Who we are
Masterkey is operated by Masterkey LLC.
Masterkey is an operating system for companies. A company signs up, connects its tools, and its people build their own screens, workflows and agents. The agents run on the company's own data.
What this policy covers
This policy covers the Masterkey app at os.masterkey.ai and the accounts you connect to it. It says what data Masterkey collects, what it does with that data, who else handles it, how long it is kept, and what you can do about it.
When your company brings a TimeScout scan, Masterkey reads the scan report through a hand-off. TimeScout is a separate product with its own privacy policy.
What we collect
Account details: your name, your email address, your company and your role, from sign-in.
Data from the sources you connect: for example mail, calendar events, documents, spreadsheets, contacts, chat, meetings, CRM records and payments. Masterkey reads only what each connection needs.
What your company builds: screens, workflows, agents and their settings, and what the agents produce.
Product usage: the pages you open, recorded with your account id only, never your name, your email or the query string.
Messages you send to support.
Google user data we access
When you connect a Google account, Google asks you to approve each permission below. Masterkey uses each one only for what this list says.
https://www.googleapis.com/auth/gmail.modify: Read and organize your Gmail. Lets Masterkey read your mail and its labels, add and remove labels, archive messages and move them to Trash. Masterkey uses this to keep your company's copy of your mail, to show it on your screens, and to let an agent sort mail at the level your company sets. It cannot delete a message for good.
https://www.googleapis.com/auth/gmail.send: Send mail from your Gmail. Lets Masterkey send mail from your address. Masterkey uses this only to send a message an agent drafted, at the level your company sets.
https://www.googleapis.com/auth/calendar: See and edit your Google Calendar. Lets Masterkey see your calendars and events, and create or change events. Masterkey uses this to show your meetings and to let an agent add or move an event at the level your company sets.
https://www.googleapis.com/auth/drive: See and edit your Google Drive files. Lets Masterkey see, open, create and change files in your Google Drive. Masterkey uses this to find the files your screens and agents work from, and to save a file an agent makes.
https://www.googleapis.com/auth/documents: Read and edit your Google Docs. Lets Masterkey read and edit your Google Docs. Masterkey uses this to read a document an agent works from and to write the changes an agent makes, at the level your company sets.
https://www.googleapis.com/auth/spreadsheets: Read and edit your Google Sheets. Lets Masterkey read and edit your Google Sheets. Masterkey uses this to read the numbers your screens show and to write the changes an agent makes, at the level your company sets.
https://www.googleapis.com/auth/contacts: See and edit your Google Contacts. Lets Masterkey see and change your Google Contacts. Masterkey uses this to tell the people inside your company from the people outside it, and to match one person across your sources.
openid: Sign in with Google. Lets Masterkey sign you in with your Google account.
https://www.googleapis.com/auth/userinfo.email: See your Google email address. Lets Masterkey see the primary email address of your Google account, to know which account you signed in with.
https://www.googleapis.com/auth/userinfo.profile: See your Google name and picture. Lets Masterkey see your name and profile picture, to show who is signed in.
Masterkey connects to Google and your other sources through Composio. Composio holds the access each provider grants and passes Masterkey's requests to it. It handles your data only to make those requests.
Your company's copy of your data
Masterkey keeps a company copy of the data your company's connections sync, with the original record from each source. Your screens, workflows and agents work on this copy, so they keep working when a provider is slow or down.
How agents act for you
Agents can send mail, create and change calendar events, and read and edit Google Docs and Sheets. They do this only at the level your company sets for each agent.
Your company chooses the level each agent works at: Drafts only, Asks first or On its own. An agent never sends anything to a person outside your company on its own.
How we use data
Masterkey uses your data to run your company's screens, workflows and agents, to sync your sources, to answer support requests, to keep the service secure, and to fix and improve the service.
Masterkey does not sell your data and does not use it for advertising.
Google API Services User Data Policy
Masterkey's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Under the Limited Use requirements, Masterkey:
1. Uses Google user data only to provide and improve the features you see and use in Masterkey.
2. Transfers Google user data to others only when it is needed to provide those features, for security, to obey the law, or as part of a merger, acquisition or sale of assets, with notice to you.
3. Does not let a person read Google user data, unless you give consent for specific messages, it is needed for security or to obey the law, or the data is aggregated and anonymized for internal operations.
4. Does not use or transfer Google user data for advertising, including retargeting, personalized or interest-based ads.
Google user data is not used to train general AI models. Masterkey does not use it, and does not let a vendor use it, to develop, improve or train generalized AI or machine-learning models.
AI processing
AI features run on Anthropic's Claude models, called directly and through OpenRouter. Under their terms, neither trains its models on your data.
Masterkey sends a model only the data the task needs. The answer is stored in your company's copy.
Who sees what inside a company
A connection belongs to the person who connected it. A mailbox is visible to that person and to the agents they run.
The company owner cannot read an employee's private mail.
What a person builds and shares in the company is visible to the members it is shared with. Each company's data is kept apart from every other company's.
Sub-processors
These vendors handle data on Masterkey's behalf: Vercel, Supabase, Railway, Clerk, Composio, Google Workspace and Microsoft 365 APIs, Anthropic, OpenRouter, Cloudflare, Resend, Intercom, Stripe, Sentry, PostHog, Sendblue and Deepgram. New ones are announced at least 14 days ahead.
How long we keep it
Masterkey keeps synced mail and other source data with no automatic deletion. It stays until your company or the person who connected the source asks to delete it, or the account is deleted.
Account details stay while the account exists.
Deleting data and revoking access
Disconnecting a source stops Masterkey from reading it. You can delete your account yourself from Account settings; that deletes the data Masterkey holds for it.
To delete the data from one source, write to privacy@masterkey.ai or ask through Support inside Masterkey. Requests are answered within 30 days.
You can also remove Masterkey's access to your Google account at any time at myaccount.google.com/permissions.
Security
Data is encrypted in transit and at rest, and stored credentials are encrypted again by the app. The database denies access by default and keeps each company's data apart. Staff actions are logged. There is no SOC 2 report yet.
Where data is stored
Masterkey stores and processes your data in the United States.
Your rights
You can ask for a copy of your data, a correction or a deletion. Requests are answered within 30 days.
Children
Masterkey is not for people under 16 and does not knowingly collect their data.
If something goes wrong
If a breach involving your data is confirmed, you get an email within 72 hours saying what happened and what is being done.
Changes
When this policy changes, the effective date at the top changes too. A change that affects how your data is used is announced in the app or by email before it takes effect.
Contact
Questions about this policy or your data go to privacy@masterkey.ai.
You can also ask through Support inside Masterkey.