Privacy Policy

Effective 24 September 2026

Platform Lydian is an administrative platform that business applications run on — people, events, documents, billing and communications for each customer workspace (a "tenant"). This policy explains what personal data the platform handles, why, and how it is protected. It covers the platform and the applications built on it that are operated by us, such as the Software Consulting App.

Data we hold

• Account data — name, email address and a password hash (argon2id) for each user a workspace invites.
• Workspace records — the people, events, documents, invoices and messages a workspace creates. The workspace decides what goes in; we process it on its behalf.
• Operational data — logs and metrics needed to run and secure the service.

Google Calendar data

A workspace administrator may connect a Google account so meetings can be mirrored into the workspace. We request read-only calendar access (calendar.readonly) and use it only for that purpose:

• We read calendar events to find the ones that invite the workspace's notetaker address. Events that do not invite it are not stored.
• For the events that do, we store the title, description, start and end times, conferencing link, organizer, and attendee email addresses, and keep them updated as the calendar changes. Occurrences more than 90 days ahead are not stored until they come within that window.
• We never create, change or delete anything in your calendar.
• The OAuth refresh token is stored encrypted (AES-256-GCM) and is used only to read the calendar.

Platform Lydian's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, not used for advertising, not used to train general AI models, and not read by people except with your permission, for security reasons, or where the law requires it.

Meeting recordings, AI and email

These run only when a workspace turns them on, and use services the workspace chooses:

• Meeting capture — a notetaker bot (for example Recall.ai) joins meetings the workspace selects and returns a transcript, which is stored as a workspace document.
• AI summaries — transcripts and documents may be sent to an AI provider (for example Anthropic) to produce notes. Provider terms prohibit training on this data.
• Email — messages sent from the workspace, and email forwarded into it, pass through an email provider (for example Resend).

Where data lives and how it is protected

• Data is hosted on Amazon Web Services in the United States (us-west-2).
• Traffic is encrypted in transit (HTTPS). Every request is authenticated, and each workspace's data is isolated from every other workspace's.
• Nightly backups are kept for 35 days and then deleted.

Sharing

We do not sell personal data or share it for advertising. Data goes only to the service providers listed above, when a workspace enables them, and where the law requires it.

Your choices

• Disconnect Google Calendar at any time from the workspace's Settings, or revoke access at myaccount.google.com/permissions. Syncing stops immediately.
• Ask us to export or delete your data using the contact below. Deleted data leaves backups within 35 days.

Changes

If this policy changes, we will update the date above and, for material changes, tell workspace administrators.

Contact

Questions or requests: derekallwardt@gmail.com