Privacy Statement

Who we are

Attaché is a product of Attache Holdings LLC, a limited liability company with its registered address at 7 Portwalk Place, Portsmouth, New Hampshire 03801, United States. In this statement, “Attaché”, “we”, “us” and “our” mean that company.

Attaché is a self-serve, multi-tenant CRM with AI agents, sold per seat. Customers sign up and run themselves. There is no per-customer deployment and no professional-services engagement in the middle — one platform, one set of infrastructure, many customers isolated inside it.

Which product this statement covers. Attache Holdings LLC operates more than one product, and this domain is the company’s rather than any one product’s. This statement covers Attaché — the self-serve platform — and this website. It does not cover Sentinel, our contracted life-sciences build, which runs as a single-tenant deployment on its own infrastructure with its own controls; how we handle data there is governed by the agreement signed with that customer and by the data processing agreement under it, not by this page.

Our role: processor or controller

Which hat we wear depends on which data you mean, and the distinction matters for your rights.

Data you put into Attaché — we are the processor

The accounts, contacts, deals, notes, tasks and files in your workspace belong to you. You decide what goes in, why it is there, and how long it stays. We process it on your instructions in order to provide the service. Under the GDPR and similar laws, you are the controller and we are the processor, and the people whose details you store are the data subjects.

If one of your contacts asks us directly what we hold about them, we will not answer for you. We will refer them to you and help you respond.

Your own account and billing data — we are the controller

The name, work email and password of the people on your account, your subscription and payment records, and our server and usage logs are data we determine the purposes for. For that narrow set, we are the controller.

Information we collect

Information you give us

• Account information — the name, work email address and password of each person you give a seat to, and the organization name.
• Workspace content — everything you or your team enter or import: accounts, contacts, deals, quotes, notes, tasks, expenses, attachments.
• Support correspondence — what you write to us when you ask for help.

Information that arrives because you connected or published something

• Calendar entries, and a passing digest of recent mail, if and only if a user on your account connects a mailbox. The mail digest is read to answer a question and is not stored. Section 4 covers this in full.
• Public comments on a YouTube channel somebody chose to watch, if and only if a user on your account connects one. The commenter’s public display name and channel id, and the text of the comment, are cached for no longer than 30 days. Section 5 covers this in full.
• A name, an email address and a tick box from somebody who filled in a sign-up page you published, if and only if a user on your account publishes one. We also record, as we do for any form posted to us, the IP address the submission came from and the browser string it was sent with. Section 6 covers this in full.

Information we generate

• Authentication records — every sign-in, multi-factor challenge, pass, failure, enrollment and sign-out is appended to an audit log.
• Audit trail — every change to your data is recorded with who made it and when.
• AI usage metering — for each AI action, the kind of job, the model tier and the token count, so that your usage dashboard can show you what the AI layer did and what it cost.
• Technical logs — ordinary server logs: request paths, timestamps, IP address, error traces.

We do not buy personal data about you from data brokers to enrich your account, and we do not build advertising profiles.

Connected mailboxes

Connecting a mailbox is optional, it is off until a user turns it on, and it is the part of Attaché that touches the most sensitive information. So here is exactly what happens.

What we ask for

When you connect a Microsoft 365 or Google Workspace mailbox, you are shown your provider's own consent screen listing the permissions we request. They are:

That is the whole list. On the direct Microsoft and Google connections we do not request access to your calendar, your contacts, your files or your drive, and we cannot read them. The read permission is deliberately the narrow, read-only one: we cannot modify or delete anything in your mailbox.

We never send mail on your behalf on our own initiative. The send permission is used only when a person on your account composes and sends a message in Attaché. We do not send marketing from your address, and we do not auto-reply.

What we store: nothing out of the mailbox itself

We do not store your messages. There is no mail ingest and no copy of your inbox on our side. When somebody on your account asks their agent about recent mail, we read a digest from your provider at that moment — sender, subject, date and your provider's own one-line snippet, the same fields your own inbox list shows you — and use it to answer the question. Message bodies and attachments are never fetched from your provider, which is what makes it impossible for them to be stored, logged or sent to a model. Attachments you deliberately save onto a record are stored, because you put them there. Where calendar sync is in use, we store an event's subject, time, participants and conferencing link — not its full description.

Limited Use of Google user data

Attaché’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, and in plain terms:

• We use Google user data only to provide and improve the features you connected the mailbox for — sending a message you wrote in Attaché, and answering a question you asked about your own recent mail.
• We do not transfer or sell Google user data to anyone, except as needed to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition — and in that last case the data stays under this same policy.
• We do not use Google user data for advertising, and we do not build advertising or marketing profiles from it.
• We do not allow humans to read your Google user data, unless we have your explicit permission for a specific message, it is necessary for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and de-identified so that it is no longer about you.
• We do not send Google user data to a third-party AI or machine-learning model to train or improve that model. When an agent answers a question about your mail, the digest is passed to the model for that one answer and is not retained by us for training, ours or anyone else’s.

Turning it off

You can disconnect a mailbox in Attaché at any time, and you can independently revoke our access from your Microsoft or Google account settings without involving us. Revoking stops all further access immediately — and because nothing out of the mailbox was stored, there is no mail of yours left on our side to delete afterwards.

Connected YouTube channels

Watching a YouTube channel is optional, it is off until somebody on your account connects one, and most of what it reads was written by other people — the fans who left the comments. So, as with mail above, here is exactly what happens.

What we ask for, and what we read

Nothing, and there is no consent screen — because we do not sign in as you and we hold no permission on your channel. Attaché reads the public comments on a channel you name, through YouTube’s public Data API, using a key of our own. These are the same comments any visitor to the video can read. You can name up to three channels, and they do not have to be yours.

Reading public data is the only thing that key can do. It cannot see your YouTube analytics, your private or unlisted videos, your subscriber list, your messages, or anything a signed-out visitor cannot already see.

That feature uses YouTube API Services. Using it means the YouTube Terms of Service apply to you, and Google’s Privacy Policy governs what Google does with the request we make. Because the key is ours rather than a sign-in as you, there is no Google permission of yours to revoke — the way to end it is to stop watching the channel, described at the end of this section.

What we store

For each comment we keep the commenter’s public display name and channel id, the text of the comment, which video it was on, when it was posted, its like count, and the moment we fetched it. Beside that we keep what our AI layer made of it — which kind of comment it is, and a drafted reply — and whether somebody on your account has marked it dealt with. The comment text is sent to Google Gemini to produce those two things, under the same terms described in section 8.

Thirty days, and whose rule it is

Cached comments are deleted 30 days after we fetched them, and that limit is YouTube’s rather than ours. The YouTube API Services Developer Policies allow a developer to hold public data of this kind for no longer than 30 calendar days before deleting or refreshing it. We honour it by deleting: a daily job removes the whole row — display name, channel id, comment text, our classification and the drafted reply all go at the same moment — and writes down how many it removed.

Two details make that a real limit rather than a stated one. Nothing past 30 days is shown even before the job runs: every screen and every read is bounded by the same cutoff the deletion uses, so an expired comment is unreadable from the moment it expires, not from the moment the job next wakes up. And if that job has not run for two days, the module stops reading new comments altogether rather than collecting rows it cannot promise to sweep.

Themes and counts, and what they leave behind

The point of reading comments is not to read them one at a time. Attaché groups the ones that are asking the same thing and shows the creator how many people asked it — forty questions about shipping to one country is a decision, where any one of them is an anecdote. The example sentence shown beside a count is a real comment somebody wrote, not a summary we invented, and the key used to collect a group is opaque and never displayed.

Those figures are worked out at the moment somebody opens the page, and stored nowhere. There is no table of themes and no weekly snapshot, and that is deliberate: a stored theme would be a copy of comment text with no expiry date on it, which is exactly what the 30-day rule forbids. So the counting is done on the way to the screen, out of the comments still inside the window, and nothing is written down — a comment that has expired is not in the count, and no trace of it survives in a total somewhere.

The only derived figures that outlive a comment are the two described under Turning it off below: our own count of how many reads we made each day, and the receipts recording how many rows each day’s deletion removed. Neither contains a comment, a commenter’s name, or a commenter’s channel id.

Nothing is ever posted

Attaché cannot post to YouTube, and that is a fact about the credential rather than a policy we are keeping. The reply our AI layer writes is a draft on a screen, for a person to read, change and paste into YouTube themselves. Posting a comment requires signing in as the channel owner, which we never do and never ask you for. There is no setting that turns posting on, because there is nothing to turn on.

When a commenter becomes a contact

A commenter is not a contact. They become one only when a person on your account presses the button that makes them one, one at a time — nothing in here bulk-imports an audience into your contact book. A contact made that way is your own workspace content and outlives the 30 days, because somebody deliberately created it; the cached comments behind it still expire on schedule.

What an outside assistant can reach

If you have connected an outside AI assistant (section 9), three of the tools on its fixed list reach these cached comments — the list of them, the ones left by a particular commenter, and one that writes a draft reply onto a comment for one of your own people to read and post. The first two are read-only; the third posts nothing anywhere and sends nothing. Everything in section 9 applies unchanged: what it reads leaves our platform, and from that point it is covered by that operator’s terms and not by this statement. If you would rather an assistant could not see comments, narrow its connection when you make it, or do not connect a channel.

Turning it off

You can stop watching a channel in Attaché at any time, and there is nothing to revoke anywhere else, because we never held a permission to revoke.

Unlike a mailbox, stopping does not erase what was already collected — and we would rather say that than let the paragraph above imply otherwise. The comments already cached stay until they reach their 30 days and the daily job removes them; stopping means only that no new ones arrive. Ask us if you want them gone sooner. Closing your workspace deletes them with everything else, as described in section 12.

Three things outlive the comments: the list of channels somebody chose to watch, our own count of how many reads we made each day, and the receipts recording how many rows each day’s deletion took out. None of the three contains a comment, a commenter’s name, or a commenter’s channel id.

Forms that send us your details

There are two ways a member of the public who has never heard of us can end up with their details in Attaché: a sign-up page we host, and an enquiry form on a customer’s own website that posts to us. Both are described below. In both cases the customer is the controller and we are the processor — we did not choose to collect your details and we have no use of our own for them.

A sign-up page we host

A customer can publish a sign-up page — a single page we host at an address of the form /f/…, which they put in a video description, a bio link, or a QR code on something printed. The person who fills it in is usually a member of the public who saw it under a video. They are not our customer, and they are not the same person as a commenter. So they get their own section.

Whose data it is

We host the page; the customer who published it decides what the list is for. In the language of section 2, they are the controller and we are the processor. We did not choose to collect your details and we have no use of our own for them, which also means we cannot tell you what you were signing up for — only they can. If you filled in one of these pages and want to know what is held or want it deleted, write to us and we will pass you to the customer who published the page and help them act on it.

What the page asks for

A name and an email address. That is the whole form, plus a tick box for each way the publisher is offering to contact you, and one hidden field that no person ever sees, which is there to catch automated submissions.

There is no phone number box, and that is a fact about the product rather than a careful sentence. Text messaging is not switched on in Attaché, so a phone number collected here would be a number nobody could send to, handed over by somebody who reasonably assumed a text was coming. The box appears on the day sending does, and not before.

Nothing is pre-ticked. A tick box starts empty, and whether you ticked it is recorded with your sign-up so the publisher can show what you agreed to. The page does not show you the publisher’s internal name for the list, because that name is for their own filing and not a promise to you.

What we store

The name and email address you typed, which boxes you ticked, which page and which campaign the sign-up belongs to, and when it arrived. Alongside it, as with any form posted to us, we record the IP address the submission came from and the browser string it was sent with. Those two are what let us hold a ceiling on how many submissions one address can make and recognise the same form being sent twice, and we say so here because they are two pieces of information about you that you did not type. The check only ever looks at the last ten minutes, but the address stays on the submission record after that — it is not aged off on a schedule of its own, and it goes when that record goes: on request, or when the workspace is deleted.

These pages carry no advertising, we run no analytics on them, and nothing on them is used to build a profile or to follow you anywhere else.

What happens next, and for how long

A sign-up becomes a contact in the publisher’s workspace and a member of the campaign the page belongs to. From that point it is their workspace content, it is theirs to correct or delete, and it stays until they delete it or close the account — the same rule as section 12 sets for everything else they hold.

It is not on the 30-day clock. That limit belongs to cached YouTube comments and to nothing else, because it is YouTube’s rule about YouTube’s data. Somebody who signed up on a page gave their details directly and deliberately; the two are kept under different rules on purpose, and we would rather say that than leave the shorter number looking like it covers both.

Turning it off

A publisher can retire a sign-up page at any time, and the address stops accepting submissions. Retiring a page does not erase the sign-ups it already took — those are contacts in a workspace by then, and removing them is a deletion the publisher makes, or one they ask us to make for them.

An enquiry form on a customer’s own website

A customer, or the agency that built their website, can point a contact or enquiry form on their own site at Attaché, so that what you type arrives as a lead in their workspace instead of as an email in somebody’s inbox. We did not build that page and we do not host it. We receive the submission, nothing else. We cannot see the rest of the site, we set no cookie through the form, and nothing on the page is ours.

Whose data it is. The business whose website you were on. They decide what the form asks and what they do with the answer; in the language of section 2 they are the controller and we are the processor. Sometimes there is an agency in between, and then they are a processor too and we are a sub-processor — which changes who instructs us, not what we may do. If you filled in a form on somebody’s website and want to know what is held or want it deleted, the request belongs to that business. If you do not know who they are, write to us and we will pass your request to the right customer and tell you that we have.

What we store. Whatever the form sent us — typically a name, an email address, sometimes a phone number, a company, a country and a message, plus any tick box the site offered and whether you ticked it. We keep every field the form sent, under the name the site used, including ones we do not recognise; discarding a field would be deciding on the business’s behalf that it did not matter. Alongside it, exactly as described above, we record the IP address the submission came from and the browser string it was sent with, for the submission ceiling and to recognise the same form being sent twice. Those two are never shown anywhere in the product — not to the business, not to us in normal use. They go when the record goes: on request, or when the workspace is deleted.

No file you attach is kept. If a form tries to send us a file, the fact that a file was sent is recorded and the file itself is discarded. We do not accept uploads from a page anyone on the internet can post to.

No advertising, no analytics, no profile. We run none of those on the submission, and we do not combine it with anything from anywhere else to learn more about you than the form asked.

Nothing you type is used to train an AI model. An enquiry arriving through a form is read and filed by ordinary software — it is not sent to an AI model at all. If somebody in the business later asks a question about their records, section 8 describes what happens then, and the answer about training is the same: no.

How long. A submission becomes the business’s workspace content and stays until they delete it or close the account — the same rule section 12 sets for everything else they hold. Submissions our filters marked as junk are kept too, in a separate place, because a real enquiry caught by mistake is worse than a junk one kept.

How we use information

• To provide the service — storing, organizing and showing you your own data, and running the features you use.
• To authenticate and secure accounts — signing people in, running multi-factor checks, detecting abuse, keeping the audit trail.
• To run AI features you invoke, as described in section 8.
• To bill you and to meter AI usage against your plan.
• To support you when you contact us, which sometimes means a member of our team looking at your workspace to reproduce a problem. We do that to answer a request, not on a schedule.
• To keep the platform working — diagnosing errors, capacity planning, and improving the product in aggregate.
• To meet legal obligations and to enforce our terms.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not use your workspace content to train AI models, ours or anyone else's.

Where the GDPR applies to our own controller-side processing, our legal bases are performance of a contract (running your subscription), legitimate interests (securing the platform, preventing abuse, improving the product), and legal obligation (tax and accounting records).

AI processing

All AI features in Attaché run on Google Gemini, called through a single point in our code so that every model call is recorded with its job kind, model tier and token count.

We send only the text a specific task needs — the note you asked it to summarise, the document you asked it to read, the question you typed. Your mail is not one of those tasks. An earlier version of this statement named the case where up to 8,000 characters of a message body went to Gemini for a timeline summary; that path was removed with the mail connector on 09-26-2026, and since no body is fetched at all (section 4) there is none to send.

Training. Google's paid API terms exclude the inputs and outputs of these calls from training Google's models. We do not train models on your data ourselves.

Region. These calls go to a global Google endpoint with no region selection. Google's regional-endpoint product is not in use.

Outside AI assistants

You can connect an outside AI assistant to your workspace — Claude, or any other product that speaks the Model Context Protocol — so that you can ask it about your records in its own window instead of ours. This is deliberately a separate section from section 8, because it is a different thing in the way that matters here. Section 8 is us sending a short piece of text to a model we chose, under terms we negotiated, and bringing the answer back. This is you handing a company we have no contract with a door into your workspace.

Nothing is connected until somebody on your account connects it. A new workspace has none. Turning one on means a person holding a seat signs in through the assistant and approves the connection on our own screen, the way they would approve any other application asking for access. We cannot connect one for you, and there is no assistant that arrives already switched on.

A connected assistant can never see or do more than the person who connected it. Its permissions are that person's permissions, resolved freshly on every single call rather than copied at the time of connection — so a connection made by somebody who cannot see your invoices cannot see your invoices, and a connection made by somebody whose access is later reduced is reduced with them. The consent screen shows that person the actual list of tools the connection would get, computed the same way.

What a connected assistant can read

It reads through a fixed list of twenty-four tools — who am I, search records, read one record, list deals, list invoices, list files, what is on my plate, and the rest. That list lives in our code. The assistant cannot run a query of its own against your database, cannot reach a table no tool exposes, and cannot widen the list by asking.

It cannot open a connected mailbox. No tool on that list reaches your inbox, so an assistant cannot ask for the passing digest described in section 4, with the mailbox switched on or off. What it can read is email that has already been filed onto one of your records — a message somebody forwarded in, or one Attaché filed itself because the workspace address was copied on it when it was sent. That is the record, not the mailbox: an email nobody filed is not there and cannot be fetched.

What it can change — and the desk everything waits at

On its own, nothing. An assistant can name thirty-seven actions in your workspace, and they all arrive through one door. Seventeen of them are things it can actually ask to have done. The other twenty it cannot run at all — it is told so and handed the address of the page where a person does it, which is a sentence we would rather it read than a button we would rather not build.

Each of the seventeen parks as a request on an approvals desk inside Attaché, where a person reads what was asked and either runs it or does not. A parked request expires by itself after 24 hours, and an assistant may hold at most twenty waiting at once, so a connection that starts asking for things cannot bury you in them or leave one lying around for a week.

The same desk stands in front of the two tools that touch files: adding a file to a record, and making a link that opens a file without a login. Neither happens because an assistant asked for it. A person approves the link, and the link itself stops working after 30 days.

Two writes do not wait, and we would rather name them than bury them. The first: an assistant can tell your workspace a fact to remember — the way you would tell a colleague something. That goes straight into the same agent memory your own agents use, where it is listed on a page in the app with a button to forget it — and forgetting takes it off every one of your agents at once, because one fact is taught to all of them. We record which assistant said it; the page today lists it alongside the things your own agent worked out for itself. The second: on a comment left under one of your own videos, an assistant can write a draft reply for one of your people to post — a draft is not a reply, nothing is posted or sent by writing one, and one comment holds one draft, so writing again replaces what was there. Neither write touches a record, a deal or an invoice; the first changes only what your agents know, and the second only what is sitting there waiting for a person to read.

What is refused outright

Anything carrying a credential never reaches the desk at all. The actions that hold a secret — connecting a phone number, connecting an outside account — are refused entry to the assistant interface entirely, so there is no approval screen on which somebody half-reading it could hand an outside assistant a key to one of your other services. Actions that work by asking a person a question are refused for the same reason: an assistant cannot put words in your staff's mouths.

What is written down

Every call an assistant makes is recorded, including the ones we refuse, on a page in the app you can read. The record says which tool was called and how it ended, plus — in the four cases where naming it tells a reader something — which change was asked for, what a file was called, which kind of record was opened, or which set-up instructions were read. It deliberately does not record what came back — not the records read, not the words searched for — because a log of everything an assistant was ever shown would be a second copy of your workspace sitting in a place with weaker rules around it.

A connection can also be narrowed when it is made — to sales, money, people, work, marketing, setup, your own records or your documents, rather than all of them — so an assistant brought in for one job need not be given the run of the place.

How long access lasts, and how to end it

An assistant's access key is good for one hour; the standing grant behind it for 30 days, after which the person signs in again. Disconnecting an assistant kills both at once — there is no key that outlives the grant that issued it — and anything that assistant left waiting on the approvals desk is still just a request nobody ran. An administrator ends a connection from the agent activity page in Attaché; anyone can also stop one at the assistant's end, which is the faster route if it is your own.

The part we cannot control, said plainly

Everything above is about what happens on our side of the line. Here is the other side. What a connected assistant reads leaves our platform. It goes to whoever operates that assistant, and from that moment it is covered by their privacy terms and their retention, not by this statement and not by anything we can enforce. We do not see what they do with it. If that company trains on what it is sent, or keeps it, that is a question to settle with them before you connect it — and it is worth settling, because the whole point of connecting one is that it can read your customer records.

We do not reach back the other way. An outside assistant usually has connections of its own — its own mail, its own calendar, its own files. Attaché cannot see or use any of them today; nothing in our code asks an assistant for anything. We may want to in future, because an assistant that can read the thread a deal actually lives in would be genuinely useful. If we build it, it will be something you switch on, and it will appear in the table in section 10 before it is switched on, like everything else that gets access to your data.

Who we share information with

We share data with the service providers below, and with nobody else except as described at the end of this section. This is the actual list as of the date at the top of this page — not a list of everything we might one day use.

There is one fewer company on this list than there was. Attaché used to offer a third-party sync service for mailboxes we could not reach directly; it was removed from the product on 09-26-2026, and with it the last company other than you, us and your own provider that ever touched your mail. If you are on Google Workspace or Microsoft 365 you connect your own mailbox directly. If you are on neither, Attaché works without a mailbox.

That is the whole list. No other company is set up to receive your data. Anything we add appears in this table before it is switched on.

We may also disclose information when the law requires it — a valid subpoena, court order or similar legal process — and to protect our rights or someone's safety. If we are ever compelled to hand over a customer's data, we will tell that customer unless we are legally prohibited from doing so. If Attaché is acquired or merged, customer data may transfer as part of that transaction, and you will be told before it becomes subject to a different privacy statement.

Where your data is processed

Attaché runs one set of infrastructure for every customer worldwide, located in the United States. We do not create per-region infrastructure, and we do not intend to. A self-serve product priced per seat cannot carry a separate database and storage footprint per jurisdiction; regional infrastructure is what a contracted single-tenant deployment buys, and it is priced accordingly.

Said plainly rather than buried: if you are outside the United States, you are served from infrastructure inside the United States. Personal data of people in the EU and UK is processed in the US — by the platform and by Gemini. Where we rely on a transfer instrument for that, it is the EU-US Data Privacy Framework where a provider is certified, and standard contractual clauses otherwise.

How long we keep it

Your workspace content stays until you delete it or close your account. We do not age it out on a schedule.

Cached YouTube comments are the one exception, and they are not ours to keep. They are deleted 30 days after we fetched them, whether or not the channel is still being watched, because YouTube’s developer policies set that limit. Section 5 explains it in full.

When you close your account, we delete your workspace. Your records live in a database of your own and your files are stored under your workspace's own name, so deleting everything we hold on you is one operation rather than a hunt through shared tables. It removes your records, your files, and your registration with us. We do this within 30 days of closure, and sooner on request. Ask us and we will confirm in writing when it is done.

Backups are the one honest exception. Our automated database backups still hold a copy of your data until they expire on their normal cycle, which is no longer than 30 days after the deletion. They are encrypted, they are not used to serve the product, and nothing is restored from them to bring your data back.

Two things outlive that deletion, and you should know about both. Ordinary backups roll off on their own cycle, so data can persist in a backup for a short period after it is gone from the live system; it is not restored to anyone. And we keep billing and tax records for as long as the law requires us to, independently of your workspace.

Before you close an account, export what you want to keep. Section 14 covers how.

How we protect it

• Tenant isolation. Each customer gets its own PostgreSQL schema — a separate namespace with its own copy of every table, not a shared table with a customer column on it. The schema is fixed when a database connection is opened and never changed afterward, so a connection serving one customer has never been able to address another's tables. This is the strongest control we have and the reason it is listed first.
• Passwords are stored using scrypt with a per-user random salt and compared in constant time. They are never reversible and never written to a log.
• Sessions are a signed, HTTP-only cookie marked secure in production — not a token sitting in browser storage where a script could read it.
• Multi-factor authentication is available to every user via an authenticator app. It is per user and is not currently something an administrator can force on the whole organization.
• Encryption. TLS for all traffic between your browser and us and between us and our providers. Platform-managed encryption at rest on the database and on file storage.
• Authorization and audit. Permissions are named capabilities resolved per role and adjustable per organization. Every write goes through one layer that applies the permission check and records the audit entry, so neither can be skipped by new code.
• Access by our staff is limited to the people who need it to operate and support the platform.

No system is perfectly secure, and we will not claim otherwise. If you believe you have found a vulnerability, write to support@attache.group and we will respond.

Your choices and rights

Everyone

• See and correct your own account details in the application.
• Export your workspace data in a portable format — ask us if the in-app export does not cover what you need.
• Delete individual records at any time, or close your account and have the whole workspace removed.
• Disconnect any connected mailbox, from Attaché or from your provider directly.

If the GDPR, UK GDPR, CCPA/CPRA or a similar law covers you

You have rights of access, correction, deletion, portability, restriction and objection, and the right not to be discriminated against for exercising them. Where we are the controller — your own account and billing data — exercise them by writing to us at the address in section 18. We will respond within the time the applicable law allows, normally 30 days.

Where we are the processor — the contacts and companies in someone's workspace — the customer who operates that workspace is the controller, and the request belongs to them. Contact them. If you do not know who they are, write to us and we will forward your request to the right customer and tell you that we have.

We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of on that front. We do not make decisions producing legal effects about you by automated means alone.

If you are in the EEA, the UK or Switzerland, you may also complain to your local data protection authority. We would rather you came to us first.

Cookies

This website — attache.group — sets no cookies at all. It is static HTML and CSS with no scripts, no analytics, no tag manager, no advertising pixels and no embedded third-party content. Nothing here follows you anywhere.

The application sets two cookies, both strictly necessary and neither used for tracking: a signed session cookie that keeps you signed in, and a short-lived cookie used while completing a multi-factor challenge. Both are HTTP-only. Blocking them means you cannot sign in.

Children

Attaché is a business tool sold to businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child's information has reached us, write to us and we will delete it.

Changes to this statement

We update this statement when the product changes, and the date at the top always reflects the current version. If we make a change that materially affects how we handle your data — a new category of information, a new purpose, or a new provider with access to customer data — we will tell account administrators by email before it takes effect, not after.

Contact us

Privacy questions, data requests, and security reports all go to the same place, and a person reads it.

Email: support@attache.group
Post: Attache Holdings LLC, 7 Portwalk Place, Portsmouth, NH 03801, United States

See also our Terms of Service.