Privacy Policy

StableOS (“StableOS”, “we”) provides an AI revenue workspace for sales teams. StableOS is a product of Biddwell Technology Inc., doing business as Stable (stableos.ai, stable.work). The platform is currently invite‑only and used by business customers under direct agreements with us. This policy covers the StableOS application (app.stableos.ai), our API (api.stableos.ai), the StableOS Assist browser extension, and the integrations our customers choose to connect.

StableOS is a business tool. Most of the information in the platform is working data our customers bring or generate — we process it on their behalf, under their instructions.

Account and workspace data. Your name, work email address, role and seat on a workspace, and settings. Passwords are stored only as salted hashes; sign-in tokens are scoped and revocable.

Customer workspace content (processed on the customer’s behalf):

• CRM records synced from a CRM the customer connects — leads, companies and contacts, including names, titles, business emails and phone numbers, notes, statuses and activity history.
• Email sent and received through a mailbox the user explicitly connects, used to send on that user’s behalf and match replies to the right lead.
• Call audio, recordings and transcripts — from calls placed in the platform, call recordings synced from a connected CRM, or audio a user uploads — and the analysis the platform produces from them (summaries, coaching, scoring).
• Meeting recordings and transcripts, when a workspace invites the StableOS notetaker to a meeting.
• Lists and files users upload or forward in (for example CSV imports or forwarded emails), and the tasks, sequences, drafts and notes created in the platform.

Business contact data. When users search for or enrich prospects, we return professional contact data — names, titles, employers, business emails and phone numbers, and company firmographics — from licensed business-data providers and public web sources.

Browser extension. The StableOS Assist extension reads only the page the user has open (a LinkedIn profile or a company website domain) to show that user’s own workspace context and to save people they explicitly choose to save. It stores a revocable pairing token on the user’s device. It never collects LinkedIn credentials and never acts on any site on the user’s behalf.

Usage, diagnostics and billing. Service logs, feature-usage and credit-usage records, and billing events. Payments are handled by our payment processor; full card details never touch our servers.

Location. Only if a workspace uses our mobile field-capture features, and only the check-in locations those features exist to record.

• To provide and operate the platform’s features for the customer.
• To provide AI assistance — drafting, summarizing, scoring, coaching, answering questions about the workspace’s own data. AI features are powered by vetted model providers whose API terms do not permit using our customers’ content to train their models.
• To secure the service, prevent abuse, meter usage and bill.
• To support customers when they ask us to look at something.

We do not sell personal information, and we do not use customer workspace content for advertising.

Customers and their users are responsible for complying with the laws that apply to their own activity — including consent requirements for recording calls and meetings, and telemarketing / do-not-call rules for outreach — in the places they operate. The platform provides supporting controls (recording policies, consent prompts and do-not-call handling), but using them correctly is the customer’s obligation.

Where a user connects a Google account (for example a Gmail mailbox), StableOS’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to send email the user composes or approves, to match replies to leads (so automated follow-ups stop when someone replies), and to show the user their own threads with their contacts — never for advertising, and it is not read by humans except with the user’s explicit permission for support, for security, or where required by law. When the user asks, Gmail content may be processed by our AI model providers solely to provide features the user sees — sorting what needs a reply, summarizing a thread, drafting a reply for them to edit and send. Gmail data is never used to develop, improve or train generalized AI or machine-learning models. OAuth tokens are stored encrypted and can be disconnected by the user at any time.

• Subprocessors that run the service: cloud hosting and storage, AI model providers, telephony and messaging infrastructure, a payment processor, licensed business-contact-data providers, and a web-search provider — each bound to use the data only to provide their service to us.
• Integrations the customer connects: when a workspace connects a CRM, mailbox, calendar, or a notification channel (such as Slack, Discord or Google Chat), data flows to and from that service as the feature describes — under the customer’s instruction and that service’s own terms.
• Legal: if required by law, or to protect the service and its users, with notice to the customer where lawful.

Data is encrypted in transit. Integration credentials (such as OAuth tokens) are stored encrypted at rest. Access inside StableOS is role-based and scoped to the workspace; browser-extension and API tokens are individually revocable. No internet service can promise perfect security, and neither do we — but security failures are treated as incidents, not inconveniences.

Workspace content is retained while the customer’s agreement is active and for a short wind-down period afterwards, then deleted. Customers can ask us to delete specific records — or an entire workspace — at any time, and individuals can direct requests about their own data to us or to the workspace that holds it.

Depending on where you live, you may have rights to access, correct, export or delete personal information about you (for example under PIPEDA in Canada, the GDPR in Europe, or the CCPA in California). Write to us and we will honor the rights that apply — whether you are a user of the platform or a person whose business contact information appears in it.

While the platform is invite-only, we will update this policy as features change and note the new effective date here; material changes will also be announced to customers directly. Questions and requests: info@stable.work.