01
Collect with purpose.
Our design principle is to use only the information needed for the task. More context should make your work better, not become a reason to collect everything.
PRIVACY / UNDERLEAUTRUST IS PART OF THE WORK
Your context.
Handled with care.
Documents carry more than information. They carry your work, your relationships, and your judgment. A workspace built around that context must take privacy seriously.
Read our approachPRIVACY OVERVIEWUPDATED /
Your work isn't
and will NEVER be
used as dog food for
training AI models.
User data is never used for model training. That is our policy for Underleau, and a requirement for the providers and configurations we choose for the AI workspace.
01 / OUR APPROACHLess ambiguity.
Less ambiguity.
More accountability.
02
Make processing visible.
You should know when information leaves your device, why it is needed, and which services receive it. AI should not be a black box for your data.
03
Build for your control.
Source selection, permissions, and clear ways to manage your information belong in the product. Privacy is part of the workflow, not an afterthought.
What happens when you visit.
Browsing
Delivering a webpage involves sending connection information, such as your IP address and browser request, to the server hosting it. The current website code does not include an analytics SDK or advertising pixels. This is not a claim that hosting infrastructure keeps no logs.
Contact & demo requests
The demo form prepares an email draft in your browser. It does not submit your answers to a form backend. You choose whether to open your email app and send it. If you email us, the information you send is handled through email so we can respond. Please do not include confidential documents in a demo request.
External media & links
Some blog posts include externally hosted images or video players. Loading them can send connection information to their providers, which have their own privacy practices. Following a link to another site also takes you outside this website.
Visible sources.
Clear data boundaries.
The current canvas prototype creates file cards in browser memory and reads short previews of supported text files. Its synthesis is a mock, not a call to an AI provider. It does not yet upload files to a server or persist a workspace.
The planned product is different: cloud storage, document extraction, and AI inference may involve sending your content to service providers. We will not describe that as a local-only experience.
Our planned infrastructure includes Cloudflare, Supabase, Vercel, and OpenRouter. This is a planned stack, not a finalized list of services currently processing workspace data. Their specific roles, processing locations, and retention terms will be documented before launch.
BEFORE THE AI SERVICE LAUNCHES
- Explain which data is processed, for what purpose, and by which providers.
- Publish retention and deletion rules, including any backup limitations.
- Verify that provider contracts, model routes, and settings uphold our no-training policy.
- Explain permissions for future integrations such as Gmail, Notion, and Linear before connecting them.
These are requirements for the product we are building, not claims that those controls already exist. We do not claim end-to-end encryption or compliance certifications that have not been verified.
Questions are welcome.
So are requests.
Depending on the law that applies and the circumstances, you may have rights to access, correct, delete, or receive a copy of your personal data; restrict or object to processing; and withdraw consent where processing relies on it. You may also complain to a relevant data protection authority.
Email us to ask about your information or exercise an applicable right. We may need enough information to verify your identity and understand the request. Please start with a description, not a copy of an identity document.
Read about EU data rightsA few important distinctions.
Does everything stay on my device?
The current canvas prototype works in browser memory. The planned AI workspace is not a local-only product. A production notice must explain any server-side storage and third-party processing before you use those features.
Are app integrations connected today?
No. Integrations shown on the website illustrate our roadmap. Connecting an account, requesting permissions, and importing its content are not available in the current prototype.
Will my documents train an AI model?
No. Our policy is that user data is never used for model training. Before enabling real AI processing, we need to verify that each provider and model route meets that requirement. Processing a document to answer your question is different from using it to train a model.
05 / KEEP THE CONVERSATION OPENPrivacy deserves
privacy@underleau.comPrivacy deserves
a straight answer.
Ask a question, flag a concern, or make a data request.