Privacy Policy

Effective 30 October 2026

ForeAct Labs, LLC, a Georgia limited liability company, operates Open Executive. This policy explains how ForeAct Labs, LLC ("we", "us") handles personal data in the hosted Open Executive service (the "Service") and on openexecutive.ai.

This policy covers two kinds of data:

• Account, billing and usage data about you and your seats. We are the controller of this data, and this policy covers it.
• Customer Content: the information you put into your instance or connect it to, which may include personal data about other people. The customer is the controller of it and we are a processor: we handle it only to run the Service for you, on your instructions and under the Data Processing Addendum ("DPA"). If an existing customer put your data into the Service, please contact that customer first; we will help them respond.

What we collect

We do not collect data for advertising, and we do not use advertising trackers. On our public pages (the home page, sign-up and sign-in) we count visits with Plausible Analytics, which does not use cookies; we do not use analytics on pages you see once signed in. Our cookies are the ones needed to sign you in, keep you signed in and protect sign-in against forgery, plus one set on our public pages that records where you first came from, for up to 30 days, so your account can say which source brought it.

How we use it, and our legal bases

• To provide the Service and bill for it — performance of our contract with you.
• To secure the Service, prevent fraud and abuse, and keep it working — our legitimate interests in running a safe service.
• To send service emails (address confirmation, password reset, instance ready, usage and billing notices, security notices) — performance of contract. We also send tips in your first weeks, a note when your workspace has gone quiet, and a reminder before your usage month resets; you can stop each kind from the link in the email. We do not send marketing email without your consent.
• To keep records the law requires (such as tax and billing records) — legal obligation.

We do not use Customer Content to train AI models, and we do not sell or share personal data for cross-context behavioral advertising.

AI processing

To answer you, the Service sends the relevant parts of your request and Customer Content to AI model providers through OpenRouter, a model gateway (see the Subprocessors page). They process it only to generate a response. Our OpenRouter account is set to exclude providers that may train on prompts. By default the Service uses Claude models, served by Anthropic or by the cloud providers that host Claude, none of which train on API data. If your organization chooses a model from another vendor, requests for it go to that vendor or to a host serving its model, and a PDF that model cannot read itself is read by Mistral AI's document reader.

If you connect your own model-provider API key, people's requests go to that provider under your own agreement with it. We are not a party to, and are not responsible for, the agreement between you and your own model provider, including how that provider processes, stores or uses your data. The Service's own background work (such as briefings, monitoring and the memory it keeps about your organization) still runs on our AI providers.

Automated actions and decisions

Some features let the Service act for you in connected tools (for example drafting and sending email, updating your calendar, or posting in Slack). These features are off until you turn them on or connect the tool. When you do, the Service reads from and writes to those tools on your instructions to carry out the task you asked for, and the data involved is handled as described in this policy and the DPA. You are responsible for the actions you enable, and you can turn these features off or disconnect a tool at any time in your instance's settings.

We do not use your personal data to make decisions that produce legal or similarly significant effects about you without human involvement. The Service generates drafts, suggestions and actions at your request, and you direct and remain responsible for them. If this ever changes, we will update this policy and give you any rights the law requires, including the right to request human review.

Meetings

If you send the Executive to a video call, or talk with it in a voice call, the call's audio, video, chat and transcript go to Recall.ai, which runs the meeting bot, and the audio goes to OpenAI's realtime voice model, which hears and answers live (see the Subprocessors page). Your instance keeps the transcript and the notes it writes. Recall.ai deletes the recording after the call unless your organization chooses to keep recordings.

Mobile app

If you use the mobile app, notifications are sent through Expo's push service, which passes them to Apple or Google to deliver. They carry only a short text; private or sensitive items say only that something needs you. Dictation uses your phone's own speech recognition, which Apple or Google provide under your agreement with them.

Google user data

When you connect a Google account (for example Gmail, Google Calendar or Google Drive), your instance reads and acts on that account's data only to provide the features you use: answering your questions, drafting and sending messages, managing your calendar and searching your documents. We do not use Google user data to develop, improve or train generalized AI or machine-learning models, we do not sell it or use it for advertising, and people at our company do not read it except with your permission, for security, or where the law requires.

Open Executive's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

• Subprocessors that run parts of the Service for us: hosting, backups, AI models, meeting bots and live meeting voice, payments, email and phone notifications, and error tracking. The current list, with what each does and where, is on the Subprocessors page.
• Stripe, which processes payments and may act as merchant of record for your purchase. For that role Stripe is an independent controller under its own privacy policy.
• Services you connect (for example Google Workspace, Microsoft 365, Slack, or business apps such as HubSpot), which receive what your instance sends them on your instructions. For business apps our platform keeps the access token, encrypted, and makes the calls for your instance.
• Plausible Analytics (Plausible Insights OÜ, hosted in the EU), which counts visits to our public pages for us without cookies. It receives the page address, the referring site, the browser and device type, and the visitor's IP address, which it uses only to count unique visitors and does not store. It never receives account data or Customer Content, so it is not on the Subprocessors list, which covers the vendors that process Customer Content and account data for us.
• Authorities or others where the law requires it, or to protect rights, safety and security, and a successor if our business is sold or merged (it must honor this policy).

International transfers

We host the Service in the United States. If you are in the EEA, the UK or Switzerland, your personal data is transferred to the US. If your organization chooses an AI model from a vendor other than Anthropic, its provider may process prompts in another country. We rely on the EU Standard Contractual Clauses (and the UK Addendum) in our DPA and with our subprocessors, or on a subprocessor's certification under the EU-US Data Privacy Framework where it has one.

How long we keep it

• Account data: while your account exists. Delete it yourself from Settings → Account on the web or in the app, or by writing to support@openexecutive.ai, and we do so within 30 days.
• Customer Content: while your subscription is active. When it ends (cancelled by you, or by us for non-payment or account closure), we delete it within 30 days after the end date, backups included, or sooner if you ask. This deletion applies only to Customer Content held within your instance; data held in or by connected third-party services is not covered and remains subject to those providers' own terms and retention practices. Download a backup before it ends if you want to keep it; after deletion it cannot be recovered.
• Billing and usage records, and the audit log of actions on your account: kept after your account is closed, as long as tax, accounting and security needs require (generally up to 7 years).
• Email sent to an Executive's platform address: kept by our email provider, Resend, for up to 30 days after it arrives, then deleted. Your instance keeps its own copy as Customer Content.
• Enterprise contact form: as long as needed to answer and follow up on your enquiry.
• Security logs: no longer than needed for security, generally 90 days.

Your rights

Depending on where you live (for example under GDPR, UK GDPR or US state laws such as the CCPA), you may have the right to access, correct, delete or export your personal data, to object to or restrict our processing, and to withdraw consent where we rely on it. We will not discriminate against you for using these rights. You can download what we hold about your account, and delete it, yourself from Settings → Account. For anything else, write to support@openexecutive.ai; we answer within one month, or sooner where the law requires it, and may need to verify your identity first. Where we decline a request, we will tell you how to appeal. Other US state privacy laws may also apply, and we will comply with them to the extent they apply to us. You can also complain to your local data-protection authority.

Security

Each customer's instance runs in its own isolated machine with its own storage, and code it runs and apps it builds run in separate isolated environments. Data is encrypted in transit and at rest, and stored credentials for connected services and API keys are additionally encrypted. See the security measures in the DPA. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will tell affected customers without undue delay, and notify authorities, as the law requires.

Children

The Service is not for people under 18. You must be at least 18 years old to use it, and we do not knowingly collect data from anyone under 18.

Changes

We will post changes here and update the effective date. For a material change we will tell you by email or in the Service at least 30 days before it takes effect.

Contact

You can contact us if you have any questions, feedback, or data-protection requests at support@openexecutive.ai.