Privacy policy
This policy says what total does with your data, in plain words. It is written for the person who connects their own accounts to total, and it is the policy linked from the consent screens of Google and Microsoft.
Who we are
The data controller is Heartless Precision (Heartless Precision is a trading name of HPS Data Analytics Ltd, registered in England and Wales; Company number: 10378037; Registered office: 47 Alexandra Road, Croydon, England, CR0 6EY). Write to privacy@heartless-precision.com for anything about your data.
What this policy covers
total is a personal voice assistant. You call it or open the app, you talk, and it reads your own calendar, mail, messages and files on your behalf to answer you. This policy covers what total reads, where it is processed, what is kept, and your rights. The website itself collects nothing: see Cookies.
What total accesses on your behalf
Only the accounts you connect, and only the kind of data you agree to on each consent screen:
- Google: Google Calendar (your events), Gmail (your mail), Google Drive (your documents).
- Microsoft: Outlook mail, through Microsoft Graph; the Outlook calendar and OneDrive when those connectors ship.
- Telegram: the messages and channels of your own Telegram account.
- Your own files: the files you give total yourself.
total reads these only when you ask it something, or at the times you set, such as a morning briefing, and only to answer you. It does not build a profile or act for anyone but you. Where it writes, such as sending a mail or adding a calendar event, it does so because you asked for that exact thing on the call, and it tells you what it did.
Why we may process your data
We process your data because you ask us to: the service you use is the contract, and the access to each account is your consent on that account's consent screen, which you can withdraw at any time by disconnecting the account. We keep operational logs to run the service safely, which is our legitimate interest, and we keep them short, as the next sections say.
Where your data is processed
Today total runs on infrastructure the person controls, and the only installation is the founder's own: a server he runs, for his own accounts. Nobody else's data is processed on it, and nothing of your data passes through Heartless Precision, because we hold no server for it. That installation keeps the audio of each call for 14 days (the founder calling his own server; no one else is on the line) and logs of every request, every answer and every read of a connected account in full, with no automatic deletion.
In the hosted product, which is being built, each person gets their own isolated runtime and their own storage. Your tokens, your logs and your files live in that runtime and nowhere else. Deleting your account deletes the runtime.
What is stored and for how long
In the hosted product:
- Access tokens for the accounts you connect: stored encrypted, kept until you disconnect the account or delete your account, then deleted.
- What you asked and what was answered: kept for 30 days, looked into only when you ask us to or for security, then deleted.
- Your own files: kept until you remove them or delete your account.
- Call audio: not recorded. The text of what you said is handled like any other request.
- Calendar events, mail, messages and documents read while answering you: used for that answer and not copied into a store of ours.
On a self-hosted install the person decides; today's install, the founder's own, keeps the call audio for 14 days and the logs in full, as the previous section says.
What we never do
- We never sell your data.
- We never use your data for advertising, ours or anyone else's.
- No human at Heartless Precision reads your mail, your messages or your documents, except when you ask us to look into something, for security, or where the law requires it.
- We never transfer your data to anyone except the processors named below, who act only on our instructions.
- We never use your data to train a model.
Who else processes your data
To answer you, total sends the part of your data that the question needs to providers of five kinds: large language models (which read your request and the data and write the answer), speech recognition (which turns your voice into text), speech synthesis (which turns the answer into a voice), a cloud hosting provider (which runs your runtime and holds its storage) and the telephony and media providers (which carry the call between your phone and the runtime). Each of them processes the data on our instructions, to answer your request and for nothing else, and we hold a data processing agreement with each. Some of them process data outside the United Kingdom; where they do, the transfer is covered by the UK's International Data Transfer Agreement or by an adequacy regulation.
Google user data
total's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
In particular: Google user data is used only to provide and improve the features of total that you see, it is never transferred to others except as needed to provide those features, to comply with the law or as part of a merger or acquisition with notice to you, it is never used for advertising, and no human reads it except with your consent for a specific message, for security purposes or to comply with the law.
Microsoft user data
Access to your Outlook mail (and, when those connectors ship, the Outlook calendar and OneDrive) goes through Microsoft Graph with the permissions shown on Microsoft's consent screen. The same rules apply: read only to answer you, nothing kept beyond the 30 days of logs in the hosted product, nothing sold, nothing used for advertising, no human reading beyond the cases above.
Your rights
Under UK GDPR you can ask us at any time for:
- access: a copy of the data we hold about you;
- correction: a fix to anything wrong;
- deletion: your account and everything in its runtime, erased;
- restriction and objection: a stop to a particular use;
- portability: your data in a usable form.
Write to privacy@heartless-precision.com. We answer within one month, as the law requires. You can also complain to the Information Commissioner's Office at https://ico.org.uk, and you can revoke total's access to an account from that account's own settings (Google: your account's third-party access page; Microsoft: your account's app permissions page) at any time.
Cookies
None. This website sets no cookies, runs no analytics and loads nothing from third parties. The site is served by Firebase Hosting, a Google service, which handles your request to deliver the page; our other domains, which redirect here, are answered by Cloudflare; we keep no visitor log.
Changes
When this policy changes, the version and the date at the top change with it, and the previous version stays available on request.
Contact
privacy@heartless-precision.com for anything about your data; support@heartless-precision.com for help with total; info@heartless-precision.com for anything else.