Privacy Policy

1. Introduction

Hey Noah AI Inc. ("Company," "we," "our," or "us") operates Noah, an AI-powered executive assistant that works where you work. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our website (heynoah.io) and app (app.heynoah.io), and when you interact with Noah through any supported communication channel, including SMS, RCS, WhatsApp, iMessage, email, Slack, phone calls, and other integrations (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not access or use the Service.

Important: Noah is an artificial intelligence assistant. Noah is not a human. All interactions with Noah are powered by AI technology, including third-party large language model providers. Please review this Privacy Policy carefully to understand how your data is processed in connection with AI-powered features.

2. Our Data Commitments

We believe you should always know how your data is used, and you should always be in control of it. These commitments govern everything we do with your information:

We do not train AI models on your data. We use your data to run and improve Noah, not to train or fine-tune AI models. We require our AI providers not to train on your data, and where a routing service is used, we instruct it to use only providers that do not store or train on it. If this ever changes, we will update this policy and tell you before the change applies to your data (see Section 16).

We never sell your personal data. Your personal information is never sold to data brokers or any third party.

We never grant ourselves a perpetual license to your data. We process your data to provide and improve the Service for you. You can request deletion at any time (see Section 6).

You stay in charge of what Noah does. Noah acts on your requests and on standing instructions you give it, such as "handle scheduling on this thread" or "send me a briefing every morning." When you copy Noah on an email thread, Noah may reply to the people on that thread to complete what you asked. When Noah creates or changes a calendar event, your calendar sends invitations or updates to the attendees. Noah may also send you reminders, briefings, and tips about features. You can turn any of these off by telling Noah or by replying STOP.

We access what we need to do the job you give us. When you connect Google, Noah can read your calendars and, if you grant email access, read your inbox so it can find scheduling requests, look up contacts, and answer your questions. Noah does not access your screen, keystrokes, passwords, or device location. Noah uses your microphone only during a phone call or live voice session with Noah.

We encrypt your data. All data is encrypted in transit using TLS and at rest using AES-256 encryption provided by our cloud infrastructure. See Section 7.

When you disconnect, we stop. If you disconnect a service in Noah, or revoke Noah's access in that service's settings, Noah can no longer access it. Data Noah already copied is deleted when you ask us or when your account is deleted (see Section 6).

When you say stop, we stop. If you reply STOP to a text message or iMessage from Noah, Noah stops sending you messages, including reminders and briefings, until you reply START. If you write to Noah again, Noah will reply to that message. On WhatsApp, email, or Slack, tell Noah to stop or email hello@heynoah.io and we will turn off messages on every channel.

You can delete your data. Email hello@heynoah.io to delete your account and your data, and we will confirm in writing when it is done (see Section 6).

3. Information We Collect

3.1 Information You Provide Directly

• Account and registration information, including your name, email address, phone number, company, and any information you provide during signup.
• Conversation data, including all messages, instructions, requests, and other content you send to or receive from Noah through any supported channel.
• Calendar, scheduling, and task-related data you share with Noah or authorize Noah to access.
• Files you send, such as photos, documents, and voice notes. We transcribe voice notes and describe images so Noah can understand them.
• Phone calls. If you talk to Noah by phone, or Noah calls a person or business for you, we record the call audio and keep a written transcript.
• Information about people you work with, such as names, email addresses, phone numbers, and job titles of your contacts, when they appear in your messages, email, or calendar, or when Noah looks them up to complete a task.
• Payment and billing information, if applicable. Card details are handled by our payment processor, Stripe, and we do not store your card number.
• Feedback, correspondence, and communications you send to us.

3.2 Information Collected Automatically

• Device information (device type, operating system, browser type).
• Log data (IP address, access times, pages viewed, referring URL).
• Usage data (features used, interaction patterns, frequency of use).
• Signup and advertising data: the page that referred you, campaign tags, and advertising click identifiers (such as a Meta, Google, LinkedIn, or TikTok click ID) present when you sign up.
• Cookies and similar technologies (see Section 9).

3.3 Information from Connected Services

When you connect a service, Noah receives data from it so it can do the work you ask for.

• Google Calendar: Noah reads and updates events on the calendars you connect, and keeps a copy of them to stay in sync.
• Gmail: if you grant email access, Noah reads messages in your inbox to find scheduling requests and contact details and to answer your questions. Noah stores copies of the messages it works with.
• Other services you connect, such as meeting note tools (for example Granola or Fathom), Google Drive, or Notion: Noah reads the notes, transcripts, or documents it needs for your request.
• During signup, we may look up the public LinkedIn profile you give us.

You can disconnect any service in Noah, in that service's own settings, or by contacting us.

3.4 Google User Data

Noah requests these Google permissions:

• Your basic profile and email address, to identify your account.
• Google Calendar, to read your schedule, find free time, and create, update, or cancel the events you ask Noah to manage.
• If you choose, read-only Gmail access, to read messages so Noah can find scheduling requests and contact details and answer questions about your email.

Email drafts: if you grant permission, Noah can create a draft email in your Gmail Drafts folder when you ask it to write one. Noah only creates the draft. It does not send it. You review the draft and decide whether to send it from Gmail yourself. Noah does not read, change, or delete your other drafts.

Noah does not send email from your Gmail account and does not delete or change your messages.

We use Google user data only to provide and improve the user-facing features of Noah described in this policy. We do not use it for advertising, we do not sell it, and we do not use it to train AI models. We share it only with the service providers in Section 5 that help us run those features. As described in Section 4, our team may review your data, including data from Google, to fix problems and improve Noah. Otherwise, people at Hey Noah read your Google data only when needed for security, to investigate abuse, or to comply with the law.

Noah's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.5 Information We Do Not Collect

Noah does not collect:

• Screen captures or screenshots from your device.
• Keystroke or keyboard input data.
• Cursor or mouse movement data.
• The passwords to your accounts. When you connect a service, you sign in with that service directly and we receive an access token, not your password. If you sign in to a website through a browser session Noah runs for you, that session is kept by our browser provider so Noah can act for you there, and you can ask us to remove it.
• Camera data, or microphone data outside of phone calls and live voice sessions with Noah.
• Precise geolocation or GPS data from your device.
• Data from services you have not connected to Noah.

3.6 Sensitive Information

During your use of the Service, you may choose to share sensitive personal information with Noah, including health information, financial details, legal matters, or personal concerns. We do not request or require this information. Please use caution before sharing sensitive information, and understand that AI-generated responses on sensitive topics are not a substitute for professional advice (see our Terms of Service).

4. How We Use Your Information

We use the information we collect to:

• Deliver the Service: provide, operate, and maintain Noah and complete your requests.
• Fix problems and improve Noah: find and fix mistakes and test improvements. To do this, our team may review your conversations and the data Noah used, including email and calendar data from Google, and re-run past conversations against new versions of Noah to check that a fix works. Access is limited to staff who need it for this work.
• Communicate: send service notices, updates, security alerts, and support messages.
• Personalize: tailor Noah's responses to your preferences and usage patterns.
• Keep the Service safe: detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Comply with the law: respond to legal requirements, legal process, or government requests.
• Analyze usage: understand usage trends to improve the Service.
• Measure advertising: share scrambled (hashed) email addresses with advertising platforms to measure which ads lead to signups (see Section 5.2). You can opt out (see Section 10).

We do not use your conversations to train AI models.

AI can make mistakes. Noah acts on your behalf and can misunderstand a request, produce incomplete or incorrect results, or act on misleading instructions from people it interacts with, such as a message written to trick an assistant. Review what Noah does for you, especially anything sent to other people or involving money, and tell us if something goes wrong.

5. How We Share Your Information

5.1 Service Providers

We share your information with service providers only as needed to run and improve the Service. They may use it only to provide their services to us, under agreements that require them to protect it.

AI providers

Your messages, and the calendar, email, and other connected data Noah needs for a task, are processed by AI providers to generate Noah's responses. We do not allow them to train models on your data. Our AI providers are Anthropic (our primary provider), OpenAI, and OpenRouter, a routing service that sends some tasks to other model providers. We instruct OpenRouter to use only providers that do not keep or train on your data.

Other service providers

We also use service providers for:

• Cloud hosting and storage, in the United States.
• Delivering our website and app.
• Delivering messages and phone calls between you, Noah, and the people Noah contacts for you (text messages, iMessage, WhatsApp, email, Slack, and voice).
• Connecting Noah to the services you choose to link, and running a web browser for tasks that need one.
• Recording and reviewing Noah's work so we can find and fix mistakes and test improvements.
• Product analytics and error reporting.
• Payments and our newsletter.
• Looking up the public profile information you give us at signup.

The current list of these providers, what each one does, and what data it receives is at heynoah.io/subprocessors. We update that list when we add or change a provider.

User-connected integrations

When you connect a service such as Google (Calendar and Gmail), Zoom, or another integration, Noah accesses it with your permission to do the tasks you ask for.

5.2 Advertising and Marketing Partners

To measure the effectiveness of our advertising, we share information with these advertising platforms when you sign up after clicking one of their ads:

• Meta (Facebook and Instagram)
• Google Ads
• LinkedIn
• TikTok

These platforms use this information to report whether our ads led to signups ("conversion matching"). We send your email address only in hashed form, which turns it into a code that cannot be reversed. Meta and TikTok also receive your IP address and browser type, which they use to match the signup. We do not share your phone number, your conversations, or your calendar or email content with advertising platforms.

You can opt out of this sharing at any time. Contact us at hello@heynoah.io and we will remove your information from all advertising platform audiences within 30 days. See Section 10.

5.3 Other Disclosures

• Legal requirements: we may disclose your information if required by law, regulation, legal process, or government request, or if we believe disclosure is necessary to protect the rights, property, or safety of the Company, our users, or others.
• Business transfers: in connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in advance, and your data will remain subject to the commitments in this Privacy Policy.

6. Data Retention and Deletion

6.1 How Long We Keep Data

We keep your information, including records of Noah's work that we use to fix problems and improve Noah, for as long as your account exists or until you ask us to delete it.

6.2 Cancelling Versus Deleting

Cancelling your subscription or deactivating your account stops Noah and stops billing, but it does not delete your data. To delete your data, email hello@heynoah.io.

6.3 Deleting Your Account

When you ask us to delete your account and we verify the request, we delete:

• your account information and conversations
• email and calendar copies
• contacts and memories
• call recordings and transcripts
• files you sent
• records of Noah's work

We also ask our service providers to delete copies they hold for us. We will confirm in writing when it is done. Copies may remain in our encrypted backups and system logs for a limited time until they are overwritten in the normal course.

6.4 Connected Service Data

If you disconnect a service, Noah can no longer access it. Data Noah already copied from that service, such as calendar events, emails, and meeting notes, stays with your account until you ask us to delete it or you delete your account.

6.5 Meeting Notes and Transcripts

When Noah reads a meeting note or transcript from a service you connected, such as Granola or Fathom, it keeps a copy with the task it was working on, along with any summary or follow-up it created. These copies are kept until you ask us to delete them or you delete your account.

6.6 Opting Out of Messaging

If you reply STOP to a text message or iMessage from Noah, Noah stops sending you messages, including reminders and briefings, until you reply START. If you write to Noah again, Noah will reply to that message. On other channels, tell Noah to stop or email hello@heynoah.io and we will turn off messages on every channel. To delete your account, contact us at hello@heynoah.io.

6.7 Exceptions

We may keep certain information longer when required by law, to resolve disputes, or to enforce our agreements. Aggregated or de-identified data that cannot reasonably be used to identify you may be kept indefinitely for analytics. Hashed identifiers previously shared with advertising platforms (see Section 5.2) may stay in those platforms' systems under their own retention policies, even after you opt out of future sharing.

7. Data Security

We use technical and organizational security measures designed to protect your personal information, including:

• Encryption of all data in transit using TLS.
• Encryption of all data at rest using AES-256 encryption provided by Google Cloud Platform.
• Encrypted database connections only.
• Access controls that limit which staff can see user data, with administrative access restricted to a small number of engineers.
• Regular security assessments, including the independent assessment Google requires for apps that access Gmail, and monitoring of our infrastructure.
• Infrastructure hosted on Google Cloud Platform.

No method of electronic transmission or storage is completely secure. While we work to protect your personal information, we cannot guarantee its absolute security. You are responsible for keeping your account credentials secure and for activity that occurs under your account.

7.1 Breach Notification

If a data breach compromises your personal information, we will notify affected users without unreasonable delay and in accordance with applicable state and federal law. Our notice will include, to the extent known, the nature of the breach, the types of information involved, the steps we are taking, and steps you can take to protect yourself. We will also notify regulatory authorities as required by law.

8. Text Messaging Data

If you opt in to receive text messages from Noah by SMS or RCS, the following applies:

• We do not share your mobile number or your text messaging opt-in with third parties for their marketing. We share them only with the messaging providers that deliver our texts.
• Message frequency varies based on your requests and usage.
• Message and data rates may apply.
• For help, email hello@heynoah.io.
• Reply STOP to stop messages from Noah, including reminders and briefings. Reply START to resubscribe.

9. Cookies and Tracking Technologies

We and our partners use cookies and similar technologies on our website and app:

• Essential cookies: needed to sign you in and keep the Service secure.
• Analytics: PostHog and Google Analytics help us understand how people use our website and app, including pages visited and clicks.
• Advertising: Google Tag Manager loads conversion tags from Meta, Google Ads, LinkedIn, and TikTok to measure whether our ads lead to signups. These may collect your IP address, browser details, and pages visited.
• Visitor identification: our website and app use RB2B, which may match your visit to publicly available business profile information, such as your name and company, so we can understand who visits us.

You can block or delete cookies in your browser settings, or contact us to opt out. Blocking some cookies may affect how the Service works.

10. Your Rights and Choices

10.1 General Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information.
• Object to or restrict certain processing of your information.
• Receive your data in a structured, commonly used format.
• Withdraw consent where processing is based on consent.
• Opt out of sharing with advertising platforms for conversion matching.

To exercise any of these rights, contact us at hello@heynoah.io. We will respond within a reasonable time and as required by applicable law.

10.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including:

• Right to Know: you may request the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: you may request that we delete your personal information, subject to certain exceptions.
• Right to Correct: you may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell your personal information. We do share information with advertising platforms for conversion measurement as described in Section 5.2. Under the CCPA/CPRA this may count as "sharing" for cross-context behavioral advertising. You may opt out by contacting us at hello@heynoah.io.
• Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights.

To submit a request, contact us at hello@heynoah.io. We may verify your identity before processing your request. You may also designate an authorized agent to make a request for you.

Categories of Personal Information Collected: identifiers (name, email address, phone number, IP address, advertising click IDs); commercial information (your subscription); internet or network activity (pages visited and how you use our website and app); audio information (recordings of phone calls with Noah); professional information (job title, company, and public LinkedIn profile); the content of your messages, email, and calendar that you share with or connect to Noah; and inferences drawn from your use of the Service.

Categories of Personal Information Shared for Advertising: identifiers (hashed email address, IP address, browser details, and advertising click IDs) and internet activity (pages visited), shared with Meta, Google, LinkedIn, and TikTok to measure our advertising.

11. Children's Privacy

The Service is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at hello@heynoah.io.

12. Health Information Disclaimer

The Company is not a healthcare provider, health plan, or healthcare clearinghouse as defined under the Health Insurance Portability and Accountability Act (HIPAA). Health information you choose to share with Noah is handled under the general privacy and security practices in this Privacy Policy, not under HIPAA safeguards. Please do not share protected health information (PHI) with Noah if you need HIPAA-level protection for it. For more on the limits of the Service regarding health topics, see our Terms of Service.

13. International Data Transfers

Your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those where you live. By using the Service, you consent to the transfer of your information to the United States and other jurisdictions as described in this Privacy Policy.

14. Third-Party Links and Services

The Service may contain links to third-party websites or connect with third-party services. We are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you use through or in connection with the Service.

15. Do Not Track Signals

Some web browsers send "Do Not Track" (DNT) signals. Because there is no widely accepted standard for responding to them, we do not currently respond to DNT signals. We will keep watching developments and may update this policy.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date above, and by email or through Noah before a material change takes effect. Changes to how we use your data, such as any use of your data to train AI models, apply only after we have told you. Your continued use of the Service after changes take effect means you accept the updated policy.

17. Contact Us

If you have questions, concerns, or requests about this Privacy Policy or our data practices, contact us at:

Hey Noah AI Inc.
Email: hello@heynoah.io