Privacy Policy

Effective November 2, 2026

PMC Assistant is an AI assistant that works in a small business's own email, spreadsheets, files and web apps. Patrick McElroy Consulting LLC ("PMC", "we") runs it for its client businesses. This policy explains what it accesses, how that information is used, where it goes and how long it stays. Your organization decides what gets connected. If it has a signed agreement with PMC, that agreement applies too.

What we collect

• Your sign-in. When you sign in with Google or Microsoft, we receive your name, email address and account ID. Signing in doesn't give us access to your email or files.
• What your organization connects. Mail, calendars, spreadsheets and documents, only after someone at your organization connects that service. The sections below list each permission.
• What you give the assistant. Files you upload, notes about your documents, your instructions, and what the assistant produces from them.
• Keys. API keys an admin at your organization pastes in to connect another app.
• Activity records. Sign-ins, approvals, rejections and changes to connections or people, with who did it and when.
• Cookies. Only what's needed to keep you signed in and protect the sign-in. We use no advertising or analytics cookies. Our pages load fonts from Google Fonts, so your browser's IP address reaches Google when you open them.

Google user data

PMC Assistant asks for each Google permission only when someone at your organization connects that service:

• Sign-in (openid, email, profile): your name, email address and account ID, to know who you are.
• Google Sheets (spreadsheets): reads and changes spreadsheets the connected account can open, so the assistant can look things up and, after a person approves, update them.
• Gmail (gmail.readonly, gmail.compose): reads messages and attachments in the connected mailbox and saves draft replies. Google's compose permission would also allow sending, but our software has no way to send from your mailbox. A person reviews and sends every draft.
• Google Drive (drive.readonly): opens Docs, Slides and other Drive files your staff link in PMC Assistant, read-only.
• Saving to Google Drive (drive.file): creates folders in the connected account's Drive and saves files into them. This permission reaches only the folders and files PMC Assistant made, not the rest of your Drive. A person approves each save, unless an admin has chosen otherwise for a particular agent.
• Google Calendar (calendar.events, calendar.calendarlist.readonly): reads the connected account's calendars and events and, after a person approves, adds, changes or deletes events. When an event has guests, Google emails them about it, and the person approving sees who.

How we use it. Only to do the work your organization asks the assistant to do, and to show your staff the results.

How we store it. Google's access tokens are stored encrypted. Linked documents are read from where they live each time they're needed. What the assistant reads during its work can stay in the records listed under "How long we keep it" below.

Who it's shared with. Content the assistant works on is sent to Anthropic, whose Claude models do the work, and is stored on Railway, our hosting provider. We don't share it with anyone else except as described under "Who we share information with".

What we don't do. We don't sell Google user data, use it for advertising, or use it to train AI models. People at PMC don't read it unless you've asked us for help with it, it's needed for security, or the law requires it. People at your own organization can see what's on its pages, according to their role.

PMC Assistant's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

To remove access, use Disconnect on the Connections page, then remove the app at myaccount.google.com/permissions.

Microsoft 365 data

The same uses and limits apply to data from Microsoft. PMC Assistant asks for User.Read and Mail.ReadWrite to read mail and save drafts, Mail.ReadWrite.Shared if your organization lists shared inboxes, Files.Read.All to read OneDrive or SharePoint files your staff link, and Calendars.ReadWrite, if your organization allows the calendar, to read calendars and, after a person approves, add, change or delete events. We don't ask for permission to send mail. When an event has attendees, Microsoft emails them about it from the connected account, and the person approving sees who. To remove access, use Disconnect on the Connections page, then remove the app in Microsoft's My Apps.

Websites and other apps

• Assistant computer. Each client has its own separate browser for the assistant. When your staff sign it in to a website, they type the password themselves on that site's own page, and we don't see it. The sign-in session stays on that computer until someone signs it out. What the assistant sees on a page is sent to Anthropic so it can do the work.
• API connections. Keys an admin pastes in are stored encrypted, kept from the AI model, and sent only to the addresses that admin was shown.
• Web search. The assistant may search the web for public facts. The search query goes through Anthropic's search service.
• Agents. Your staff can set up an agent for one job, which then runs on its own, with nobody watching, on each new email in the inboxes they pick, on a schedule, or both. It checks those inboxes about every two minutes and can read only those. It can't use the web or send email. Its changes wait for a person's approval. The one exception is an admin's choice, per agent: saving an attachment from the email it's handling to that agent's own Drive folder, so anyone who emails that inbox can get a file into the folder before someone looks.

Who we share information with

• Anthropic provides Claude, the AI that reads the content it's given and does the work. Anthropic's commercial terms say it may not train its models on customer content.
• Railway hosts our website, database and assistant computers.
• Google and Microsoft provide sign-in and the services your organization connects. We may also email short notices about the work from PMC's own Gmail account to people named as reviewers.
• Websites and apps your organization chooses, when the assistant works in them.
• Others, only when required. If the law requires it, to protect safety or security, or with your prior consent as part of a merger or sale of our business.

We don't sell personal information.

How long we keep it

• Reference documents (links and files with a note on how they're used): until someone removes them.
• Other uploaded files, records of assistant and agent runs, and items in the approval queue (including proposed drafts and changes, the sender and subject of each email an agent ran on, and the IDs of those it passed over): deleted after 30 days. A copy an agent saved to Drive stays there, under your control.
• The assistant's working sessions at Anthropic, which can include what it read during its work: deleted after 30 days. Anthropic's own systems may hold data for a limited time after that, under its terms.
• Screenshots and logs from the assistant computer: deleted after 30 days.
• Access tokens and keys: until they're disconnected or removed.
• Website sign-in sessions: end after 12 idle hours or 7 days at most.
• Activity records: kept for security and accountability, including after your organization stops using PMC Assistant.

A daily cleanup does the deleting, so something can last a day or two past its 30 days.

Security

Connections to our site use HTTPS. Access tokens and keys are stored encrypted, and each client has its own assistant computer. No system is perfectly secure. If we learn of a breach that affects your information, we'll tell your organization promptly.

Your choices

• Admins at your organization can disconnect any service and remove documents at any time.
• You can ask us for a copy of your information, or ask us to correct or delete it, by writing to consulting@patrickmcelroy.me. We'll answer within 30 days. Since your organization controls its account, we may need its admin's go-ahead.
• When your organization stops using PMC Assistant, we'll delete its connections, files, assistant computer, run records and working sessions on request, keeping only the activity records.

Children

PMC Assistant is for people at work. It isn't for anyone under 18.

Changes

When we change this policy we'll update it here and change the date at the top. For a significant change, we'll tell your organization's admins before it takes effect.

Contact

Patrick McElroy Consulting LLC, consulting@patrickmcelroy.me