Privacy
What we hold, and what you can ask us to do about it.
Written in plain English on purpose. If anything here is unclear, ask us and we will answer in the same language.
Last updated 1 November 2026 / Version 2.1
01 / Who we are
The controller.
Holocron builds and operates the Holocron platform. Where this policy says we, us or Holocron, it means the Holocron company that provides your service, which is named in the agreement your organisation signs with us. If you want our registration details before that point, ask and we will send them.
For anything in this policy, or to exercise one of the rights in section 09, write to privacy@holocron.global. We are not currently required to appoint a data protection officer. If that changes, this section will name them.
02 / What this covers
Two different relationships.
This policy covers both, and they are governed by different rules, so it is worth being clear which one you are in.
You visit the site or contact us
We decide what happens to your details, so we are the controller. Sections 03 to 09 apply to you.
Your organisation uses Holocron
Your organisation decides what goes into the platform, so they are the controller and we are the processor acting on their instructions. What we may do with that content is set by the data processing agreement we sign with them, not by this policy. Section 05 describes it, and the agreement wins if the two ever disagree.
03 / What we collect
Seven things, and nothing else.
We do not buy personal data, we do not sell it, and we do not use it for advertising.
04 / Why, and on what basis
The lawful bases.
| What | Why | Basis |
|---|---|---|
| Your enquiry | To reply to you and, if it goes further, to arrange a demo | Legitimate interests, and steps before a contract |
| Server logs | To keep the site available and secure | Legitimate interests |
| Account details | To run the service your organisation bought | Contract, and our customer's instructions |
| Customer content | To do the work your organisation asked the platform to do | Our customer's instructions under the data processing agreement |
| A Google account you connect | To provide the Calendar and Drive features you turned on, and your picture if you chose your Google photo | Your consent, which you withdraw at any time by disconnecting |
| Errors in the platform | To find and fix faults and keep the service secure | Legitimate interests |
05 / Artificial intelligence
What the models do and do not get.
Holocron uses large language models supplied by third parties to do the work in the platform. This is the part of the policy most people want, so it is stated plainly.
We do not train on your content
Nothing your organisation puts into Holocron is used to train or fine tune a model, ours or a vendor's. We do not build a proprietary model out of your work.
The providers, by name
Holocron sends work to OpenAI and Anthropic through their commercial APIs, and both exclude API content from model training by default. Other suppliers handle parts of the work: Cohere ranks search results, Deepgram transcribes voice dictation, Perplexity runs web research, Langfuse holds diagnostic traces of Aria's work, Sentry holds reports of errors, PostHog holds records of how the platform is used, including clicks that did nothing, errors shown and requests that failed, and Supabase and Railway store and host the platform. Sentry and PostHog are set up not to receive customer content. If we add, remove or change a provider, this section changes with it.
Content is sent to be processed
To produce an answer, the relevant part of your content is transmitted to the model provider, processed, and returned. A model provider may hold it briefly to detect abuse, and no longer than 30 days, after which it is deleted. It keeps nothing for reuse.
A person is always accountable
Holocron drafts, proposes and files. It does not make final decisions about people, and there is no automated decision making with legal or similarly significant effects.
06 / Google Workspace
Calendar and Drive, if you connect them.
Connecting a Google account is optional, done by each person for themselves, and off until you choose it. Google holds anyone who reads this data to a particular standard, so this section sets out, for Google user data specifically, what we access, how we use it, who we share it with and how we protect it.
What Google user data we access
| What we access | Why | What happens to it |
|---|---|---|
| Your Google email address | To show you which account is connected | Held while you are connected, erased when you disconnect |
| Events on calendars you own, read only | So Aria knows what is in your week and can prepare you for it | Read fresh each time and never stored. Two days back, seven days ahead, twenty five events at most |
| Individual Drive files you pick | So Aria can read a document you hand her | Held privately to you until you disconnect. A file a club admin brings into the club's files is kept as the club's copy, like an upload |
| Your Google profile photo, if you choose it | To show it as your picture in Holocron instead of your initials | A copy is kept as your picture until you switch back to initials or disconnect, and is then erased |
We ask Google for the narrowest permissions that do these jobs. For Calendar that is read only access to events on calendars you own, so we cannot see calendars other people have shared with you, cannot change or delete anything, and cannot read your calendar settings. For Drive it is access to the individual files you pick yourself, one at a time; it does not extend to the folders around them, and everything else in your Drive is invisible to us. For your photo it is your basic Google profile, asked for only when you choose to use your photo; we keep the photo and nothing else from it.
How we use it
Only to provide the features you turned on: to show which account is connected, to let Aria take your week into account when she prepares you for meetings and answers questions about your schedule, and to let her answer from files you handed her. We do not use Google user data for advertising, we do not sell it, we do not use it to build a profile of you, and nothing we receive from Google is used to train or fine tune any model, ours or a vendor's. Error reports never carry Google user data. We test this.
The calendar itself is never stored, and a Drive file you hand Aria stays private to you, unless you are a club admin bringing it into your club's files, which makes one copy for the club. What you and Aria say about either inside a proposal is different: it is part of that proposal's conversation, kept like anything else said there, readable by colleagues who can open the proposal, and it can be summarised into your organisation's notes on that deal. If you ask Aria to act on something in your calendar, such as researching a company you are meeting, that request is handled like any other request you make.
The Limited Use commitment
Holocron's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share it with
We do not sell, rent or trade Google user data, and we do not share it with advertisers or data brokers. It is processed only by the service providers that run these features for us, under written agreements that forbid them from using it for their own purposes:
| Data | Who processes it, and for what |
|---|---|
| Your Google email address | Supabase, our database provider, which stores it while you are connected |
| Your calendar events | Anthropic, the model provider that reads them as part of the conversation to write Aria's reply. No other provider receives them |
| Drive files you pick | Supabase stores them; OpenAI turns them into search embeddings; Cohere ranks them for relevance when you ask a question; Anthropic reads them to write the reply; Langfuse holds diagnostic traces of Aria's work, in which content from a file can appear where it formed part of an answer |
| Your Google profile photo | Supabase stores the copy. Colleagues in your organisation see it as your picture, as they see your name |
Railway, which hosts our servers, carries all of the above in transit. Beyond that, we disclose information only where the law requires it, and if Holocron is ever sold or merged it may transfer with the business, as section 07 describes. You will be told.
How we protect it
Your Google access is encrypted
The tokens that let us act for you are encrypted in our application with AES-256-GCM before they are stored. The key is held only in our servers' environment, never in the database alongside them.
Encrypted in transit and at rest
Everything travels over HTTPS. Our database provider encrypts all stored data at rest with AES-256.
Your calendar is not kept, even in logs
Calendar events are read fresh when needed and never written to our database. They are removed from our diagnostic traces before those traces leave our servers, so the traces record that a calendar was present and nothing about what was in it.
Your files stay yours
A Drive file you hand Aria is private to you. Nobody else in your organisation can open it or search it, and our search only ever returns it to you. The one exception is a file a club admin chooses for the club's files while setting up the club. Holocron makes one copy for the club, everyone in the club can see it, and later changes in Drive don't reach it. What you discuss about a file inside a proposal is shared with that proposal, as set out above.
Disconnecting takes it all back
Disconnecting deletes the Drive content we hold, then hands the permission back to Google, then erases the email address and access we stored, in that order. You can also remove our access from your own Google account settings at any time; to have us delete what we hold as well, disconnect in Holocron or write to us. Copies a club admin brought into the club's files stay with the club, as an uploaded file does. Remove them from Knowledge.
07 / Who else sees it
Sub processors.
We use a small number of suppliers to run the service: cloud hosting and infrastructure, the providers named in section 05, error reporting, and email delivery. Each is bound by a written agreement, may only act on our instructions, and may not use anything for its own purposes.
The current list, naming each supplier, what it does and the country it processes in, forms part of the data processing agreement and is available from privacy@holocron.global on request.
We also disclose information where the law requires it, and to professional advisers under a duty of confidence. If Holocron is ever sold or merged, information may transfer with the business, and you will be told.
If your organisation shares a report with someone outside it, for example a sponsor, using a share link and access code, the person who opens it sees that report only. When the link is opened we record the time, the browser type and a scrambled form of the network address, so your organisation can see that the report was viewed and so we can stop people guessing codes. We keep these records for 12 months. Your organisation decides who receives a link and can revoke it at any time.
08 / Transfers, and how long we keep it
Transfers and retention.
Where information leaves the United Kingdom or the European Economic Area, we rely on the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, with a transfer risk assessment behind them.
We keep information only for as long as we need it for the purposes in section 04, and you can ask us to delete it at any time, as section 09 describes. Deleting a connected Google account's data is covered in section 06. Error reports are held in the European Union.
09 / Your rights
What you can ask for.
Under UK and EU data protection law, and under the Saudi Personal Data Protection Law, you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to us relying on legitimate interests, and ask for it in a portable form.
Write to privacy@holocron.global and we will answer within one month. If your organisation is the customer and the request concerns platform content, we will pass it to them, because it is their decision to make.
If you are not satisfied you can complain to a regulator. In the United Kingdom that is the Information Commissioner's Office. In Saudi Arabia it is the Saudi Data and Artificial Intelligence Authority. In the European Economic Area it is your national authority.
10 / Cookies
This site sets none.
holocron.global uses no cookies, no analytics and no advertising or tracking scripts. There is nothing to consent to and no banner.
Nothing on this site is loaded from anyone else's servers either. The typefaces are served from holocron.global rather than called from Google, so visiting this page sends your IP address to us and to nobody else.
The platform is different, because it has to be. Signing in sets strictly necessary cookies that keep you signed in and protect the session, and connecting a Google account sets one more, for the length of that flow only, so the request cannot be forged. Those need no consent under the law and they are the only cookies we set. The platform also keeps a few preferences in your browser's own storage, such as your theme and whether the sidebar is open. Those never reach us. A random id for your browser and session is also kept there, so that PostHog can tell one session from another.
11 / Security and changes
The rest of it.
How we protect information is set out on the security page, and in the data processing agreement we sign with each customer.
If we change this policy we will change the date at the top.
Questions go to privacy@holocron.global.