Privacy policy

1. Our role: your information and your organization's content

This policy covers information about you, such as your account, billing, and website activity. The content an organization puts into or retrieves through the Platform (“Customer Content”) is processed on that organization’s behalf under its agreement with us, and questions about it are best directed to the organization. Section 5 on Google user data applies to all data we receive from Google APIs and controls over anything else in this policy where the two differ.

2. Information we collect

Information you give us. When you request a briefing, take an assessment, download a paper, or otherwise contact us, we collect your name, work email, company, role, and anything else you choose to tell us. When you create a Platform account we collect your name, email address, and organization. If you buy a paid plan, our payment processor (Stripe) collects your payment details and billing address. We never see or store full card numbers. We also keep the messages you send us for support or feedback.

Information the Platform creates as you use it. When you connect a third-party service, we store the credentials needed to keep that connection working, encrypted as described in Section 6. We keep operational records of activity, such as which tools were called, by whom, when, and whether the call succeeded, so we can run the service reliably and give your organization an audit trail. These records hold activity metadata, not the content of the messages, files, or responses involved.

Customer Content. We store the Customer Content your organization chooses to keep in its workspace, such as indexed documents and context graph entries, so the Platform can search and serve it to your authorized users and agents. Content that a connected tool returns in answer to a request is passed back to you to complete that request and is not otherwise kept, unless you or an agent acting for you deliberately save it into your workspace.

Information collected automatically. On this website we collect standard usage data, including pages viewed, referring links, campaign and ad click identifiers, approximate location derived from IP address, and device and browser type. In the Platform’s web app we collect performance and session data (pages loaded, errors, and interactions) to diagnose problems, linked to your internal user and organization IDs. Cookies and similar technologies are described in Section 9.

Information from other sources. If you sign in with a third-party identity provider such as Google or Microsoft, we receive the basic profile information you allow it to share, typically your name and email address. We receive aggregate reporting from our advertising and analytics partners. For business outreach, we may obtain professional contact details (such as name, title, employer, and work email) from business data providers and public sources.

3. How we use information

We use the information we collect to:

• provide, operate, secure, and support the Services;
• create and manage accounts, authenticate users, and enforce access controls;
• process payments and manage subscriptions;
• respond to inquiries, prepare for the conversations you request, and send service notices such as security alerts and billing confirmations;
• send product updates and marketing to business contacts, which you can opt out of at any time;
• understand how the website and Platform are used, measure which marketing works, and fix bugs and performance problems;
• detect, investigate, and prevent abuse, fraud, and security incidents; and
• comply with law and enforce our terms.

We use Customer Content only to provide the Platform to the organization that owns it, as its agreement with us allows, and never for advertising. We may create aggregated or de-identified information that can no longer reasonably be linked to you or your organization, for example service-wide usage counts, and use it to run and improve our business.

4. AI models and connected AI applications

Parts of the Platform route requests to third-party AI model providers (currently Anthropic, OpenAI, and Google). When they do, the content needed for that request is sent to the provider for inference only, to produce the response you asked for. Our agreements with these providers prohibit them from training their models on that content.

We do not use Customer Content or Google user data to train, fine-tune, or improve generalized or cross-customer AI or machine learning models, whether the data is raw, aggregated, anonymized, or derived.

You may also connect your own AI applications to the Platform, such as Claude, ChatGPT, Cursor, or an agent you build. Those applications are chosen and controlled by you or your organization and are not our service providers. Once the Platform returns data to them at your direction, their handling of it is governed by their own terms and privacy policies.

5. Google user data

If you connect a Google account, the Platform accesses Google services on your behalf, with your explicit consent through Google’s OAuth consent screen. We request only the scopes needed by the connectors you or your organization enable. Depending on those connectors, this may include reading and managing your Gmail messages, reading files in Google Drive, managing your Google Calendar, and reading Google Docs, Sheets, and Slides.

Use. We use Google user data for one purpose only, which is to provide the user-facing features you or your authorized AI tools request through the Platform. We do not use or transfer it to serve advertising of any kind, including retargeting, personalized, or interest-based advertising. We do not sell it, transfer it to data brokers or information resellers, or use it to determine creditworthiness or for lending.

AI. We do not use Google user data, or anything derived from it, to develop, improve, or train generalized or non-personalized AI or machine learning models. When your request involves an AI model, the relevant content is sent to the model provider solely to complete that request, under terms that prohibit the provider from training on it.

Storage. Content retrieved from Google is passed through to serve your request. We do not build server-side copies, caches, or indexes of your Google data, and our operational logs record activity metadata only, never the content of your messages or files. The Google data we persist is limited to your OAuth credentials, which are encrypted as described in Section 6.

Human access. Port of Context personnel do not read your Google user data unless you give us affirmative permission for specific data (for example, to help with a support request), it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

Sharing. We transfer Google user data only to provide the features you request (including to AI applications you choose to connect), to service providers as needed to provide those features under confidentiality and data protection obligations, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.

Deletion. You can disconnect a Google connector at any time from your Port of Context dashboard, which deletes the stored credentials immediately. You can also revoke our access at any time from your Google Account permissions.

Port of Context’s use and transfer to any other application of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we protect information

• Encryption in transit. All connections between your clients, our services, and the third-party services you connect are encrypted with TLS.
• Encryption at rest. OAuth access and refresh tokens and other connection credentials are encrypted with AES-256-GCM before they are written to our database, with encryption keys held in a dedicated secrets manager under least-privilege access. They are never stored in plaintext. Our databases and storage are additionally encrypted at rest by our cloud provider.
• Tenant isolation and access controls. Each organization’s data is isolated at the database level. Connection credentials are scoped to the user who granted them and used only for that user’s sessions. API access requires authenticated, hashed credentials, and administrative actions are recorded in an append-only audit log.
• Incident response. If we become aware of a breach affecting your personal information, we will notify you and affected customers promptly and share what we know as the investigation proceeds, consistent with applicable law.

No system is perfectly secure, and we can’t guarantee that information will never be accessed, disclosed, or altered without authorization. You are responsible for keeping your account credentials and API keys safe and for not sharing them. If you believe your account or data has been compromised, email privacy@portofcontext.com right away.

7. Retention and deletion

We keep information only as long as we need it to provide the Services, meet legal and accounting obligations, resolve disputes, and keep the Services secure, and then delete or de-identify it. Connection credentials are deleted immediately when you disconnect the connection, delete your account, or your organization is deleted. To request deletion of anything we hold about you, email privacy@portofcontext.com.

8. Who we share information with

We do not sell your personal information for money. We share information only in the following ways.

Service providers. We share information with vendors who help us run the Services, including for cloud hosting and storage, sign-in, payment processing, AI model inference, monitoring and security, analytics, advertising measurement, and customer relationship management. They may use it only to provide services to us, and we’ll provide a current list on request.

At your direction. The Platform is a gateway, and your organization decides which third-party tools, MCP servers, and AI applications to connect to it, from Google Workspace and Slack to its own internal systems. When you use a connected tool, we pass your request and its data to that tool because you asked us to. These tools are chosen by you, are not our service providers, and handle the data they receive under their own terms and privacy policies.

Professional advisors. We may share information with our lawyers, accountants, auditors, and insurers as needed for them to advise us.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this policy and, for Google user data, the consent requirement in Section 5.

Legal and safety. We may disclose information when we believe in good faith that it is required by law, subpoena, or other legal process, or that it is necessary to protect the rights, property, or safety of Port of Context, our users, or the public, including to detect and prevent fraud and security issues.

9. Cookies and similar technologies

On this website we use:

• Marketing attribution (first-party). A cookie we set (pctx_attr) records the campaign or ad click that first brought you to the site, so we can measure which marketing works. It is only set when you arrive from a tagged link or ad, and it expires after about 90 days.
• Product analytics (PostHog). We use PostHog to understand site usage and, on some sessions, to replay interactions so we can improve the experience. Form inputs are masked, so recordings never capture what you type.
• Advertising measurement (Google Ads, Microsoft Advertising, LinkedIn). These tags measure conversions from ads we run and may set cookies that the advertising platforms use for ad measurement and targeting.
• Traffic measurement (Vercel Analytics). Privacy-friendly, aggregate traffic statistics that do not use cookies.

The Platform web app uses cookies that are strictly necessary to sign you in and keep your session secure, plus Datadog monitoring to diagnose errors and slow pages. It does not use advertising cookies.

You can block or delete cookies in your browser settings, though parts of the Services may not work without them. Our website does not currently respond to browser “Do Not Track” signals, because there is no common standard for interpreting them.

10. Your rights and choices

You may request to access, receive a copy of, correct, or delete the personal information we hold about you by emailing privacy@portofcontext.com. We will verify your identity before fulfilling a request and will respond within the time required by applicable law. We will not discriminate against you for exercising any of these rights.

Other choices. You can unsubscribe from marketing emails with the link in any message; we will still send service messages about your account. You can opt out of personalized Google advertising at adssettings.google.com, and manage ad settings for Microsoft and LinkedIn in your accounts with those services. You can update basic account details in the Platform, and organization administrators can manage their members, connections, and content there directly.

11. International transfers

Port of Context is based in the United States, and we and our service providers process information in the United States and other countries whose data protection laws may differ from those where you live.

12. Children

The Services are built for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

13. Third-party services and links

The Services link to and connect with websites and services we don’t control, including the tools you connect to the Platform. Their own privacy policies govern how they handle your information, and we encourage you to review them.

14. Changes to this policy

We may update this policy as the website and Platform evolve, and we’ll revise the date at the top when we do. If we make a material change to how we use or share personal information, we will tell you in advance by email or with a notice in the Platform.

15. Contact us

For questions about this policy or our privacy practices, or to make a request, email privacy@portofcontext.com or write to us at Port of Context, 85 Broad Street, Floor 17, New York, NY 10004. Port of Context is a trade name of Sideko, Inc.