Privacy Policy

Effective date: 14 August 2026

Executive OS (“Executive OS”, “the Service”, “we”, “us”) is operated by Sandan AI GmbH (“Sandan”). This Privacy Policy explains what information the Service accesses, how we use and protect it, and the rights you have. By using Executive OS you agree to this policy.

1. Who we are

Executive OS is an AI executive assistant that connects to your work tools to help you stay on top of your priorities, communications, calendar and tasks. Operated by Sandan AI GmbH, Marienstraße 18, 71332 Waiblingen, Germany. Contact: iskander@sandan.ai.

2. Information we access and process

Account information. Your name and email address, used to create and secure your account.

Data from services you connect. The Service accesses a connected service only after you explicitly authorize it, and only for your own account:

Google Gmail — with your permission we read your email messages (content and metadata) to surface action items and priorities, generate briefings, and answer your questions; and we send email on your behalf, only after you review and approve each message.
Google Calendar — we read your events to prepare meeting briefings and answer scheduling questions, and create, update or delete events when you ask us to.
Google Tasks — we read and manage your tasks to track action items.
Microsoft Outlook, Slack, WhatsApp, and meeting-notes tools — messages and meeting transcripts from the services you choose to connect, used in the same way.
Social accounts (Instagram, TikTok, LinkedIn) — when you connect one of your own accounts, we read your own posts and videos and their public performance metrics (such as views, reach, likes, comments, shares and saves) and basic profile information (such as your handle and follower count). We use this only to analyze how your content performs and to help draft new content ideas and scripts for your approval. We access only your own content and analytics — never other users’ private data — and we do not post, comment, or message on your behalf without your explicit approval.

We use this content to power the assistant and to build your private, searchable knowledge base (including text embeddings used for retrieval). Connected-service data is kept separate per account and is never combined across customers.

3. How we use your information

Provide the Service: surface what needs your attention, generate briefings and answers, draft and — with your approval — send messages, and keep your tasks and calendar in sync.
Secure, maintain and improve the Service.
Communicate with you about the Service.

We do not use your information for advertising, and we do not sell it.

4. Google user data — Limited Use

Executive OS’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained through Google Gmail, Google Calendar and Google Tasks scopes is:

used only to provide and improve the user-facing features described above, for the signed-in user;
never sold, and never transferred to third parties except as needed to provide the Service, for security or legal reasons, or as part of a merger or acquisition with appropriate notice;
never used for advertising;
never used to develop, improve or train generalized or non-personalized AI/ML models;
not read by humans, except with your explicit consent, to comply with applicable law, for security purposes (e.g. investigating abuse), or where the data has been aggregated and anonymized.

5. Sub-processors and third parties

We use trusted providers only to run the Service, under contractual confidentiality and data-protection obligations:

Hosting — Vercel and Google Cloud (EU region).
Database — Neon (EU region).
AI models — OpenRouter and the large-language-model providers it routes to, used to generate your answers and briefings. Content sent to these providers is processed only to return your result and is not used by them to train their models.

We do not sell your data to anyone.

6. Storage, location and security

Your data is stored in the European Union and protected with encryption in transit (TLS) and at rest, access controls, and least-privilege practices. OAuth tokens are stored encrypted.

7. Data retention and deletion

We retain your data while your account is active and a service is connected. When you disconnect a service, the data ingested from it is deleted. When you close your account, or on request, we delete your personal data and connected-service data. Email us to request deletion.

8. Your rights

Depending on your location (including under the EU GDPR), you may have the right to access, correct, delete, export or restrict the processing of your personal data, and to withdraw consent. To exercise these rights, contact iskander@sandan.ai.

9. Changes to this policy

We may update this policy from time to time; we will post the new version here with an updated effective date.

10. Contact

Sandan AI GmbH, Marienstraße 18, 71332 Waiblingen, Germany · iskander@sandan.ai