Two different things live under this name
This website collects nothing. It sets no cookies, runs no analytics and makes no request to any other host. That is covered on the cookies page.
The product is a different matter, and the rest of this page is about it. It reads material you connect to it and it attends meetings, so it necessarily processes personal data.
Where your data sits depends on how you run it
In your own Azure tenant. Your mail, documents, recordings, transcripts and knowledge base stay inside your own subscription. We do not hold them and cannot read them. In data protection terms you are the controller and we are not a processor of that content at all, because it never reaches us.
Hosted by us. The same material is processed on infrastructure we operate in the European Union. You remain the controller, we act as processor on your instructions, and each customer's material is kept separate rather than pooled.
What it reads, and only because you said so
Access is granted through Microsoft's own consent flow and can be withdrawn the same way. We never receive or store your password. Each source is switched on individually: a mailbox, one SharePoint site, a single channel. Nothing is connected by default.
- Outlook mail, OneDrive files, SharePoint sites, Teams chats and channels, Planner tasks
- Repositories and work items in GitHub, GitLab and Azure DevOps, when you connect them
- Meeting audio in the meetings you invite it to, and the transcript and notes made from it
Meetings, and the people in them
A meeting contains other people, which makes this the part that deserves the most care.
- When the assistant joins, a written notice is posted in the meeting chat naming whose assistant it is. It stays on screen for anyone joining late, and the organiser can remove the assistant at any point.
- It is silent by default. It listens and writes the notes. Speaking is switched on deliberately, one meeting at a time.
- Audio is used to produce the transcript and the summary. The recording is kept so that a disputed line can be checked against what was actually said, and is deleted when you delete the meeting.
- Consent rules differ by country, and in some of them recording without telling everyone is a criminal matter. The notice exists for that reason. Whether your meeting may be recorded is a decision only you can make.
Who else touches it
Answers and summaries are produced by models rather than by people. In the hosted version those run on Microsoft Azure AI Foundry and Azure Speech, inside the European Union, under Microsoft's terms for enterprise data, which state that your content is not used to train their models. Where you run it in your own tenant, they are your deployments and your agreement.
Web search, when enabled, sends the search query to a third party search provider. It sends the question, not your documents.
No human at CF Innovation Labs reads your material as part of running the service. We access it only if you ask us to, for support, and only for as long as that takes.
Deleting, and actually deleting
Disconnecting a source can also remove what it brought: the raw copies, the search index entries and the pages written from it. This is offered as a choice rather than done automatically, because someone reconnecting a mis clicked toggle should not lose months of work.
Closing your account removes your data from the hosted service. Backups are kept for a short window for recovery and then expire.
Your rights
If you are in the European Union you have the right to access, correct, export, restrict and erase your personal data, and to object to its processing. Write to [email protected] and we will answer within one month. You also have the right to complain to a supervisory authority.
Last updated 22 August 2026.