Inlay Privacy Policy

Effective date: 5 November 2026

Inlay is an AI assistant that software companies build into their own products. This policy says what information Inlay collects, what it does with it, who else sees it, how long it is kept, and what you can ask us to do with it.

"Inlay", "we" and "us" mean Lee Davis, an individual doing business as Inlay, who operates Inlay. "You" means a person who uses the assistant.

1. How Inlay reaches you

You usually meet Inlay inside another company's product, such as an app you already use for your business. We call that company the vendor.

• The vendor signs you in. Inlay does not have its own passwords for you.
• The vendor decides what the assistant can do in its product and which of its data the assistant can read.
• For information that reaches Inlay through a vendor's product, Inlay processes it for that vendor, and the vendor's own privacy policy also applies.
• When you connect another service to Inlay yourself, such as QuickBooks Online, Inlay is responsible for the information that connection gives it.

This policy covers Inlay as we provide it. Where a vendor provides Inlay to you under its own agreement with us, that vendor's terms and privacy policy apply instead.

2. What we collect

1. Who you are. What the vendor passes us when you open the assistant: its id for you, your name, and the id of the business you belong to in the vendor's product. When you connect another service, we may receive the email address of the account you connect.
2. Your conversations. Your messages, the assistant's replies, files you upload, and the files, charts and spreadsheets the assistant makes.
3. Data the assistant reads for you. When you ask a question, the assistant reads the data it needs from the vendor's product and from services you have connected, as you and with your permissions. These results become part of the conversation.
4. Web searches and pages. The search queries the assistant writes, and the web pages it opens for you.
5. Settings you create. Scheduled tasks, saved skills, and the services you have connected.
6. Sign-in credentials for connected services. The tokens or keys that let Inlay call a service you connected. They are encrypted.
7. Records of activity. A record of each action the assistant takes, usage counts used to measure credits, and technical logs. Technical logs hold identifiers, sizes and timings, not the content of your conversations.
8. Cookies. Inlay uses only the cookies it needs to keep you signed in and to complete the sign-in to a service you connect. It uses no advertising cookies, analytics trackers or session recording.

3. QuickBooks Online

When you connect a QuickBooks Online company to Inlay, you sign in with Intuit and choose to give Inlay access.

• What we access: the QuickBooks data the assistant needs to answer you, for the company you connect: company information, the chart of accounts, customers, vendors, items, invoices, bills, payments, purchases, and financial reports.
• What we do with it: only answer your questions and run the tasks you ask for, such as an analysis, a chart or a scheduled report.
• What we never do: sell it, use it for advertising, share it with other users or vendors, or use it to train AI models.
• Changes in QuickBooks: Inlay only reads your QuickBooks data and never changes it.
• Disconnecting: you can disconnect Inlay in the assistant or in your QuickBooks account. When you do, we delete the stored QuickBooks credentials, and Inlay can no longer read your QuickBooks data.
• Data already in conversations: QuickBooks data that already appears in a conversation stays there until the conversation is deleted. You can ask us to delete it (section 7).

4. How we use information

• To run the assistant: answer your messages, run analyses, make files and charts, and run your scheduled tasks.
• To keep Inlay secure: prevent abuse, investigate problems, and keep each vendor's and user's data apart.
• To show the vendor how the assistant is used, and to apply usage limits the vendor sets.
• To support you and the vendor, and to meet legal obligations.

We do not sell personal information, use it for advertising, or use your conversations or connected data to train AI models.

5. Who else sees it

• The vendor. The vendor's staff can read conversations held in its product, and see usage per user and per business, so they can support you and improve the assistant.
• Service providers. Inlay runs on Amazon Web Services in the United States. Your messages and the data the assistant reads are sent to Anthropic, whose Claude models write the replies. Anthropic's commercial terms do not allow it to train models on that data. Web searches go through Anthropic's search provider. These companies are Amazon Web Services, Inc. and Anthropic, PBC. We will update this list before we add another.
• Services you connect. When the assistant uses a service you connected, it sends that service the request needed to answer you.
• Websites. When the assistant opens a web page for you, that website sees a request from Inlay's servers, not from your device.
• Legal and safety reasons. We disclose information when the law requires it, or to protect people or Inlay from harm.
• A change of ownership. If Inlay is sold or merged, information may pass to the new owner, under this policy.

6. How long we keep it

• Conversations are kept until you or the vendor delete them, or the vendor's account ends.
• Copies of data the assistant fetched for a conversation, such as downloaded files, are deleted after 24 hours.
• Credentials for connected services are deleted when you disconnect, when the service refuses them, or after 90 days without being renewed.
• Records of assistant actions stay after a conversation is deleted so we can investigate security problems. Their content is removed.
• Usage counts are kept for the vendor's records.

7. Your choices and rights

• You can delete a conversation in the assistant.
• You can disconnect any service you connected.
• You can ask us for a copy of your information, to correct it, or to delete it, by writing to hello@inlay.chat. When the information belongs to a vendor's product, we may pass your request to that vendor, and we act on its instructions.
• Depending on where you live, you may have more rights under local law. We will not treat you differently for using them.

8. Security

• Inlay keeps each vendor's data apart from every other vendor's, and each user's own conversations, connections and settings apart from other users'.
• Data is encrypted in transit, and stored credentials are encrypted at rest.
• Code the assistant runs works in an isolated sandbox with no internet access.
• Every action the assistant takes with your data is recorded.

No system is perfectly secure. If we learn of a breach that affects your information, we will tell the vendor and, where the law requires, you.

9. Where data is stored

Inlay stores and processes data in the United States.

10. Children

Inlay is a business tool and is not meant for anyone under 16. We do not knowingly collect information from children.

11. Changes

We will post changes to this policy here and update the effective date. If a change is significant, we will tell vendors before it takes effect.

12. Contact

Lee Davis, doing business as Inlay. Email hello@inlay.chat.