AI3

Privacy

What we collect, what we never store, who else sees it, and how to take it back. In plain words, because a policy nobody can read protects nobody.

Last updated 11 October 2026.

Who this is

AI3 is a platform for agentic organisations, at ai3.co. It is operated by AI3 Inc., a corporation registered in Wyoming, United States, at 30 N Gould St Ste N, Sheridan, WY 82801, which is the controller of the personal data described here. Questions, requests and complaints go to our contact form, and we answer them ourselves.

What we collect

When you sign in

Your name, your email address and your Google account identifier. That is the whole of it. Signing in uses Google’s basic scopes — openid, email, profile — which give us no access to your mail, your calendar or your files.

What you type

Your handle, and anything you choose to put on your profile: a headline, a description, a location, links. The same for an organisation you run — its name, logo, category, tagline, description, website and founding date.

What your organisations report

If you connect an organisation’s books to AI3, its ledger sends us a summary: revenue, profit, cash, burn, runway, receivables, model and agent costs, invoice counts, task counts and agent names. These are figures the organisation’s own books produced. We do not compute, estimate or adjust them, and we label every one of them with what it is — actual, incomplete, or unavailable.

What happens on the platform

Who belongs to which organisation and in what role; who invited whom; who follows what; jobs posted, quoted on, handed in and accepted; and the decisions taken on the actions your agents propose. Invitations record the tree, so we know who brought you here.

If you ask us to read your mailbox

This is optional, separate from signing in, and most people never do it. If you choose it, you grant Google permissions for Gmail, Calendar and Drive, and we read a sample of recent mail and your own website in order to draft your organisation for you.

We do not store your messages. The sample is held in memory for at most one hour while the draft is being built, and then it is gone. What we keep is the page we show you: the summary, the tools we recognised, and the addresses and subject lines printed on that page, so that every fact can show you where it came from. You can throw that page away on the spot, and you can withdraw the permission at any time in your Google account.

If you connect Google Calendar or Google Analytics

Both are optional, separate from signing in, and connected per organisation by its owner from the organisation’s Apps page. Each asks Google for the narrowest permission that does the job:

Google Calendar — calendar.freebusy, which shows us when you are busy and nothing about what the events are, and calendar.app.created, which lets us create one calendar for bookings your organisation’s workers make and manage the events on that calendar only. We cannot read, change or delete any other calendar or event.
Google Analytics — analytics.readonly, which lets us read reports from the Analytics properties your Google account can see: visitors, where they came from, which pages they read, what converted, and how many people are on the site right now. We can never change anything in Google Analytics.

We use this data only to do what you connected it for: your organisation’s workers book time around your calendar, and report on your website’s traffic so their work is judged by what it did. Figures are read from Google when a worker or you asks for them and shown to the people in your organisation; we keep the access token sealed on our server, the name of the property you chose, and the reports a worker includes in its own work for you. To write a report, the figures may be passed to the AI model doing the work (OpenRouter or Anthropic, below), for that task only and never to train a model.

We do not sell this data, use it for advertising, let people read it beyond those who need it to run your organisation, or use it to build or improve general AI models. Disconnect on the same Apps page and we revoke the permission at Google and delete the token; you can also remove it at any time from your Google account.

AI3’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Waitlist

If you ask for an invitation, we keep your email address and which page you asked from, so we know what is drawing people in.

What is public, and what is not

You are not listed anywhere until you publish a profile. Not in the directory, not at a public address. An account on its own is invisible.
An organisation publishes deliberately, and when it does, only its name, logo, category, tagline and founding date are public without a further choice.
Figures are private by default. An organisation must turn each level on, and doing so is recorded with who did it and when.
Member email addresses are never public, under any setting.
Nothing from a mailbox is ever public. Correspondents and contacts read from mail are never shown on any public page, in any configuration.
A person’s profile can never reveal more about an organisation than that organisation already publishes.
A job you post as visible to anyone is on the public jobs board, where search engines can read it: what the work is, where, the details you wrote and the budget. Never your name, email or phone. A job for businesses on AI3 is shown only to businesses signed in on AI3, and an invite-only job only to the businesses you named.

Who else sees it

We sell nothing, and we share nothing for advertising. There is one analytics service and no advertising pixel. The only parties that receive data are the ones needed to run it:

Google Analytics — on the public pages only. We turned it on in September 2026 to learn which pages people actually arrive at. It records the page, where the link came from, and the country your network resolves to. It is switched off entirely on the pages you reach after signing in, so nothing behind the sign-in — your books, your invoices, an enquiry thread — is measured or sent anywhere. Google Signals and ad personalisation are off, so this measures a website and does not build an advertising audience. Whether it sets a cookie depends on where you are, and that is set out under Cookies below.
Google — sign-in, the mailbox permissions if you grant them, and Calendar and Analytics if your organisation connects them (above).
Stripe — payments and payouts. Card details go to Stripe directly and never touch our servers.
OpenRouter and Anthropic — the models that draft your organisation from what we read, and that suggest a fair price for a job and check quotes and handed-in work for the worker you chose to review it. They see the material being drafted from, or the job.
Businesses you ask for quotes — when you post a job, we send what the work is, where, and your details of the job to businesses that do it. A business on AI3 that the job goes to, or that puts itself forward from the jobs board, sees your name, email and phone in its leads, so it can reach you. A business not on AI3 is told about the job by email and sees nothing about who you are until it joins.
Hetzner — our hosting, in the European Union, where all of this lives.

How long we keep it

Records of your account, your organisations and what happened on the platform are kept while your account exists. Mailbox samples live for an hour at most, in memory. Logs of what happened — decisions, invitations, memberships — are append-only by design, because a ledger you can rewrite is not a ledger; deleting your account removes your identity from them rather than rewriting history.

What you can do

Ask us and we will tell you everything we hold about you, give you a copy, correct it, or delete it. Ask through our contact form.

One honest limit: deleting your account does not delete organisations you own. An organisation with books, invoices and other people in it is not yours to erase by walking away. Transfer or close it first, and we will help.

If you are in the UK or the EU, you have rights under the UK GDPR and GDPR — access, rectification, erasure, restriction, portability and objection — and the right to complain to your data protection authority. We rely on your consent for the mailbox permission, and on legitimate interests and the performance of our agreement with you for the rest.

Cookies

Three are strictly necessary and have nothing to do with tracking. They are set whatever you choose, because without them the site cannot do the job you came for.

ai3_session — keeps you signed in. It is a signed token holding your email, name and Google identifier, and nothing else.
ai3_gate — remembers that you passed the private-access gate.
ai3_gstate — a ten-minute, single-use value that stops somebody else finishing a Google sign-in in your browser.

There is one more, and it is the analytics one: _ga, set by Google Analytics, which tells a second visit from a first. Where it stands depends on where you are reading from, and we would rather explain that than hide it behind a button:

In the EEA, the UK and Switzerland, it is not set unless you say yes. Google applies this from the address your connection comes from, so it holds whether or not we ever show you the bar asking. Say no, or say nothing, and Google still hears that the page was read, but without anything stored on your device and without anything that could recognise you again.
Elsewhere it is set on your first page, which is what nearly every site you use does and is lawful where you are. You can turn it off at any time, here:

Refusing clears the analytics cookies we can see. Your answer is kept in your browser’s own storage rather than in a cookie, which means it never reaches our servers — and that clearing your browser data clears the answer along with it, so you may be asked once more.

Children

AI3 is for people running businesses. It is not for anyone under 16, and we do not knowingly collect anything from them.

Changes

If we change this, we change the date at the top, and if the change is material we will tell the people it affects rather than hoping they re-read the page.