TRUST / PRIVACY
What we hold, where it lives, who processes it and how it's deleted. Formal legal documents are being prepared with counsel.
What we hold
The data your team and your clients put into SmoothOS, plus what's needed to run your account.
- Your workspace: clients, brands, projects, tasks, meetings, proposals, invoices, retainers, time and files.
- Accounts: names, email addresses, roles and two-factor enrollment.
- AI usage: the model, tokens and cost of every call, recorded under your agency.
- Billing: handled by Lemon Squeezy as merchant of record. We don't store card numbers.
Where it lives
SmoothOS is in early access. Today the platform runs on Supabase Cloud, with files on Cloudflare R2 by default.
- At launch we plan to move the database to our own Supabase installation on Hetzner servers.
- The data region for both stages hasn't been decided. We'll publish it here before general launch.
Who can see it
Access is decided by the database, for people and for SAI alike.
- Row-level security keeps every agency's rows apart.
- Clients see only their own company's data.
- SAI reads with the permissions of the person asking.
- Draft invoices and unapproved tasks never appear in the client portal.
Deletion
When a subscription ends, your agency and its files are permanently deleted after 60 days.
- Files are removed from platform storage and from your own S3 bucket if you connected one.
- Files SmoothOS created in your Google Drive are removed and Google access is revoked. Your own Drive content is never touched.
- Custom domains, the sending domain and stored secrets are removed with your rows.
- We keep a deletion record that holds no personal data.
- Paying again before the 60 days are up cancels the deletion.
Export
A full self-serve export of your agency isn't available yet. It's planned. Until then, ask us and we'll help.
Compliance status
We'd rather show the gaps than a badge we haven't earned.
- We don't hold SOC 2 or ISO 27001 certification today.
- GDPR and KVKK pages, and a Data Processing Agreement you can download, are being prepared with counsel.
- We make no promise on AI providers' behalf about training. Their own current terms apply.
Integrations you connect
Google Calendar and Meet, Zoom, Google Drive, Google Analytics, Search Console and Buffer only exchange data when your agency connects them, under your own accounts and their terms.
| Service | What it does | Status |
|---|---|---|
| Supabase | Database, authentication, server functions and optional file storage (Supabase Cloud during early access) | In use |
| Vercel | Hosts the web app during early access | In use |
| Cloudflare | Custom domains and SSL for agency portals, edge routing | In use |
| Cloudflare R2 | Default file storage | In use |
| Anthropic | AI models (Claude) for SAI and meeting scope checks | In use |
| Google (Gemini API) | AI models (Gemini) for reading transcripts and documents | In use |
| Resend | Transactional and agency email delivery | In use |
| Lemon Squeezy | Subscription billing, as merchant of record | In use |
| Hetzner | Production servers for our self-hosted database | Planned |
| Cloudflare Pages | Production hosting for the web app | Planned |
| Recall.ai | Meeting recording bot | Planned |
| Deepgram | Transcription for the recording bot | Planned |
