Version 2 · effective 1 October 2026
Privacy Policy
Conductor (conductor.gigatokens.ai) is operated by Behavox Ltd, a company registered in England and Wales (company no. 09066452), registered office 29 Albert Embankment, London, England, SE1 7GR ("Behavox", "we"). Behavox is the controller of the personal data described here. This policy explains what we collect when you use Conductor, why, where it is processed, and how long we keep it. It complements the Behavox Privacy Policy (www.behavox.com/privacy-policy).
01What we collect
| Your sign-in identity | When you continue with Google we receive your e-mail address and Google account ID (we ask Google only for openid and email). If you sign in with an e-mail and password, we keep that account in Google Cloud Identity Platform. |
|---|---|
| Accounts you connect | If you connect a service (for example Google, Slack, GitHub, GitLab, HubSpot, Atlassian or Figma), we store the access tokens that service gives us, per person, so your agents can act with the permissions you granted. You can disconnect at any time. |
| What you do in Conductor | Your conversations with agents, the files you and your agents create or upload, and the data your agents work on inside your workspace. |
| Usage and billing | AI model usage and infrastructure costs per workspace, so we can show you your usage and bill it. If you add a card, Stripe holds it; we keep only the card brand, last four digits and expiry. |
| Cookies | Only the cookies sign-in needs: a session cookie on this site, and short-lived cookies (one to five minutes) that carry you, already signed in, from this page to your Conductor. No advertising or analytics cookies. |
02How we use it
- To sign you in and decide which Conductors you can open.
- To run your agents: they send your instructions and the data they work on to AI model providers and to the services you connected.
- To measure usage, bill it, and prevent abuse.
- To support you. Support can read workspace data only with the workspace owner's permission.
We do not sell your data, and we do not use it for advertising.
03Where it is processed
We share personal data only with the sub-processors that run Conductor for you:
- Google Cloud (in the region chosen when the workspace is created — us-central1, United States, by default): each workspace runs in its own Google Cloud projects, with its own database, storage and machines. Account, sign-in and billing records are kept in the United States.
- AI model providers we route to (for example, Anthropic and OpenAI, depending on the model you choose) receive the prompts and content your agents send, through your workspace's own gateway.
- Stripe processes payments. We never see your card number.
- The services you connect receive what your agents send them, under your permissions.
Some of these providers process data outside the UK and the EEA, mainly in the United States. Where they do, we rely on adequacy decisions or the Standard Contractual Clauses (with the UK Addendum) so your data gets the same level of protection.
04How long we keep it
- Workspace data. A workspace owner can set a retention period; when it's set, conversations, support data, activity records and telemetry older than that are deleted. Files and agent disks stay until you delete them or the workspace.
- Support data. Raw material gathered for a support request is deleted after the request closes, on the workspace's retention schedule.
- Deleting a workspace. Deletion stops everything at once and removes the workspace within 24 hours. For 30 days after that, the underlying cloud projects can still be restored by us in an emergency; then they are gone for good. Database backups expire within 7 days.
- Billing records are kept for 6 years, for tax and accounting.
- Sign-in sessions last at most 8 hours.
05Your choices and rights
You can disconnect a connected account, change the retention period (owners), or delete a workspace at any time. Under data-protection law you also have the right to:
- request access to your personal data;
- request correction of your personal data;
- request erasure of your personal data;
- object to processing of your personal data;
- request restriction of processing of your personal data;
- request transfer of your personal data;
- withdraw consent, where we rely on it.
To exercise any of these, write to our Data Protection Officer at legal@behavox.com. We aim to answer within one month. You can also complain at any time to the Information Commissioner's Office, the UK data-protection regulator (www.ico.org.uk), though we'd appreciate the chance to address your concern first.
06Security
Each workspace is isolated in its own cloud projects. Connected-account tokens are held in Google Secret Manager, per person, and are used only inside your workspace. All traffic is encrypted in transit.
07Changes and contact
If we change this policy we will update the date above and tell you in Conductor before a material change takes effect. Questions or requests: our Data Protection Officer, legal@behavox.com, or Behavox Ltd, 29 Albert Embankment, London, England, SE1 7GR.