Privacy Policy
Last updated 2026-11-13
Abalmon is provided by Abalmon Inc., a Delaware corporation, 1606 Headway Circle, Austin, TX 78754, United States. Contact: hello@abalmon.com.
This policy explains what information Abalmon receives, why, who else receives it, how long it is kept and how you can exercise your rights. It covers the website, the web and phone apps, the Chrome extension, supported devices and the connections available to your account.
Who is responsible
Abalmon Inc. (details above) provides Abalmon and is responsible for the processing described in this policy, except where it acts on behalf of a business customer as explained in section 2. For privacy questions and rights requests, write to hello@abalmon.com or use our contact form.
Representative in the European Union. Abalmon Inc. has chosen Biese School SL (Spanish tax ID B22456735, Spain) to act as its representative in the European Union under Article 27 of the GDPR. A representative is a point of contact in the EU for individuals and data protection authorities; it does not replace Abalmon Inc., which remains responsible for the processing. For privacy questions and rights requests, use hello@abalmon.com.
Abalmon has not appointed a data protection officer. All privacy matters are handled through the contact address above.
Abalmon is a general productivity tool that helps managers, executives, founders and other professionals organise and find information. It is not a clinical or medical service.
When we decide and when we act for a customer
Abalmon decides how information is used, and is the controller, for running your account, billing, support, security, the community board, our own communications and the optional website analytics.
When an organisation or professional uses Abalmon to handle information about its customers, employees or other people for its own purposes, that organisation decides the purposes and is the controller, and Abalmon processes the information on its behalf under the Data Processing Agreement. If that organisation itself acts for another controller, Abalmon is a subprocessor. The organisation must have the authority to contract with Abalmon and to give it instructions.
Purely personal or household use does not turn every operation into processing for a business. The role and duties that apply depend on the purpose of each operation.
If you are not an Abalmon user. Your information can reach Abalmon when it appears in a meeting someone records, or in an email, calendar event or message from an account a user connects. You can contact the user or organisation that brought it into Abalmon, or write to hello@abalmon.com. You do not need an Abalmon account to exercise your rights. We will locate the request with the information you provide and, where a customer is the controller, pass it to that customer without disclosing other people's content.
Information we receive
- Account: name, email address, a hash of your password (or your linked Google identity), your language (initially your browser's, changeable in Settings) and the timezone detected from your browser.
- Connected accounts (Google, Microsoft Outlook or Slack): the mail, calendar or message content each provider makes available under the access you grant, imported into your searchable memory.
- Recorded sessions (web, phone app or Chrome extension): the recorded audio — your microphone and, for meeting recordings, the audio of the meeting tab you selected, which includes the other participants — plus the transcript, contextual cards and the generated review. They are saved persistently in your account and become part of your searchable memory.
- Abalmon Chrome extension: it captures audio only after you click Start recording on a tab, and only that tab’s audio plus your microphone; it does not read page content, your browsing history or other tabs, and it pauses if that tab is closed or leaves the meeting page. The recording is sent to Abalmon and processed like any other session (it is not kept only on your computer). To link the recording to a calendar meeting, it sends the meeting page address without its query to Abalmon, which does not store it. The extension keeps a revocable sign-in credential in Chrome’s extension storage, and keeps audio that has not finished uploading on this computer, encrypted with a key held by your Abalmon account. Abalmon uses what the extension captures only to provide recording, its session panel and chat.
- Assistant conversations: your messages and the replies, the files and photos you choose to attach (including photos you take with the camera in the phone app), and the emails and calendar changes made from them. Attached files are stored encrypted with their conversation. The “About me” text you write on the About you page is also stored encrypted and used as context for the assistant.
- Notifications about your sessions, imports and briefings. If you allow push notifications in the phone app, Abalmon stores that device's push token to send generic alerts that don't include your content; the token is removed when you sign out or delete your account.
- Reports: if you report AI-generated content, Abalmon keeps a copy of the reported content with your reason and optional note, and shares them with Abalmon's administrators for review. Reports are deleted with your account.
- Sign-in and security: if you sign in with Google or, where available, Apple, we receive the identifier and the details you authorise. Your PIN, passkeys and devices generate security records. When your phone unlocks Abalmon with Face ID, Touch ID or a fingerprint, the check happens on the device; Abalmon does not receive an image of your face or fingerprint.
- WhatsApp (only where this connection is available for your account): you link Abalmon from the website as a linked device of your WhatsApp account. Abalmon receives the content and metadata that connection delivers — messages, chats, groups and the contact details needed for the available functions — and keeps encrypted linking credentials so the connection survives restarts until you disconnect or WhatsApp ends it. Complete history is not guaranteed. Imported messages are stored in Abalmon, become part of your searchable memory and can be processed with AI, including by the providers listed in section 5. WhatsApp's own encryption does not continue inside Abalmon: once imported, messages are not end-to-end encrypted in Abalmon. Messages are sent only when you clearly ask the assistant to reply in an existing conversation.
- Memory and derived content: contacts, collections, notes, summaries, briefings, daily reviews and the links Abalmon builds between people, meetings and messages. Memory can contain inferences and mistakes, and automatic preparation and summaries use the content available in your account.
- Integrations: the permissions you grant to connected assistants, API keys, webhook destinations and their activity records, and the results of actions you request.
- Support and community: your name, email, subject and the messages you send to support or through the contact form. Suggestion text is visible to other signed-in users of the board; administrators can see individual votes to manage the board and send completion emails. Please do not include other people's personal information or confidential material in a suggestion.
- Technical and billing information: device and push identifiers, sign-in activity, information needed to prevent abuse, usage of plan allowances, subscription and payment status, and support incidents. Abalmon does not store full payment card details.
Your content is stored on Abalmon's servers and is not end-to-end encrypted: the service processes it to provide search, transcription, the assistant and reviews.
Purposes and legal bases
| Purpose | Legal basis | Scope |
|---|---|---|
| Creating your account and providing the service you signed up for | Performance of the contract | The information needed for the account and the functions you use |
| Managing the users and contacts of a business customer | Legitimate interest in administering the business relationship | Professional identity and access; it does not allow reuse of the customer's content |
| Payments, subscriptions and support | Performance of the contract, or legitimate interest for business contacts | Account, payment and support information |
| Tax, accounting and valid legal requests | Legal obligation | Only the records required, kept separately |
| Protecting accounts, preventing fraud and handling claims | Legitimate interest in security and in defending legal rights | Limited access and minimised records |
| The suggestions board and its completion emails | The service you request and legitimate interest in running the board | Shared suggestion text, private votes and the expected email |
| Optional website analytics | Consent | Separate from accepting the Terms; you can withdraw it at any time |
When Abalmon processes information about other people on behalf of a customer, that customer decides the legal basis. Your agreement with Abalmon is not, on its own, a legal basis for every employee, contact or participant whose information you bring into the service, and reading this policy is not a blanket consent.
Providing the information needed for your account and the functions you use is a contractual requirement: without it we cannot provide that function. Analytics is optional and not needed to use Abalmon. Withdrawing consent does not affect processing that took place before.
Service providers and other recipients
We use the following providers to run Abalmon. Each one receives only what its function needs and processes it under its own terms and the settings of Abalmon's account with it.
- OpenAI — generates assistant replies, contextual cards and session reviews, and creates search embeddings that index your imported mail, calendar and session content. The relevant messages, the files and photos you attach to a chat, your “About me” text, and transcript and memory excerpts are sent to OpenAI for these purposes. In voice mode, your voice is streamed to OpenAI's realtime service to understand you and to speak the replies; Abalmon saves only the text of the conversation, not the audio. OpenAI processes this data under its own terms.
- Public web research (OpenAI, Tavily and Firecrawl) — when you ask about something public, the assistant can search the web with OpenAI's web search, or with Tavily, and can have Firecrawl read one public web page. They receive only a short search query written for that request, or a public web address. Your conversation history, memory, “About me” text and attachments are not sent to them. The links found are kept with the reply so you can open them again later.
- Google Maps Platform — when you ask about places, Abalmon sends Google only the text of the place search and the language of the app, not your profile, conversations or memory. Google's results are shown to you directly in a separate “Google Maps” block below the reply, with Google's links. They are not sent to OpenAI or used by the assistant's AI model, and they are not added to your memory. Abalmon keeps these results in your chat history for one year and then deletes them. Google processes this data under the Google Privacy Policy, and the Google Maps/Google Earth Additional Terms of Service apply.
- AssemblyAI — transcribes recordings made with current versions of the web app, the phone app and the Chrome extension. While you record, the session audio passes through Abalmon's servers to AssemblyAI, which returns the transcript with speaker labels and detects the spoken language automatically. Speaker labels group similar voices and may start again after a reconnection, so the same person can appear under more than one label; they do not identify who is speaking. You can rename them in your session, but that only changes how they are displayed and does not verify anyone's identity.
- ElevenLabs — transcribes recordings made with older installed versions of the apps or the Chrome extension that do not use AssemblyAI. During meeting recordings, ElevenLabs also transcribes a second microphone-only stream so you can ask “Hey Abalmon”; it is not saved as audio or as a transcript, and only the requests it recognises are kept in the session chat. If the live transcript has gaps, Abalmon sends the saved audio from its servers to ElevenLabs to transcribe it again before the review; in recordings with speaker labels, the recovered text only fills the gaps and is shown without a speaker label.
- Google — sign-in with Google, and the mail and calendar data of accounts you connect.
- Microsoft — the mail and calendar data of Outlook accounts you connect.
- Slack — the messages and workspace details of Slack workspaces you connect, under the access you grant.
- Resend — delivers Abalmon's emails: account emails such as verification and password reset, notification emails such as suggestion completion notices, and the support and contact messages you send to Abalmon.
- Stripe — processes subscription payments. It receives your email address, payment details and billing records; Abalmon never stores your full card details. If you delete your account, an active subscription ends immediately without an automatic refund, and billing records Stripe must keep, such as invoices, remain with Stripe under its own terms.
- Apple and Google — deliver push notifications to the phone app (Apple Push Notification service on iPhone, Firebase Cloud Messaging on Android) if you allow them. They receive that device's push token and a generic alert, not your content.
- Hosting — Laravel Cloud and the infrastructure providers it uses run the application, database, file storage and transcription relay, and protect the network. They store and process all the content described in section 3.
- WhatsApp — the service you connect under your own relationship with it. Abalmon receives messages from it as described in section 3; WhatsApp processes your account under its own terms.
- Apple — sign in with Apple, where available, under Apple's own terms.
Provider credentials are held on Abalmon's servers and are never sent to your browser or device.
Abalmon does not sell your content, does not use it for advertising and does not use it to train general AI models on its own behalf. Providers' retention periods and their use of data for their own purposes differ by provider and by service, and depend on their terms and on the settings of Abalmon's account; we do not give a blanket assurance about every provider.
Authorised Abalmon personnel can access information only when needed for support, security, troubleshooting or legal obligations, under confidentiality and with limited access. Abalmon does not claim any security certification.
Stripe, Google, Microsoft, Slack, Apple and WhatsApp can also act as independent controllers for their own purposes. Not every recipient has the same legal role for every operation.
ChatGPT and Claude
- What they receive — if you connect Abalmon to ChatGPT (OpenAI) or Claude (Anthropic), Abalmon sends that assistant only the content your connection’s permissions allow, and only when the assistant asks for it to answer your requests. Depending on the permissions you approve, this can include: basic account details (your name, time zone, language and what the connection can access, but not your email address); the titles, dates and saved reviews of finished sessions; your session and meeting notes; the names and saved summaries of your Memory collections; and full transcripts only if you turn that permission on. If you choose specific collections, only content within them is included. The connection does not include your recordings’ audio, your conversations with the Abalmon assistant, or direct access to your connected email, calendar or Slack accounts.
- Their own terms — OpenAI or Anthropic processes what its assistant receives under its own terms and privacy policy, and it can remain in your chats there. Abalmon does not ask for your chat history with that assistant; it receives only the request the assistant sends, such as the words to search for.
- Disconnecting — disconnect at any time in Settings → Connected apps. This stops future access, but it can’t remove content the assistant has already received or that is already in your chats there. Resetting your password or deleting your account also disconnects every connected app.
- Connection records — Abalmon keeps a record of each connection (which assistant, the permissions and collections you chose, when you approved it and whether it is still active), including after you disconnect. It also keeps a log of connection events, such as approvals, refusals and disconnections, without your content; these entries are deleted after 30 days. Approval requests expire after 10 minutes and are deleted within two days. All of these records are deleted when you delete your account.
Abalmon does not sell the content it sends to these assistants and does not use it for advertising.
API keys, webhooks and shared links. API keys and webhooks power the integrations you set up. Webhooks deliver event references and metadata; reading content requires a key with the right scope. Revoking a key stops later access, but you remain responsible for copies already transferred to other systems. A shared session link lets anyone who has it see the finished session summary it shows until you revoke it; share only what you are authorised to share.
Whether a personal assistant account offers the protections of a business service depends on that service and on your plan; Abalmon cannot guarantee it.
Where information is processed
Abalmon Inc. is established in the United States and works with providers in several countries. Your information may therefore be accessed or processed outside the European Economic Area, including through remote access, even if some of the infrastructure is located in Europe.
Transfers from the European Economic Area must rely on a mechanism recognised by the GDPR, such as an adequacy decision covering the recipient or appropriate safeguards like standard contractual clauses with any supplementary measures needed. Abalmon Inc. does not claim certification under the EU–US Data Privacy Framework. You can ask us which safeguard applies to a specific transfer and request a copy, with confidential commercial terms removed.
How long we keep information
Delete your account at any time in Settings, in the phone app's Profile or at abalmon.com/account/delete. Every sign-in and device is signed out at once, any recording stops, Abalmon asks Google, Microsoft and Slack to revoke its access, and your recordings, transcripts, memory, conversations, notes, briefings, shared links, push registrations and reports are deleted, usually within minutes. Copies that remain in backups and system logs are removed as those backups and logs expire; you can ask us which periods apply. Service providers handle any data they processed under their own terms. A record that the deletion happened (without your content) is kept for 30 days after it completes so you can check its status.
- Your content is kept while your account exists and you keep using the functions it supports, and according to the customer's instructions where we act for a customer. A trial or subscription ending does not delete it. Abalmon does not currently delete inactive accounts automatically; if that changes, we will tell you in advance.
- You can ask for deletion at any time, with or without an active subscription.
- Integration events and webhook deliveries are kept for 30 days, and revoked or expired API keys are deleted 30 days later. Connected-assistant records follow the periods described in section 6, and Google Maps results the period in section 5.
- Invoices and records we must keep for tax, accounting or legal claims are kept only as long as the law requires, separately from your memory and never used by the assistant.
- Support and contact messages are kept in our support mailbox for as long as needed to handle the request and any resulting claim, and may remain there after your account is deleted. You can ask us to delete them.
- After an account is deleted, its suggestions can remain on the board without the link to their author. That does not make their text anonymous: ask us to remove or edit anything that still identifies you.
- Disconnecting a source stops new imports and removes its content from the related answers and search, but it does not always delete every copy immediately. Content you have shared with independent recipients stays in their systems under their own rules.
Your rights
Where the law provides for them, you can access your information, correct it, ask for it to be deleted, restrict or object to processing based on legitimate interest, and receive the information you provided in a portable format. You can withdraw consent at any time.
Write to hello@abalmon.com saying which right you want to exercise and the minimum information we need to find the data. We verify your identity in a proportionate way and do not ask for identity documents by default. We reply without undue delay and, for requests under the GDPR, within one month; for complex or numerous requests this can be extended by up to two further months, in which case we tell you why within the first month. Requests are free, except where the law allows otherwise.
The session and memory downloads in Settings are self-service aids. They do not include every category — for example, original audio and attachments — and they do not limit your right to a complete answer. When we answer, we also protect other people's rights and information.
You can also complain to the data protection authority of the country where you live or work, or where you believe your rights were infringed. In Spain that is the Agencia Española de Protección de Datos (www.aepd.es).
AI, sensitive information and age
You are interacting with an AI system. Replies, transcripts, inferences and labels can be wrong and need checking. Abalmon is designed to support your work, not to make decisions about employment, credit, health or other matters with significant effects on people without the safeguards the law requires and human review.
Do not use Abalmon as a clinical record or deliberately add special categories of data (such as health information) without an appropriate agreement and legal basis. Sensitive details can still appear incidentally in ordinary email, chats or meetings, and they remain protected: limit the sources you connect, avoid importing private conversations unrelated to your purpose, and contact us if something needs to be removed.
Abalmon is intended for adults aged 18 or over.
Your choices
- Disconnect a connected account at any time: Abalmon stops reading it and its content no longer appears in your memory or answers. For anything else about your data, write to hello@abalmon.com.
- Recording only happens when you start it, on the web, in the phone app or in the Chrome extension. Disconnecting the extension, or removing it from your devices in Abalmon, revokes its access; recordings already saved stay in your account.
- Signing out clears the private cache this website keeps in your browser. Recorded audio that has not finished uploading is kept in this browser, encrypted with a key held by your Abalmon account, and uploads only after you sign in again with the same account.
Changes and contact
We show the date of the current version at the top of this page. When a change is significant, we will tell you through an appropriate channel before it applies. If a new purpose needs your consent, we will ask for it separately; changing this policy does not by itself authorise new processing.
Privacy questions: hello@abalmon.com.