deletes everything in it after 30 days, unless it’s reopened first.
• Deleting a workspace removes everything in it right away.
• You can delete your account at any time from your account page. That deletes every workspace you own, too.

We use one cookie to keep you signed in. Our website analytics, when switched on, are cookie-free and don’t track you across other sites.

You can see, correct, export or delete what we hold about you. The buyer can download the workspace’s audit trail at any time. To make a request, contact us.

If we change this policy in a way that matters, we’ll tell account holders by email before the change takes effect.