Action Intelligence, Inc.
Privacy Policy
1.Scope of This Privacy Policy
Action Intelligence, Inc., a Delaware corporation (“Action,” “we,” “us,” or “our”), provides an agentic employee support platform that businesses use to automate IT, HR, and operations requests. The platform includes our web application at app.action.so, our API and command line interface, and our apps for Slack, Microsoft Teams, Google Chat, and Jira (together, the “Service”).
This Privacy Policy explains how we collect, use, and disclose personal information that we handle for our own business purposes, and the rights available to you. It applies to personal information about:
- visitors to our websites at action.so, trust.action.so, and docs.action.so (the “Websites”), including visitors who reach action.so through actionintelligence.com;
- prospective customers and other business contacts, including people who attend our events;
- administrators and users who sign in to the Service through a customer organization, to the extent we collect account, security, usage, and support information about them; and
- job candidates.
Action is the controller of this personal information. Our contact details, and those of our EU and UK representatives, are in Section 16.
This Privacy Policy is a notice. It is not a contract, and it does not create rights or obligations beyond those provided by law or by a written agreement between Action and a customer.
2.Customer Data Is Not Covered by This Privacy Policy
This Privacy Policy does not apply to information we process on behalf of our business customers when they use the Service, including the content of tickets, cases, and attachments, messages sent to the Action app in Slack, Microsoft Teams, or Google Chat, knowledge content, workflows, directory and access information (other than the account information described in Section 3), and data from systems a customer connects to the Service (“Customer Data”). Our customers decide how Customer Data is used, and our processing of it is governed by our agreements with them.
If you are an employee or other authorized user of one of our customers and have a question about your personal information, or want to exercise a privacy right, please contact that organization. We will assist our customers in responding to those requests as our agreements with them require. Section 6 below contains more information on how we use and disclose such information.
If a support request you send us includes Customer Data, we handle that Customer Data under the customer’s agreement.
3.Personal Information We Collect
We collect the following personal information, from the sources indicated.
| Category | Examples | Source |
|---|---|---|
| Business contact information | Name, job title, company, work email, LinkedIn profile | You, when you email us (for example, at hello@action.so) or meet us at an event; sales intelligence providers and publicly available professional profiles |
| Account information | Name, work email, account login credentials, organizational role, profile picture where available, and internal user, organization, and device identifiers | Your organization’s administrator, its identity provider through single sign-on or directory sync, and you |
| Login and security records | Sign-in time, sign-in method, IP address, and browser user agent; a log of administrative changes showing who made each change, and when | Automatically, when you sign in to or administer the Service |
| Product usage information | Features used, errors, performance data, and the type of page viewed (for example, “/cases/:id,” not the full address), linked to pseudonymous identifiers; organization-level counts such as cases and workflow runs | Automatically, when you use the Service |
| Website log information | IP address, browser type, page requested, and date and time of the request | Automatically, through our hosting providers’ logs |
| Communications and meeting records | Emails and Slack messages you send to us; notes, transcripts, and recordings of calls and meetings with us | You and other participants |
| Billing contact information | Name, work email, and billing address of your organization’s purchasing contact; invoices | Your organization |
| Event and case study information | Name, company, and event attendance; testimonials or case study content you approve | You |
| Candidate information | Resume and other materials you send to team@action.so, and interview notes; after you accept an offer, the result of a background check | You, your references, and Checkr, with your separate written authorization |
We do not collect phone numbers from account holders, and we do not use SMS for authentication. Customer organizations pay us by invoice, and we do not collect payment card or bank account details from individuals. Please do not send us government identification numbers, health information, or financial account numbers.
4.How We Use Personal Information
We use personal information for the purposes below. For individuals in the European Economic Area, the United Kingdom, and Switzerland, the table also states the legal basis for each purpose.
| Purpose | Information used | Legal basis |
|---|---|---|
| Setting up and administering customer accounts, and authenticating users | Account information; login and security records | Our legitimate interests in providing the Service our customer purchased and securing access to it |
| Operating, securing, and troubleshooting the Service and the Websites, and preventing fraud and misuse | Login and security records; product usage information; website log information | Our legitimate interests in protecting the Service and its users; compliance with legal obligations where applicable |
| Providing customer support | Communications; account information | Our legitimate interests in supporting our customers |
| Understanding how the Service is used and improving it | Product usage information, in pseudonymous or aggregated form | Our legitimate interests in maintaining and improving the Service |
| Responding to inquiries and demo requests, and contacting business decision-makers about the Service | Business contact information; communications | Our legitimate interests in offering the Service to businesses; steps you ask us to take before entering a contract |
| Keeping notes and recordings of calls and meetings | Communications and meeting records | Our legitimate interests in keeping accurate records of business discussions; consent where the law requires it for recording |
| Hosting events and publishing case studies | Event and case study information | Our legitimate interests (events); your consent (testimonials and case studies) |
| Invoicing and accounting | Billing contact information | Our legitimate interests (the contact); compliance with legal obligations (tax and accounting records) |
| Recruiting and pre-employment screening | Candidate information | Steps you ask us to take before entering an employment contract; our legitimate interests in hiring; compliance with legal obligations |
| Complying with law, enforcing our agreements, and establishing or defending legal claims | Any of the above, as needed | Compliance with legal obligations; our legitimate interests in protecting our rights |
We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.
If we want to use personal information for a purpose that is materially different from those listed above, we will notify you and, where the law requires, obtain your consent.
5.Our Use of AI Tools
Our employees use general-purpose AI tools for internal work such as drafting, summarizing, research, and analysis. Personal information described in this Privacy Policy, such as business contact details or support correspondence, may be processed by those tools when an employee uses them for that work. Employees review the output and remain responsible for any decision.
We do not use the personal information described in this Privacy Policy to train, fine-tune, or evaluate AI models.
6.How We Disclose Personal Information
We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We do not run online advertising, retarget website visitors, or upload contact lists to advertising platforms. We disclose personal information only as follows.
Service providers. We use service providers to help us operate our business. They may use personal information only to provide services to us. They fall into these categories:
- Website hosting, content delivery, and database services
- Logging and monitoring
- Sign-in, single sign-on (SSO), and connections to third-party systems
- Employee productivity tools including internal email and other communication, document creation and management, and AI tools
- Product analytics and feature flags
- Product-related email delivery
- Documentation site, trust center, and compliance
- Sales prospecting and CRM
- Customer support communications
- Meeting notes and recordings
- Recruiting and background checks
- Accounting and invoicing
Your organization. If you use the Service through a customer account, that customer’s administrators can view and manage your account.
Our apps for Slack, Microsoft Teams, Google Chat, and Jira. When your organization installs one of our apps, the app receives messages sent to the app or posted in channels where it has been added, and the platform user ID, display name, and email address of the people who use it. That information is Customer Data, and we process it on behalf of your organization under our agreement with it. We keep Customer Data for the term of that agreement and delete it afterward as the agreement provides. If your organization removes an app, the app stops receiving new information. The service providers that process Customer Data for us, including AI model providers, are listed at trust.action.so. To ask about or request deletion of your information, contact your organization’s administrator or email support@action.so.
Professional advisers and representatives. Our lawyers, accountants, and auditors, and our EU and UK representatives when they handle inquiries from you or a regulator.
Business transfers. A buyer, successor, or other party in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, subject to protections at least as protective as this Privacy Policy.
Legal and safety. Government authorities, courts, or other parties where we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of Action, our customers, or others.
At your direction. Other parties when you ask us to, such as when you approve a published case study.
The Websites and the Service may link to third-party websites and services that we do not control. Their privacy practices are their own.
7.Cookies and Local Storage
Cookies and browser local storage let a website or application store information on your device and read it later.
Websites. action.so does not set cookies and does not load analytics, advertising, tracking, or other third-party scripts. Our trust center at trust.action.so is hosted by Vanta, and our documentation site at docs.action.so is hosted by Mintlify and is available only to signed-in users. Those providers may set cookies needed to operate their sites.
Service. The Service uses the technologies below.
| Technology | Purpose | What it stores or receives |
|---|---|---|
| Sign-in storage | Keeps you signed in and secures your session | Session tokens, and your name, email, and organization name, in local storage |
| Mixpanel | Product analytics | A device identifier and a queue of unsent events, in local storage, starting on the sign-in page. Events go to our servers, which remove your IP address before forwarding them to Mixpanel. |
| GrowthBook | Turning features on and off | Feature settings, cached in local storage. Your browser downloads them directly from GrowthBook, which receives your IP address and browser user agent. |
| Nango | Authorizing connections to third-party systems | Your browser communicates directly with Nango when you connect a system. |
| Error and performance telemetry | Diagnosing errors and slow performance | Traces sent to our own servers with pseudonymous identifiers. |
We do not use advertising cookies, cross-site tracking, session replay, or click capture in the Service.
Your choices. You can block or clear cookies and local storage through your browser settings. Blocking sign-in storage will prevent you from signing in to the Service. Because we do not sell or share personal information or track you across third-party websites, we do not respond differently to Do Not Track or Global Privacy Control signals.
8.How Long We Keep Information
We keep personal information only as long as needed for the purposes in Section 4, then delete or deidentify it. When we deidentify personal information, we keep it in deidentified form and do not attempt to reidentify it.
| Information | Retention period |
|---|---|
| Account information and organization activity log | Life of the customer agreement. After the agreement ends, we delete it from production systems within 30 days, and from backups and security and operational logs within 90 days thereafter. |
| Sign-in records | Life of the customer agreement. Deleted from production systems within 30 days after the agreement ends, and from backups and logs within a further 90 days. |
| Application logs and traces | 90 days, on a rolling basis |
| Infrastructure metrics | 1 year |
| Database backups | 2 days |
| Product analytics in Mixpanel | While the customer account is active, then deleted within 90 days |
| Website logs | Up to 30 days with Vercel; Cloudflare logs under Cloudflare’s standard retention schedule |
| Delivery records for product email (recipient address and delivery status) | 45 days, with Postmark |
| Business contact information for customer administrators and purchasing contacts (kept in our sales, billing and email records, separately from the Service) | Term of the customer agreement, plus 2 years |
| Prospect records | 3 years after our last contact |
| Support correspondence | 2 years after our last contact |
| Meeting notes and recordings | 5 years |
| Billing contact information and invoices | 7 years, for tax and accounting purposes |
| Candidate information | 4 years after the hiring decision, unless the candidate is hired |
We may keep information longer where the law requires it or to preserve it for a legal claim.
9.Security
We use administrative, technical, and physical safeguards designed to protect personal information. Data is encrypted in transit and at rest. Access to production systems is limited to the engineers who need it and requires multi-factor authentication. Administrative actions in the Service are logged, and customers can use their own single sign-on.
Action has completed a SOC 2 Type I examination, and an independent security firm tested our public-facing application and APIs in September 2026. Our SOC 2 reports are available on request through trust.action.so.
No method of transmission or storage is completely secure, and we cannot guarantee the security of information. If we learn of a security incident affecting your personal information, we will notify you and any relevant authorities as required by applicable law.
10.Where We Process Information
Action is based in the United States, and we store and process personal information in the United States. All of our employees and contractors are in the United States. Our hosting providers’ networks may route traffic through other countries, and some service providers’ support staff may access information from outside the United States under their agreements with us.
Where an organization in the European Economic Area, the United Kingdom, or Switzerland transfers personal information to us, or we transfer it to a service provider in a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, with the amendments required for transfers from Switzerland. You can request a copy of these safeguards by contacting us as described in Section 16.
11.Your Privacy Rights
Depending on where you live, you may have the right to:
- know what personal information we have collected about you, and receive a copy of it in a portable format;
- correct inaccurate personal information;
- delete your personal information, subject to exceptions allowed by law;
- restrict or object to our processing, including an unconditional right to object to direct marketing;
- withdraw consent where we rely on it, without affecting processing that took place before withdrawal;
- opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, and certain profiling (we do not engage in any of these); and
- not be discriminated against for exercising any of these rights.
How to make a request. Email support@action.so with the subject “Privacy Request.” We will verify your identity by matching information you provide with information we hold, and we may ask for more if needed. An authorized agent may submit a request for you with your signed permission, and we may ask you to confirm your identity with us directly. We will respond within the time required by applicable law.
Appeals. If we decline your request, you may appeal by replying to our decision or by emailing support@action.so with the subject “Privacy Appeal.” We will respond in writing within the time required by law.
Sales emails. We do not send newsletters or bulk marketing email. If you receive a sales email from us, you can opt out by replying to it, and we will stop contacting you.
For requests about Customer Data, see Section 2.
12.Additional Information for California Residents
To the extent that the California Consumer Privacy Act, as amended (“CCPA”), applies to us, this section supplements this Privacy Policy for California residents. The sources of personal information are in Section 3, the purposes are in Section 4, and retention periods are in Section 8. In the past 12 months we have collected the following categories of personal information.
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, work email, IP address, account and device identifiers | Service providers; your organization’s administrators |
| Customer records described in Cal. Civ. Code 1798.80(e) | Name, work email, billing address | Service providers |
| Internet or other electronic network activity | Product usage information, login records, website logs | Service providers |
| Audio or electronic information | Call recordings and transcripts | Service providers |
| Professional or employment-related information | Job title, employer, candidate materials, background check result | Service providers; professional advisers |
| Sensitive personal information | Account login credentials | Service providers, for authentication only |
We do not sell or share personal information, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only to provide and secure the Service, and not to infer characteristics about you. We do not offer financial incentives in exchange for personal information.
13.Additional Information for Individuals in Europe
This section applies to individuals in the European Economic Area, the United Kingdom, and Switzerland. Action is the controller of the personal information described in this Privacy Policy, and Section 4 states the legal basis for each purpose. Where we rely on legitimate interests, you may object, and you may ask us how we balanced our interests against yours.
Where we did not collect information from you directly, Section 3 identifies the source. You also have the right to lodge a complaint with the data protection authority where you live or work, or, in the United Kingdom, with the Information Commissioner’s Office. Our EU and UK representatives are listed in Section 16.
14.Children
The Websites and the Service are intended for businesses and are not directed to anyone under 16. We do not knowingly collect personal information from children under 16. If we learn that we have, we will delete it.
15.Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last updated” date. If we make a material change, we will give notice before it takes effect by email to customer account administrators or by notice in the Service. We will not use personal information collected under an earlier version in a materially different way without your consent where the law requires it.
16.Contact Us
For questions about this Privacy Policy or to make a request, contact:
Action Intelligence, Inc.Attn: Privacy
500 Washington Street, Suite 425
San Francisco, CA 94111
support@action.so (subject: “Privacy Request”)
EU representative (GDPR Article 27). Instant EU GDPR Representative Ltd., Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8, Ireland. Email: contact@gdprlocal.com. Phone: +353 1 554 9700.
UK representative (UK GDPR Article 27). GDPR Local Ltd., 1st Floor Front Suite, 27-29 North Street, Brighton, BN1 1EB, United Kingdom. Email: contact@gdprlocal.com. Phone: +44 1772 217800.
17.Supplement: Google User Data
This section explains how the Service accesses, uses, stores, shares and deletes data it receives from Google APIs (“Google user data”) when you or your organization’s administrator connect a Google service: Google Workspace, Google Drive, Gmail, Google Calendar, Google Docs, Google Sheets or Google Slides. Google user data received through a customer’s connection is Customer Data under Section 2, and this section describes how the Service handles it. If anything elsewhere in this Privacy Policy conflicts with this section, this section controls for Google user data.
Data We Access
The Service requests access only to the Google services you choose to connect, and uses each one only for the features described here:
- Google Workspace (Admin SDK): users, groups, group memberships, organizational units, license assignments, the third-party apps each user has authorized, and Admin audit events, so administrators can run access reviews and keep an inventory of who has access to what. When an administrator approves it, the Service also creates, suspends and deletes accounts and manages groups and group memberships during onboarding, offboarding and access changes.
- Google Drive: the content of files in the drives you select for the knowledge base, file metadata and sharing permissions, and the files that IT workflows create, organize or share.
- Gmail: messages, threads and labels in the connected mailbox, so the Service can triage and label requests, move messages to Trash, and draft and send replies on your behalf.
- Google Calendar: availability and the calendar events the Service creates, changes or deletes for you.
- Google Docs, Sheets and Slides: the documents, spreadsheets and presentations the Service creates or edits for you.
- Your Google account: your name, email address and profile picture, to identify the connected account.
How We Use Google User Data
We use Google user data only to provide and improve the user-facing features of the Service that you or your administrator choose to use, such as answering employees’ IT questions, handling requests that arrive by email, and running access reviews and IT workflows. We do not use Google user data for advertising, we do not sell it, and we do not use it to determine creditworthiness or for lending purposes.
Artificial Intelligence
To answer questions and carry out tasks you request, the Service may send Google user data to the AI model providers that power it. These providers process the data only on our behalf, under terms that do not allow them to train their models on it. We do not use Google user data, including data obtained through Google Workspace APIs, to develop, improve or train generalized artificial intelligence or machine learning models.
How We Share Google User Data
We share Google user data only with service providers that process it on our behalf to operate the Service, such as our hosting and AI model providers; when required by applicable law; to protect against fraud, abuse or security threats; or as part of a merger, acquisition or sale of assets, after notice to you. People at Action do not read Google user data unless you give us permission (for example, to help with a support request), it is needed for security purposes or to comply with applicable law, or it has been aggregated and anonymized for internal operations.
Storage and Protection
Google user data is encrypted in transit and at rest and stored in access-controlled systems operated by us and our service providers. The credentials that let the Service reach your Google account are stored encrypted and are used only to make the requests described in this section.
Retention and Deletion
We keep Google user data only as long as we need it to provide the Service. Content indexed from Google Drive is removed when you deselect it or disconnect Google Drive. Other Google user data is deleted when you disconnect the Google service or delete your account, except for content you have chosen to keep in the Service, such as conversations, cases or documents, which is deleted when you delete it or your account. You can revoke the Service’s access at any time from your Google Account at myaccount.google.com/permissions, and you can ask us to delete your data using the details in Section 16.
Limited Use
Action’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Previous versions of this Privacy Policy are kept in the policy archive. The version this one replaced, dated October 17, 2026, is at action.so/privacy/archive/2026-10-17.