Privacy Policy
Last updated October 27, 2026
The Butler Company ("we", "us") makes a personal butler: an assistant that keeps track of your people, plans, calendar and messages, and does things for you when you ask. To do that it has to read some of your life. This policy says what it reads, where that goes, and what you control.
The short version
- Your butler reads only what you connect, and you can disconnect anything at any time.
- Your data is kept in your own household: a separate database and storage, not pooled with anyone else's.
- We don't sell your data, we don't show you ads, and we don't use your data to train AI models.
- Your butler drafts email but never sends it. It changes your calendar only when you ask, and anything that would email other people waits for your yes.
What we collect
- Your account. Your name, email address and mobile number, the name you give your butler, and a password if you set one.
- What you tell it. Your answers when you sign up, what you type or say to your butler in the portal, by text or on calls, and files or photos you add.
- Calls and texts with your butler. Your butler has its own phone number. Calls and texts to and from it are transcribed and kept so it can follow up. Calls it places for you (to a business, say) are transcribed too.
- What you connect, only if you connect it:
- Gmail: reads your messages so it can file what matters, and creates drafts. It never sends.
- Google Calendar: reads your events, and adds, moves or cancels events when you ask.
- Google Contacts: reads your contacts, so it knows who's who.
- Granola: reads your meeting notes.
- The Mac app: reads your iMessages, Apple Notes and Contacts on that Mac. It never changes them. If you turn it on, it can record a call you're on, and transcribes it.
- Other AI assistants you connect (Claude, ChatGPT, Grokbot and others): they can read and add to your household's record through the key you give them. Each visit is in your access log.
- Payment. If you pay, Stripe handles your card. We see that you paid, not your card number.
- Basic logs. Times, pages and errors, to keep the service running and find problems.
How we use it
Only to run your butler for you: to answer your questions, remember what matters, plan, remind you, prepare drafts, place the calls and send the texts you ask for, and hand work to the assistants you've connected. We look at your data ourselves only when you ask us to, to fix a problem you've reported, to keep the service secure, or when the law requires it.
Google user data
The Butler Company's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data from Gmail, Google Calendar and Google Contacts is used only to provide or improve your butler's user-facing features for you; it is not used for advertising, not sold, not used to train generalized AI or machine-learning models, not transferred to anyone except as described here, and not read by people except with your permission, for security, or to comply with the law.
When you connect a Google account, your butler asks Google for these permissions, and uses each one only as described:
| Permission | What your butler does with it |
|---|---|
Your email address and basic sign-in (openid, email) | Knows which Google account you connected, so you can connect several and disconnect each one. |
Read your Gmail (gmail.readonly) | Reads your mail, except spam, trash and the Promotions, Social and Forums tabs, and files each message in your household's record so your butler can answer questions about it, remind you of what needs a reply, and tell you when something important arrives. It never changes, labels or deletes your mail. |
Draft email (gmail.compose) | Puts a draft you asked for in your Gmail Drafts folder, for you to read, change and send yourself. Google offers no permission that allows drafts without sending; your butler's code never calls Gmail's send function, and never sends email. |
See and change your calendar events (calendar.events) | Reads the events on the calendars you show in Google Calendar, including family calendars others share with you, so your butler knows your schedule. Adds, moves or cancels an event only when you ask, and emails other guests only after you say yes. |
Read your contacts (contacts.readonly) | Reads your contacts so your butler knows who is calling or texting, and fills in a phone number, address or birthday you already keep there. It never changes your contacts. |
AI models
To answer you, your butler sends the part of your record a request needs, which can include an email, an event or a contact, to the AI model that writes the answer (Anthropic, OpenAI or xAI, whichever your household uses, or an open model Cloudflare runs for us to route a request quickly), and new mail is read by a model to decide whether it's worth telling you about. These providers process it only to return the answer, under business terms that don't allow them to train on it, and we don't use your Google data to train, fine-tune or improve any AI model, ours or anyone else's. A search index of your record (words and meaning, the meaning computed by an open model Cloudflare runs for us) is kept inside your own household's storage, for your butler's use only. When your butler tells you about an email or reads you an answer on a call, those words also pass through the text and voice services listed below.
How long Google data is kept
- Email, events and contacts read from Google are kept in your household's record for as long as that Google account stays connected, so your butler can answer questions about them. Each email is kept as its sender, recipients, subject, date and up to the first 6,000 characters of its text.
- Events cancelled or deleted in Google Calendar, and contacts deleted in Google Contacts, are removed from your record at the next sync.
- Google's access tokens are kept encrypted at rest and are deleted when you disconnect. Notes your butler keeps about each new email (whether it's worth telling you about) expire after 14 days.
Deleting Google data
- Disconnect one account on the Connections page: your butler stops reading it, its access token is deleted, and every email, event or contact read from that account is deleted from your record and its search index right away.
- Delete my Google data on the Connections page: every Google account is disconnected, access is revoked at Google, and everything read from Google is deleted from your record and its search index right away.
- Disconnecting one account deletes our copy of its access, but Google may keep the permission on file until it is revoked; Delete my Google data revokes it, and so does removing it yourself at myaccount.google.com/permissions, after which your butler can't read anything more.
- Or write to privacy@thebutlercompany.co and we'll do it for you within 30 days. Deleted data leaves our encrypted backups as they expire, within 30 days.
- Notes your butler wrote down in its own words while helping you (a reminder, say) are part of your household's record, not a copy of your Google data; you can delete them in the portal, and closing your account deletes them with everything else.
Who processes it for us
Your butler runs on services that process data on our behalf, under their own security and privacy terms:
- Cloudflare: hosting, storage, search indexing, speech transcription and the open AI models it runs for us.
- Anthropic, OpenAI and xAI: the language models that read a request and write the answer. They receive what a request needs, not your whole record, and under their business terms don't train on it.
- ElevenLabs: your butler's voice on calls. Twilio: its phone number. Linq: its text messages.
- Resend: sign-in codes and invitations by email. Stripe: payments.
- Google and Granola: only the parts you connect.
An AI assistant you connect yourself (Claude, ChatGPT and so on) is your choice, and its own provider's policy applies to what it reads.
Who else sees it
If someone in your household (your spouse, say) also talks to your butler, they share your household's record, except what you mark private, and anything that reads like a gift or surprise for them, which is hidden from them automatically. We don't share your data with anyone else, except a service above doing its job, or when the law requires it.
How long we keep it, and deleting it
- We keep your data while your account is open.
- You can disconnect Gmail, Calendar, Contacts, Granola, the Mac app or any assistant at any time on the Connections page. What disconnecting Google deletes is set out under Google user data.
- To close your account and delete everything, write to privacy@thebutlercompany.co. We delete your household's database, storage and keys within 30 days, and remove it from backups as they expire.
Security
Data is encrypted in transit (HTTPS only) and at rest. Keys and tokens for the services you connect, Google's included, are additionally encrypted with AES-256-GCM under a key held apart from the data. Each household is kept apart from every other. Every sign-in and every visit by a connected assistant is recorded in your access log, which you can read in the portal. No system is perfectly secure; if something happens that affects you, we'll tell you promptly, and within 72 hours of learning of it where Google data is involved.
Your rights
You can ask us what we hold about you, ask us to correct it, ask for a copy, or ask us to delete it, by writing to privacy@thebutlercompany.co. If you live in California or another place with similar laws, you have these rights by law; we don't sell or share personal information as those laws define it, and we won't treat you differently for using them.
Children
The Butler Company is for adults. You must be 18 or older to open an account. Your butler may hold information about your children because you tell it; that information is yours, and is treated like the rest of your household's record.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the portal before it takes effect.