Legal

Privacy Policy

Last updated: 4 October 2026

This policy explains what Broom collects, why, who else processes it, and what you can do about it. It is written to be read, not to be survived. If anything here is unclear, email youssef@broomit.net and ask.

Who we are

Broom (“we”, “us”) provides the Broom platform and the Friday assistant at broomit.net. Broom is currently operated as a personal project by [FULL LEGAL NAME], an individual based in Dubai, United Arab Emirates ([ADDRESS]). That person is the data controller for the purposes of the GDPR and the UAE Personal Data Protection Law. Broom is in free beta and no company has been formed yet; this page will be updated with the company name, licence number and registered address once it is. For any privacy question, or to exercise any right below, contact youssef@broomit.net.

What we collect

Account data: your email address, password (stored only as a hash, never in readable form), plan and billing status.
Content you give Friday: your messages, uploaded files and images, project and knowledge-base material, the facts you ask Friday to remember, and anything your agents produce.
Connected accounts: if you connect Google or Notion we store an access token and read the data you authorised. For Google we request only sign-in, your email address, Gmail and Calendar. We do not request access to your Google Drive or your documents. (Where Friday works inside a Google Doc or Sheet, it does so as its own separate Broom identity on a file you explicitly share with it, not through your account.) Tokens are encrypted at rest, and disconnecting invalidates our access immediately.
Cookies: we set a small number of strictly necessary cookies to keep you signed in and to complete secure connection flows. We do not use advertising or tracking cookies. We also record IP addresses briefly to rate-limit abuse.
Usage records: which model handled a request and how many tokens it used, so we can meter your plan, enforce spending caps and show you your usage.
Operational logs: errors and security events needed to keep the service running.

We do not sell your data. We do not use your content to train our own models.

Why we can use it (legal bases)

We process your data to perform our contract with you (running the service you paid for), on the basis of your consent (for connected accounts and optional features, which you grant and can withdraw), and for our legitimate interests in keeping the service secure and working.

AI providers who process your content

Friday is built on third-party AI models, so your prompts and the content you give Friday are sent to AI providers to generate a response. We describe them here by category. The full list of processors, with each company's name, terms and the date we last read them, is part of the data processing agreement every business customer receives, and is available to anyone on request at youssef@broomit.net.

A primary model provider (United States), behind Friday, your agents and groups. It does not train on content sent through its business API.
Other model providers: Friday picks the model for each request by the quality of answer it gives for its price, and if a provider is unavailable it moves to another so the service does not go dark. Some of these providers are in the United States; some are in the People's Republic of China. This means content may be processed outside the UAE and outside the EEA, including in jurisdictions with different data-protection laws. Importantly: while we never train our own models on your content, some of these providers may use content sent to them to train or improve their own models. Content that Friday identifies as private, your email, calendar, notes and the documents you upload, is restricted by our router to approved providers only, and in normal chat is never sent to a provider that may train on it or that sits outside an approved jurisdiction. Your saved memories, the facts Friday keeps about you so it does not have to ask twice, which can include details it picked up from your conversations and from the accounts you connect, can travel with your other requests to any of these providers, unless you switch on Keep my data with US providers in Settings, under Privacy, which keeps everything you send with the approved US providers. We are still extending the private-content restriction to every background lane, so we will not claim it is absolute yet.
Media and document providers (United States): image generation, speech, transcription and document OCR, when you use those features.
Web research and reading services (United States): when Friday searches or reads the web, your query is sent to them. One of them has verified zero retention on its API.
A knowledge base indexing service (United States): creates the numeric representations that let Friday search documents you add to a knowledge base.
A cloud browser service (United States): when you use a cloud browser session.
A messaging delivery service (United States): if you use Friday to send a WhatsApp or SMS message, the message and the recipient's number are sent to it for delivery.
Font and script hosts (United States): our pages load fonts and scripts from them, and they receive the request, including your IP address, and nothing else.

If you connect a tool of your own, through the connector directory, a pasted API key, or an MCP server. Friday will send the relevant part of your request to that provider too. You choose those, and they are governed by their own terms.

If you use a group chat, the other members of that group can see what you post there, and Friday's replies in that room. Friday cannot reach your private email, calendar or notes from inside a shared room.

Google user data and the Limited Use policy

Broom's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect Google, we ask only for the scopes we need to run features you can see in Friday: your sign-in identity and email address (to know who you are), Gmail (to read, draft, send and organize the mail you ask Friday to handle, which includes marking it read, archiving and starring, so the gmail.modify scope we request matches what Friday actually does) and Calendar (to see and create the events you ask for). We do not request access to your Google Drive through your Google account: any Drive work Friday does runs through Broom's own service identity on a file you explicitly share with it, not through your personal OAuth grant. Under the Limited Use rules, that Google data is handled as follows:

We use it only to provide or improve the user-facing features described above. It is not used for anything you cannot see in the product.
We do not transfer or sell it to anyone, except the narrow cases the policy allows: to run a feature you asked for and consented to, to investigate a security problem, to comply with the law, or, with your explicit prior consent, in a merger or sale of the business.
We do not use it for advertising of any kind, including retargeting or personalised ads, and we do not use it to assess credit-worthiness or for lending.
We do not let a human read it unless you have given affirmative consent to view specific messages, events or other Google data, it is needed to investigate a security issue or abuse, the law requires it, or the data (including anything derived from it) is aggregated and used for internal operations in line with applicable privacy and other legal requirements.
We never use your Gmail or Calendar content to train our own models. Friday treats it as private content, which our router restricts to approved providers, as described under “AI providers who process your content” above, including the honest limits we note there.

Sending data outside your country

Where we send your data to the United States, those providers are covered either by the EU, US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses in their data-processing agreements with us. There is no adequacy decision for China, so any transfer to a Chinese provider relies on contractual safeguards and, as above, never carries your email, calendar, notes or documents. It can carry your saved memories, unless you switch on Keep my data with US providers in Settings, under Privacy, which keeps everything you send with the approved US providers. If you would rather your content stayed in some other region, email us, at this stage we can configure that by hand.

Other processors

A hosting provider (United States): hosting and databases.
A file storage provider (a United States company): the files you upload and the files Friday makes for you. It stores them on our behalf.
A payment processor (United States): payments. Card details go to it directly; we never see or store them.
A mail provider (United States): outbound transactional email (for example, group invitations, and the errands you send, such as a quote request you approve by tapping Send, which carry your name and your question to the person or business you chose).

Hands On and your browser

Hands On is off unless you switch it on. Today it runs in a cloud browser that you watch live inside Friday: the pages it opens, anything typed into them (by Friday or by you) and screenshots of them pass through the cloud browser service listed above, and the screenshots are sent to the AI provider so it can decide what to do. Friday does not store what you type into the live view yourself. When a task finishes cleanly, Friday keeps the steps it took, including any text it typed, in your account so it can repeat the task faster next time. On sites we classify as ordinary (we exclude the ones we identify as sensitive, such as banking or health), a copy of those steps without the text that was typed may also help other accounts do the same task. You can pause or stop it at any moment, and actions that send, pay or delete stop and wait for your approval.

The Broom extension, which will let Friday work in a tab of your own browser, is not published yet. When it is, Friday will only see and act on tabs you explicitly share, only while you have it switched on, with the same approval rule.

How long we keep it

We keep your account and content while your account is open. Delete a conversation, project or memory and it is removed. Close your account and your content is deleted immediately, except records we must keep for legal, tax or accounting reasons. Two small things stay. One is a one-way fingerprint of your email address: it is not the address and cannot be turned back into it, but it lets us recognise the same email if it signs up again, and we use it only so one email gets one free trial. The other is that day's usage cost with your name and account removed, so our daily spending limits stay accurate. Backups roll off on their own schedule. Files Friday generated for you may persist in storage after the item that referenced them is removed; email us and we will purge them.

Security

Access is over HTTPS. Passwords are hashed. Connected-account tokens are encrypted at rest. Each account's data is separated from every other account's, and outbound actions such as sending email sit behind an approval step by default. No system is perfectly secure, and we will not pretend otherwise. If a breach affects you, we will tell you.

Your rights

You can ask us to give you a copy of your data in a structured, machine-readable format you can take elsewhere, correct it, delete it, object to a particular use, or ask us to pause a use of it, and you can withdraw a connected-account permission at any time. Email youssef@broomit.net and we will respond within 30 days. If you are in the EEA or UK you may also complain to your local data-protection authority.

Automated decisions

Friday chooses which AI model answers each of your messages automatically, based on what you asked and whether the content is private. That choice affects speed, cost and which provider sees the request. It does not produce any legal or similarly significant decision about you, and no human-review right under Article 22 arises. You can ask us which provider handled a given request.

Children

Broom is not for anyone under 18, and we do not knowingly collect their data.

Changes

If we change this policy in a way that materially affects you, we will tell you by email or in the app before it takes effect. The date at the top always reflects the current version.