Last updated: 19 October 2026
About this policy
This policy explains how Iridium handles information when you use its website, account services and connected agents. Legal and privacy contact: Jonathan Bates. Use the contact form linked below and mark your message for his attention. If you use Iridium through an organisation, that organisation may also be responsible for how it uses information in its workspace.
Information we process
We process account, authentication and assignment information needed to provide access to your authorised agents. We process the questions, task-specific context, documents and other material you choose to supply, together with available source details such as labels, authors and timestamps. When you contact us, we receive the details and message you provide. Operational records support routing, security, reliability and troubleshooting.
Connected agents and sources
The connector operates on the task and material sent to it by the host application. It does not request or reconstruct your full conversation history. Receiving an email excerpt through a host does not itself give Iridium access to your mailbox; Iridium reads an app such as Gmail only if you connect it to your agent, as described under Connected apps. Explicitly requested saves are processed as Memory or governed team updates. Personal Memory and team information follow their respective authorisation boundaries.
Connected apps (Tools)
Where Iridium has turned on Tools for your account, you can connect Gmail, Google Calendar, Google Drive and Slack (and Notion, as it becomes available for your account) to your personal agent on its Tools page and choose what the agent may do in each. When you connect an app, Iridium reads which account it belongs to so you can check it is the right one. After that, the agent reads from a connected app only when a host such as Claude or ChatGPT asks it to for your request, and what it reads is returned to that host. Apart from content you ask your agent to save, Iridium does not keep copies of what it reads from your apps. It stores each connection, its label and the access level you chose; the details of a change waiting for your approval, such as an email or Slack message you have not yet approved, which are cleared once it is approved, declined or expires after 30 minutes; and a record of each action without its content. A send, reply, post, share or calendar change runs only after you approve it in Iridium with a recent authenticator code. Email drafts and private Drive files are created or updated without asking, and nothing is sent. Agents cannot delete or cancel email, files, messages or events. Iridium connects to these apps through its service provider Composio, which holds the sign-in tokens for your connections and passes each request to the app. Google's consent screen currently names Composio, and Composio may keep records of requests and responses in its service logs under its own retention settings. Content from Gmail, Google Calendar, Google Drive, Slack or Notion is saved to Memory only when you ask your agent to save it, and then follows the Memory controls in this policy; you can remove it on your agent's Memories page. Context you ask your agent to save from a connected app can inform your organisation's shared intelligence where your agent contributes to it; the app content itself is never shared there. Results from Slack's AI search (Real-Time Search) are never kept. Slack connects through Iridium's own Slack app, which tells your workspace this. Iridium's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Iridium does not use Google, Slack or Notion data to train or improve AI models, does not use it for advertising and does not sell it. You can disconnect an app on your agent's Tools page at any time, or remove access in your Google, Slack or Notion account settings.
How information is used
We use information to provide and administer the service, authenticate users, enforce permissions, answer requests, process requested saves, respond to support enquiries and maintain security and reliability. Where data-protection law requires a lawful basis, processing must have an applicable basis, such as performing an agreement, complying with a legal obligation, a legitimate interest subject to your rights, or consent where required.
Sharing and service providers
Relevant answers and evidence are returned to the host application you use, whose own terms and privacy policy also apply. Information may be processed by providers supporting hosting, storage, authentication, AI processing and service operations. Requests to connected apps go through Composio, as described under Connected apps. Organisation information is accessible within its authorised workspace scope. Information may also be disclosed where legally required or necessary to protect rights and security. Any international processing must comply with applicable data-protection requirements.
Retention
Retention depends on the purpose and type of information, account status, user instructions, contractual requirements and applicable legal obligations. Saved information is subject to the available Memory, Knowledge and account lifecycle controls. Operational, security and audit records may need to be retained separately from saved content. Backups and records subject to legal retention requirements may remain after removal from active systems. Expiry of a connection or routing session does not by itself mean that saved content has been erased. Contact us for information about retention applicable to your account.
Your choices and rights
Use the available account controls to manage access and request exports or removal, or contact Jonathan Bates for assistance. Depending on applicable law, you may have rights to access, correct, delete, restrict or receive a copy of your information, object to processing, or withdraw consent where processing relies on it. Requests may require proportionate verification and are subject to legal exceptions. You may complain to your relevant data-protection authority; in the UK, this is the Information Commissioner’s Office at ico.org.uk.
Disconnection, closure and deletion
Disconnecting a connector does not automatically delete information previously saved in Iridium. Account closure requests and permanent erasure follow the applicable lifecycle and verification process. A submitted request or an archived agent should not be treated as confirmation of completed erasure.
Security and appropriate content
Access is limited by account and agent permissions. Do not submit payment card data, protected health information, government identifiers, passwords, API keys or other authentication secrets through the connector. Send only information you are authorised to use and that is necessary for the task. No online service can guarantee absolute security; contact us if you suspect unauthorised access.
Changes and contact
This policy may be updated to reflect changes to the service or applicable requirements. The current version will be shown on this page, with any additional notice required by law. For privacy questions or requests, contact Jonathan Bates using the form below. Do not include passwords, authentication codes or other secrets in your message.