1. Who is responsible
Elegot Inc., registered in Delaware, USA, is responsible for your data. For privacy questions and requests write to contact@legal.commands.io.
2. What we collect
Account: your email address, name if you give it, language, time zone, plan, and your role in any workspace you join.
What you set up: your commands and their settings, Business Brain details, personas, prompts, knowledge documents you upload, and approvals and drafts in your Inbox.
Runs: a record of each run, including what the steps read and produced, so you can see what happened in Activity.
Connections: the sign-in tokens, API keys and app passwords for the apps you connect, and the account names those apps return. They are encrypted with a dedicated Google Cloud KMS key before they are stored.
Payments: amount, currency, status and payment ID from Dodo Payments. We don’t receive or store your full card number.
Support: what you write to us and any files you attach.
Blog updates: if you ask for new posts by email, your address, language and when you confirmed.
Technical: IP address, browser, times, errors and usage counts (runs, AI credits), and events such as creating a command, which we use to keep the service secure, bill correctly and improve it.
Site tools: text you type into the builder or demo on our website is sent to our servers to build the steps. It isn’t linked to an account.
3. Why we use it
To provide the service: running your commands, connecting your apps, sending approvals, alerts and the morning brief.
To bill you, apply plan limits and handle refunds.
To keep the service secure and stop abuse, such as repeated free accounts.
To answer support requests.
To send blog updates, only if you confirmed you want them.
To improve the product and to meet legal duties.
4. Legal basis
Most processing is needed to provide the service you signed up for. Security and abuse prevention rely on our legitimate interest. Blog emails rely on your consent, which you can withdraw at any time.
5. Who else processes it
Google (Firebase and Google Cloud) hosts the app and stores its data in the United States. Google reCAPTCHA checks some public forms for abuse.
OpenAI processes the text a command needs in order to understand commands, run AI steps and transcribe audio. Under its API terms OpenAI does not use this data to train its models.
Composio connects many of the apps you link and holds the sign-in for those connections on our behalf.
Apify and Firecrawl read web pages when a command or a knowledge import asks for it.
Dodo Payments processes payments and billing.
Resend sends our emails, such as receipts, alerts, the morning brief and blog updates.
Telegram delivers messages when you use our Telegram bot or connect Telegram.
HubSpot may store the blog subscriber list for us, if we switch that on.
The apps you connect receive the data your commands send them, under their own terms.
We don’t sell your data to advertisers, and we don’t train AI models on it.
6. Transfers abroad
Google, OpenAI and several of the providers above process data in the United States and other countries, under their standard contractual protections.
7. How long we keep it
We keep account data while your account is open. After you close it we delete or anonymise it within a reasonable time, usually up to 90 days for logs and backups, and up to 3 years for payment records where the law requires.
Blog subscriber addresses are kept until you unsubscribe. Addresses that were never confirmed are deleted after 30 days.
8. Cookies and local storage
We only use what the site needs to work: staying signed in, remembering your language, and keeping a command you wrote on the site until you sign up.
We don’t use advertising or third-party analytics cookies. reCAPTCHA is loaded on some forms, and Google’s privacy policy applies to it.
9. Security
Connections are encrypted with a dedicated key, all traffic uses HTTPS, access to production systems is limited, and each account can only read its own data.
10. Children
Commands.io isn’t meant for anyone under 16. If a child gave us data without a parent’s consent, write to contact@legal.commands.io and we’ll delete it.
11. Your rights
You can ask to see, correct, export or delete your data, or to limit or object to how we use it. Write to contact@legal.commands.io and we’ll answer under the data protection law that applies to you, including the GDPR where it applies.
You can also complain to your local data protection authority.
Deleting your account doesn’t remove data your commands already sent to the apps you connected. Ask those companies too.