Your data, your rules.

Account information: your email address and authentication credentials, managed by Supabase. Subscription and trial status are stored with your account.

Business data you enter: leads, clients, matters, work orders, invoices, events, and other CRM records. Depending on your setup this data lives in your browser’s local storage and/or in your ADA OS cloud account.

Activity logs: sign-ins, module navigation, actions taken (including actions performed by Ada on your instruction), and conversations with Ada. We keep these so you can audit what happened in your account and so support can help you when something goes wrong.

Technical telemetry: errors, security-policy reports, and diagnostic events used to keep the product working.

When you speak to Ada, your microphone audio is processed to power transcription and responses. Audio and text are handled by our AI providers: ElevenLabs (speech and the live voice agent), and Anthropic (Ada’s reasoning). Speech may also be processed by Deepgram or OpenAI when configured as fallbacks.

Voice is only captured when you activate the microphone or a live session — never in the background. Deny microphone permission and every non-voice feature keeps working.

We do not use your audio or business data to train AI models.

Payments and subscriptions are processed by Stripe on Stripe’s PCI-compliant infrastructure. ADA OS never sees or stores your card number. We receive only the payment outcome and plan metadata needed to activate your subscription.

When you ask Ada to send invoices, statements, or messages, they are delivered through Resend from an ADA OS address. The recipient, subject, and content you approve are processed for delivery and logged in your activity trail.

We share data only with the processors that make the product work: Vercel (hosting), Supabase (database and authentication), Stripe (payments), ElevenLabs, Anthropic, Deepgram and OpenAI (AI processing), Resend (email), and Sentry (error monitoring). Each receives only what its function requires.

We do not sell your personal information, and we do not share it with advertisers.

You can request a copy of your data or complete deletion of your account and associated records at any time by emailing support@adaos.net. Deletion requests are honored within 30 days.

Business records you store locally in your browser can be removed at any time by clearing the app’s site data on your device.

All traffic is encrypted in transit (HTTPS/WSS). API keys and secrets are held server-side and never shipped to your device. Access to server data is restricted, rate-limited, and logged. A strict Content-Security-Policy protects the app in your browser, and violations are monitored continuously.

If this policy changes, we will update this page and its effective date. Material changes will be announced in the app.