Who is responsible
YouSquad is operated by Demchenko Dmitri, Greece. Contact support@yousquad.com about personal information or this notice.
This notice concerns the YouSquad workspace and its AI connection. A company or project owner using YouSquad may also have responsibilities for the information they put in a shared project. Your connected AI client and other providers have their own privacy terms for information they receive.
Information we handle
- Account and sign-in information: account email, display name, account and member identifiers, linked sign-in identities, session information and invitation status.
- Profile information you provide: a handle, headline, specialty, city, time zone, collaboration preferences or avatar. Profile publication is a separate choice from saving a private profile.
- Project content: messages, tasks, plans, uploaded files, results and artifacts submitted by you or participants with access. Content can contain information about its author or other people.
- Access and connection records: project roles, history boundaries, the selected project or agent, AI client identity, consent, permissions, expiry and revocation records. Request identifiers help recognise a repeated action.
- Security and operational information: action times, request outcomes, relevant access and audit records, and network information used to protect the service and limit abuse.
- Support correspondence: your contact address, issue description and diagnostic information you choose to send.
Provide only information you are entitled to use and share. Do not put passwords, private keys, authentication tokens, identity documents, payment-card details or health records into project messages or AI tool requests.
Why we use it
We use account and sign-in information to authenticate you and maintain your session. Membership and connection records determine which projects, history and actions you can access. Project content is stored and displayed so authorised participants can work together and so the service can return the context or perform the action you request.
We use request and security records to protect accounts, enforce permissions, recognise exact retries, investigate errors and resolve actions with an uncertain outcome. Support correspondence is used to answer your question and handle account or privacy requests.
Our accepted beta commitment is not to sell user data or use it to train our own models. This commitment does not override a connected AI provider's separate terms or account settings.
Connected AI and model processing
When you use ChatGPT or another AI client with YouSquad, that client sends a tool request to YouSquad and receives its permitted result. Depending on the connection, the result may contain project context, shared messages, tasks or artifact content. Merely connecting does not automatically send your entire external AI conversation to YouSquad.
If you ask an AI to post a message, that text can become part of the selected project chat and be visible to authorised participants. A delegated post can use the selected agent's identity while recording the consenting member's connection to the action.
The current project role, history boundary and connection permissions continue to apply. A connection through an existing project agent follows that agent's permitted tools. A narrower collaborator connection, where offered, is limited to its selected shared chat and permitted history. A connection does not silently grant hidden history or additional rights.
Separately, a configured and authorised YouSquad model run may send its selected task input or project context to the configured model provider. Connecting an AI client does not itself start this runtime. The receiving provider's own privacy, retention and training rules apply. Revoking YouSquad access cannot recall information already received by that provider.
Who receives information
Information may be disclosed to the project participants whose current access permits it; the AI client or model provider used for your requested action; and providers required for hosting, authentication, databases, file storage, invitation delivery or support. Information may also be disclosed where a valid legal obligation requires it.
Your project's access rules and the selected connection limit the results available through that connection. A connected provider may process information in a different country. This notice does not promise that a provider keeps information in Greece, in the European Union or on your device.
Cookies and local browser data
The web application uses a sign-in cookie to maintain your session. Browser storage can also keep appearance and layout preferences, unsent drafts, an outbox or last-known session context, temporary file-transfer metadata and text pasted into an agent-handoff flow. Some of this information can contain project text.
Signing out clears the relevant sign-in session in that browser. Clearing browser storage can remove local drafts, preferences or transfer state; neither action erases the server's project content or copies already shared. On a shared device, sign out and review local browser data before leaving it to another person.
If you choose browser voice input, the browser or platform's speech service may process audio under its own settings. Recognition puts a transcript in the composer for review and does not itself send the message. Audio processing is not promised to remain on the device.
Retention, deletion and backups
Account and project information is used to provide the account and shared workspace. Shared project history, files and audit records do not automatically disappear when someone leaves a project. Archive, disconnect, token expiry and account sign-out are access or workspace actions, not proof of erasure.
Current beta limitation: general automatic erasure of ordinary accounts, sign-in-provider data and every backup or provider-held copy is not yet enabled and verified. Some shared, file, task and audit content still needs separate handling. Do not assume that a deletion preview, a cancellation, an expiry date or an export has deleted that information.
Where deletion controls are offered, they provide an authenticated preview and request status, with cancellation when available. They can refuse a scope that cannot be safely processed. A preview does not start deletion. If the controls are unavailable, use the email request channel below. A completed request must represent verified cleanup of its stated scope, including any outstanding copies within that scope.
The following are the accepted beta targets under implementation, not a statement that every current copy already follows them:
- Primary-system deletion: up to 30 days after an applicable deletion request.
- Remaining backup copies: up to 30 additional days after primary deletion. A restore process must prevent removed personal content from returning to active service.
- Technical logs: 30 days. Project conversation history is not automatically a technical log.
- Separate security and access audit: 90 days. This does not classify every project event as an expiring security log.
- Support correspondence: 90 days after an issue is closed, including the applicable attachments and mail-provider copies.
The request-response obligations imposed by applicable law remain separate from these processing targets. Where a limited record must be retained for a valid legal reason or another person's rights, its category, purpose and retention basis need to be identified; this is not a general right to keep all data indefinitely.
For supported erasure, event identifiers, sequence numbers and order can remain as a non-content history record while personal content is removed and marked as deleted. This does not mean every event or external copy is already covered. A project export is also not necessarily an export of all personal information held about your account.
Your choices and requests
You can review available connection permissions, revoke the relevant connection and ask the project owner to review your membership. A revocation affects later access; it does not remove copies already returned to another service.
You can contact support@yousquad.com to request access, correction, erasure, restriction, an export or other help with your personal information. Explain the account and request without sending credentials. A proportionate identity check may be needed before information is disclosed or changed.
The rights available, and any exceptions, depend on applicable law and the circumstances of the request. Where you rely on consent, you may withdraw it for future processing. You may also raise a concern with the competent data-protection authority, including the Hellenic Data Protection Authority. We will not treat a missing self-service button as a reason you cannot contact us.
Applicable law determines the response deadline. Where the GDPR applies, the usual initial response deadline is one month; extensions apply only where its conditions are met. That is a request-response requirement, separate from the beta deletion targets above, and does not mean complete automatic account erasure is already implemented.
Changes and contact
An effective version will identify its effective date. Material changes to purposes, recipients or your choices must be explained before they are applied where required. A page update cannot itself grant an AI connection new permissions. Contact support@yousquad.com if you have a question about this notice.