Legal
Privacy Policy
This policy explains what Broom collects, why, who else processes it, and what you can do about it. It is written to be read, not to be survived. If anything here is unclear, email youssef@broomit.net and ask.
Who we are
Broom (“we”, “us”) provides the Broom platform and the Friday assistant at broomit.net. We are based in Dubai, United Arab Emirates. For any privacy question, or to exercise any right below, contact youssef@broomit.net.
What we collect
- Account data — your email address, password (stored only as a hash, never in readable form), plan and billing status.
- Content you give Friday — your messages, uploaded files and images, project and knowledge-base material, the facts you ask Friday to remember, and anything your agents produce.
- Connected accounts — if you connect Google or Notion we store an access token and read the data you authorised. For Google we request only sign-in, your email address, Gmail and Calendar — we do not request access to your Google Drive or your documents. (Where Friday works inside a Google Doc or Sheet, it does so as its own separate Broom identity on a file you explicitly share with it, not through your account.) Tokens are encrypted at rest, and disconnecting invalidates our access immediately.
- Cookies — we set a small number of strictly necessary cookies to keep you signed in and to complete secure connection flows. We do not use advertising or tracking cookies. We also record IP addresses briefly to rate-limit abuse.
- Usage records — which model handled a request and how many tokens it used, so we can meter your plan, enforce spending caps and show you your usage.
- Operational logs — errors and security events needed to keep the service running.
We do not sell your data. We do not use your content to train our own models.
Why we can use it (legal bases)
We process your data to perform our contract with you (running the service you paid for), on the basis of your consent (for connected accounts and optional features, which you grant and can withdraw), and for our legitimate interests in keeping the service secure and working.
AI providers who process your content
Friday is built on third-party AI models, so your prompts and the content you give Friday are sent to the providers below to generate a response. We think you should know exactly who they are:
- Anthropic (United States) — the primary model behind Friday, your agents and groups.
- Fallback models — if Anthropic is unavailable, a request may instead be sent to OpenAI (US), DeepSeek (China), Z.ai / Zhipu (China), Google (US), Moonshot (China) or Alibaba Cloud (Singapore), depending on configuration, so the service does not go dark. This means content may be processed outside the UAE and outside the EEA, including in jurisdictions with different data-protection laws.
- OpenAI — also used for image generation, speech, transcription and document OCR.
- Perplexity and Firecrawl — when Friday searches or reads the web, your query is sent to them.
- Voyage AI — creates the numeric representations that let Friday search your knowledge base.
- Browserbase — when you use a cloud browser session.
- Twilio — if you use Friday to send a WhatsApp or SMS message, the message and the recipient's number are sent to Twilio to deliver it.
- Google Fonts — our pages load fonts from Google, which receives the request (including your IP address).
If you connect a tool of your own — through the connector directory, a pasted API key, or an MCP server — Friday will send the relevant part of your request to that provider too. You choose those, and they are governed by their own terms.
If you use a group chat, the other members of that group can see what you post there, and Friday's replies in that room. Friday cannot reach your private email, calendar or notes from inside a shared room.
Other processors
- Render — hosting and databases.
- Stripe — payments. Card details go to Stripe directly; we never see or store them.
- Google — outbound transactional email (for example, group invitations).
Hands On and your browser
If you install the Broom extension and grant Friday control of a tab, Friday can see that page and act in it on your behalf, and screenshots of that tab are sent to the AI provider so it can decide what to do. This only happens on tabs you explicitly share, only while you have it switched on, and you can pause or stop it at any moment. Actions that send, pay or delete stop and wait for your approval.
How long we keep it
We keep your account and content while your account is open. Delete a conversation, project or memory and it is removed. Close your account and your content is deleted immediately, except records we must keep for legal, tax or accounting reasons. Backups roll off on their own schedule. Files Friday generated for you may persist in storage after the item that referenced them is removed; email us and we will purge them.
Security
Access is over HTTPS. Passwords are hashed. Connected-account tokens are encrypted at rest. Each account's data is separated from every other account's, and outbound actions such as sending email sit behind an approval step by default. No system is perfectly secure, and we will not pretend otherwise — if a breach affects you, we will tell you.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop a particular use of it, and you can withdraw a connected-account permission at any time. Email youssef@broomit.net and we will respond within 30 days. If you are in the EEA or UK you may also complain to your local data-protection authority.
Children
Broom is not for anyone under 18, and we do not knowingly collect their data.
Changes
If we change this policy in a way that materially affects you, we will tell you by email or in the app before it takes effect. The date at the top always reflects the current version.