Autm

Updated 15th October 2026: AI processing now takes place in the EU, and the sub-processor list has been updated.
Version 2.1

Autm Limited (“Autm”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data.

This Privacy Policy explains how we collect, use, store, protect and share personal data when you visit our website, create or use an Autm account, use the Autm operational intelligence platform, connect third-party services, communicate with us, or otherwise interact with Autm.

Autm is designed around the principles of privacy by design, data minimisation, security and responsible AI.

This policy should be read alongside our Data Retention Policy, Terms of Service and, where applicable, the Data Processing Agreement between Autm and a customer organisation.

1. Who We Are

Autm Limited is a company registered in England and Wales.

Company number: 16543162
Registered address: Little Wood House, Linley, Bishop’s Castle, Shropshire, SY9 5HP
Email: support@autm.ai

For questions about this Privacy Policy, personal data or the exercise of data protection rights, please contact us at support@autm.ai.

2. Our Role Under Data Protection Law

Autm may act as either a Data Controller or a Data Processor, depending on the circumstances.

When Autm is a Data Controller

Autm acts as a Data Controller where we determine why and how personal data is processed, including in relation to:

• account creation and administration;

• subscription and billing administration;

• website enquiries and communications;

• customer support;

• platform security, fraud prevention and monitoring;

• service performance and improvement;

• legal and regulatory compliance; and

• communications about Autm where permitted by law.

When Autm is a Data Processor

Where an organisation uses Autm to process information within its workspace, Autm generally acts as a Data Processor on behalf of that customer.

This may include information processed through:

• email and calendar systems;

• meetings and transcripts;

• documents and files;

• tasks and project-management systems;

• CRM and other business applications;

• workflows and agent actions;

• organisational memory and operational context;

• connected third-party systems; and

• AI-assisted interactions carried out on the customer’s behalf.

In these circumstances, the customer organisation remains the Data Controller and determines the purposes for which the personal data is processed.

If you are an employee, contractor, customer, supplier or other individual whose information has been processed within an Autm customer workspace, you may need to contact the relevant customer organisation directly regarding your personal data. We will assist our customers in responding to data protection requests where required.

3. Personal Data We May Process

The information processed by Autm depends on how the platform is used and which services a customer chooses to connect.

Account and contact information

This may include:

• name;

• company or organisation;

• email address;

• account identifiers;

• role and workspace membership;

• subscription information;

• communication preferences; and

• support communications.

Authentication and security information

Autm accounts are managed using ASP.NET Core Identity. Users may authenticate using an email address and password or, where available, through Google or Microsoft (Entra ID) as an external identity provider.

Users may also link a Google or Microsoft identity to an existing Autm account. Depending on the authentication methods configured for an account, an account may support password authentication, external OAuth authentication, or both.

For authentication and account security, Autm may process:

• email address and display name;

• authentication and account identifiers;

• password hashes, where email and password authentication is used;

• external login identifiers linking an Autm account to a Google or Microsoft identity;

• session and authentication records;

• login and security information;

• OAuth authentication information; and

• multi-factor authentication information, where enabled.

Passwords are not stored in plaintext. Where password authentication is used, passwords are stored and verified using one-way cryptographic hashes.

When Google or Microsoft is used to sign up for or sign in to Autm, Autm requests only the identity permissions required for authentication, such as openid, profile and email. These typically provide basic identity information such as the user's name and email address.

Signing in to Autm using Google or Microsoft does not itself give Autm access to the user's email, calendar, files or other business data.

Access to services such as Microsoft or Google email, calendars, files and other connected business systems is authorised separately through the Connections functionality within Autm. This uses a separate OAuth authorisation process and separate token storage, with the permissions required for the particular connection.

Depending on the account configuration and features enabled, Autm may also support additional authentication controls including:

• two-factor authentication (2FA);

• authenticator applications using time-based one-time passwords (TOTP);

• passkeys using WebAuthn/FIDO2; and

• recovery codes.

Autm also maintains authenticated session information to support secure access to the platform. Sessions may be revoked or expire following inactivity, expiry, sign-out or relevant security events.

Connected-system and operational data

Where authorised by a customer or user, Autm may process information from connected business systems, including:

• emails and associated metadata;

• calendars and events;

• meeting information and transcripts;

• documents and files;

• tasks, actions and commitments;

• CRM records;

• project and workflow information;

• contacts and business relationships;

• organisational knowledge;

• integration metadata; and

• other information contained within systems a customer chooses to connect;

• messages and conversations from collaboration tools such as Slack, limited to channels Autm has been added to and direct messages with Autm.

Autm only accesses connected systems within the permissions granted through the relevant integration.

AI and operational intelligence data

To provide Autm’s operational intelligence capabilities, we may process:

• user prompts and instructions;

• AI-generated responses;

• workflow and agent instructions;

• relevant operational context;

• organisational memories and knowledge;

• entities and relationships derived from authorised information;

• actions, decisions and outcomes associated with workflows; and

• audit information relating to AI-assisted activity.

Technical and usage data

We may process technical information such as:

• IP address;

• browser and device information;

• system and application logs;

• error information;

• security events;

• usage and performance information; and

• diagnostic information.

We seek to minimise personal data contained within technical logs wherever practicable.

Billing information

Payments are processed through our payment providers.

Autm does not store full payment card numbers or sensitive payment credentials. We may retain transaction information, invoices and other financial records required for accounting, contractual and legal purposes.

4. Where Personal Data Comes From

We may obtain personal data:

• directly from you;

• from your organisation;

• through systems and services that you or your organisation authorise Autm to connect to;

• from other users within an authorised customer workspace;

• through the operation of workflows and AI-assisted functionality;

• from service providers acting on our behalf; and

• automatically when you use our website or platform.

Where Autm processes personal data on behalf of a customer, the customer is responsible for ensuring that it has an appropriate lawful basis for providing or making that information available to Autm.

5. How We Use Personal Data

Depending on the context, we may process personal data to:

• provide and operate the Autm platform;

• create and administer accounts and workspaces;

• authenticate users and protect accounts;

• connect authorised third-party systems;

• retrieve, organise and contextualise authorised business information;

• provide organisational memory and operational intelligence;

• execute authorised workflows and actions;

• provide AI-assisted functionality;

• maintain permissions, governance and audit trails;

• provide customer support;

• manage subscriptions and billing;

• monitor platform security and reliability;

• diagnose technical problems;

• prevent fraud, misuse and unauthorised access;

• improve the reliability, security and performance of the service;

• comply with legal and regulatory obligations; and

• communicate with customers and users about the service.

We do not sell customer personal data.

We do not use customer data to train AI models, and we do not permit our AI providers to.

6. Lawful Bases for Processing

Where Autm acts as a Data Controller, we rely on one or more lawful bases under applicable data protection law.

These may include:

Contract

Where processing is necessary to provide Autm services to you or take steps at your request before entering into a contract.

Legitimate interests

Where processing is necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and freedoms.

These interests may include:

• securing and protecting the platform;

• preventing fraud and misuse;

• maintaining and improving service reliability and performance;

• supporting customers and users;

• managing our business; and

• understanding how our services are used.

Legal obligation

Where processing is necessary for us to comply with legal, regulatory, tax, accounting or other obligations.

Consent

Where consent is the appropriate lawful basis, including for certain optional communications or features. Where we rely on consent, it may be withdrawn at any time.

Where special category personal data is processed, an appropriate condition under applicable data protection law must also apply.

Where Autm acts as a Data Processor, the customer organisation is responsible for determining the lawful basis for the underlying processing. Autm processes the information in accordance with the customer’s documented instructions and applicable contractual arrangements.

7. AI Processing, Agents and Personal Information

Autm uses artificial intelligence and large language models to provide operational intelligence and AI-assisted functionality.

Depending on the feature being used, relevant information may be processed by AI model providers for purposes such as inference, reasoning, classification, summarisation and generation.

Autm applies data-minimisation and privacy controls designed to reduce unnecessary exposure of personal information during AI processing.

Where appropriate and technically feasible:

• only information required for the relevant task is passed for AI processing;

• personal identifiers may be redacted, tokenised or pseudonymised before information is transmitted to an external AI provider;

• mappings between protected identifiers and operational data are secured separately;

• access is controlled according to user and workspace permissions; and

• AI-assisted actions may be subject to governance, confirmation and audit controls.

Autm does not use customer data to train AI models, and does not permit its AI providers to.

Autm runs its AI models in its own Microsoft Azure subscription, using Microsoft Foundry, in Azure’s EU Data Zone (Sweden Central). Microsoft may temporarily retain prompts and responses for abuse monitoring, in accordance with its terms.

AI systems can produce inaccurate or incomplete outputs. Autm is designed to support human decision-making and operational activity, not to remove appropriate human judgement or accountability.

Where AI functionality could be used by a customer to make decisions about individuals, the customer remains responsible for ensuring its use is lawful, fair and appropriate, including complying with applicable requirements relating to automated decision-making or profiling.

8. Security

Autm applies technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

These measures include, where applicable:

• encryption of data in transit using TLS;

• encryption of data at rest;

• secure cryptographic key and credential management;

• role-based and permission-based access controls;

• two-factor authentication (2FA);

• OAuth-based sign-up and sign-in;

• OAuth-based authorisation for supported third-party integrations;

• secure storage and handling of authentication and integration tokens;

• monitoring and audit logging;

• data minimisation and PII redaction, tokenisation or pseudonymisation controls;

• restricted access to personal data on a need-to-know basis; and

• secure development and operational practices.

No system can guarantee absolute security. We regularly review our security measures and evolve them as the platform, technology and risk environment develop.

9. Authentication and Third-Party Integrations

Autm uses OAuth for two distinct purposes: user authentication and authorising connections to third-party business systems.

Signing up for and signing in to Autm

Autm accounts are managed using ASP.NET Core Identity.

Users may authenticate directly using an email address and password or use Google or Microsoft (Entra ID) as an external identity provider. Users may also link Google or Microsoft authentication to an existing Autm account.

When Google or Microsoft is used for authentication, Autm requests only identity scopes required to establish and authenticate the user, such as openid, profile and email.

This authentication process does not itself authorise Autm to access services such as Gmail, Google Drive, Google Calendar, Outlook, Microsoft Calendar, OneDrive or other business information held within the user's Google or Microsoft account.

Connecting business systems to Autm

Connecting a business system to Autm is a separate authorisation process.

When an authorised user chooses to connect a supported third-party service, Autm requests the permissions or OAuth scopes required to provide the selected integration functionality.

The information and functionality Autm can access through an integration are determined by:

• the permissions or scopes expressly authorised during the connection process;

• the capabilities of the third-party service;

• the integration configuration; and

• applicable user and workspace permissions within Autm.

Autm does not require users to provide their Google, Microsoft or other third-party account passwords in order to establish an OAuth connection.

Authentication tokens and integration tokens are handled separately and protected using appropriate credential management, encryption and access controls.

Users and authorised customer administrators may revoke or disconnect integrations in accordance with the functionality available within Autm and the relevant third-party service.

Third-party identity providers and connected services process personal data under their own applicable privacy policies and terms.

Connecting Slack

When an authorised user connects Slack, Autm is added to the Slack workspace as an app. Autm accesses Slack only within the permissions granted through Slack’s OAuth consent screen, and you can revoke access at any time.

What we collect. Messages posted in channels Autm has been added to, from the point it joins (Autm does not read earlier history), thread replies in those channels, direct messages with Autm, and basic profile and channel information such as display names and channel names.

How we use it. To answer requests, to carry out actions that users authorise, and to identify deadlines, commitments and other information relevant to running the customer’s business. Autm does not keep copies or backups of Slack messages. It saves a summary of the relevant information, with a link to the original message in Slack, to the customer’s Autm memory. Information learned from a private channel is visible only to the members of that channel.

How long we keep it. For as long as the customer’s Autm account is active. Disconnecting Slack stops Autm collecting new Slack data immediately, but does not by itself delete information already saved. That information is deleted within 30 days of confirmed account or workspace deletion, as set out in our Data Retention Policy.

Your choices. To request access to, transfer of or deletion of data, email support@autm.ai. We do not sell Slack data or use it for advertising.

10. Service Providers and Sub-Processors

We use carefully selected third parties to help provide and secure the Autm service.

These may include providers of:

• cloud infrastructure and hosting;

• AI model inference;

• payment processing;

• monitoring and security;

• communications; and

• other technical services necessary to operate the platform.

Our principal service providers currently include Microsoft Azure for cloud infrastructure and, through Microsoft Foundry, AI model inference; Stripe for payment processing; Postmark for service email delivery. Our current list is published at autm.ai/sub-processors.

Where a provider processes personal data on our behalf, we require appropriate contractual and data protection safeguards.

Where Autm acts as a Data Processor for a customer, relevant providers may act as sub-processors.

We maintain information about our current sub-processors and can provide further information on request.

11. Data Hosting and International Transfers

Autm’s primary customer data infrastructure and data residency are hosted within Microsoft Azure in the United Kingdom. AI model processing takes place within the European Union, in Azure’s EU Data Zone (Sweden Central).

Some other service providers, such as our payment and email delivery providers, may process limited information outside the United Kingdom or European Economic Area where necessary to provide their services.

Where personal data is subject to an international transfer, Autm uses appropriate safeguards as required by applicable data protection law.

Depending on the circumstances, these may include:

• UK adequacy regulations or recognised adequacy arrangements;

• Standard Contractual Clauses;

• the UK International Data Transfer Addendum or other approved transfer mechanisms; and

• additional technical safeguards such as encryption, data minimisation, redaction, tokenisation or pseudonymisation.

Further information about applicable safeguards may be requested by contacting support@autm.ai.

12. Data Retention and Deletion

We retain personal data only for as long as necessary for the purpose for which it is processed, to provide our services, to comply with legal obligations, and to protect legitimate business and security interests.

Different categories of information have different retention periods.

Customer workspace data is retained in accordance with the customer’s use of the service and applicable contractual arrangements.

When an account or workspace is deleted, relevant data is removed in accordance with our deletion procedures, subject to legal, security, backup and other legitimate retention requirements.

More detailed information about retention periods, long-term memory, AI interaction data and deletion procedures is set out in our Data Retention Policy.

13. Data Ownership

Customer organisations retain ownership of the Customer Data they provide to or make available through Autm.

Using Autm does not transfer ownership of a customer’s underlying data to Autm.

Autm’s rights to process Customer Data are limited to those necessary to provide, secure and support the service, comply with applicable law and perform other processing permitted by the relevant agreement.

Connected source systems remain independent of Autm. Disconnecting or ceasing to use Autm does not transfer ownership of, or remove information from, those underlying systems unless an authorised Autm action has expressly modified information within that system.

14. Your Data Protection Rights

Depending on the circumstances and applicable law, individuals may have rights including:

• the right to be informed about the use of their personal data;

• the right to access personal data;

• the right to correct inaccurate or incomplete personal data;

• the right to request erasure;

• the right to restrict processing;

• the right to object to certain processing;

• the right to data portability where applicable;

• rights relating to certain automated decision-making and profiling; and

• the right to withdraw consent where processing is based on consent.

These rights are not absolute and may depend on the circumstances and lawful basis for processing.

Where Autm is the Data Controller, requests can be made to support@autm.ai.

Where Autm processes personal data solely on behalf of a customer organisation, requests should normally be directed to that organisation as Data Controller. We will provide reasonable assistance to customers in fulfilling valid data subject requests where required.

You have the right to object to processing based on legitimate interests in circumstances provided by data protection law.

15. Marketing Communications

Where permitted by law, we may contact customers, prospective customers or users about Autm products, services, events or relevant updates.

Where consent is required, we will obtain it before sending such communications.

You can opt out of marketing communications at any time by using the unsubscribe mechanism provided or contacting us.

Service, security, billing and other essential account communications are not marketing communications and may still be sent where necessary.

16. Cookies and Website Technologies

Our website may use cookies and similar technologies to operate the website, understand its use, maintain security and, where permitted, support analytics or marketing.

Where required by law, non-essential cookies will only be used with appropriate consent.

Further information about the cookies and technologies used on our website should be provided through our cookie notice or consent mechanism.

17. Children’s Privacy

Autm is a business platform and is not designed or intended for use by children.

We do not knowingly offer the Autm platform directly to children.

If we become aware that personal data relating to a child has been collected or processed in circumstances inconsistent with applicable law or customer instructions, we will take appropriate steps.

18. Changes of Ownership or Corporate Structure

If Autm is involved in a merger, acquisition, investment, restructuring, sale of assets or other change of control, personal data may be disclosed to relevant professional advisers and prospective or actual parties to the transaction where necessary and subject to appropriate confidentiality and data protection safeguards.

Any successor organisation would remain subject to applicable data protection law and relevant contractual obligations in relation to personal data transferred as part of the transaction.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Autm platform, our processing activities, legal requirements, technology or security practices.

The latest version will be published on our website with an updated revision date.

Where a change materially affects how we process personal data, we will provide appropriate notice where required.

20. Complaints

If you have a concern about how Autm handles your personal data, please contact us first at support@autm.ai so that we can investigate.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

For individuals in the European Economic Area, you may also have the right to contact the relevant supervisory authority in your country.

21. Contact Us

For privacy enquiries, data protection requests or questions about this policy, please contact:

Autm Limited
Little Wood House
Linley
Bishop’s Castle
Shropshire
SY9 5HP
United Kingdom

Email: support@autm.ai

For more detailed information about data retention and deletion, please see our Data Retention Policy.