Privacy Policy

01Who

Who runs Bureau

Bureau is operated by Noord Ventures B.V., trading as Noord, Marterkoog 7C, Alkmaar, the Netherlands (Dutch Chamber of Commerce number 95690247). For anything about your data, write to hello@getbureau.app. This policy covers Bureau’s website at getbureau.app, the hosted Bureau service at app.getbureau.app (formerly bureau.noord.vc), and Bureau’s Mac, iPhone and web clients. You can choose to leave your email to request an invitation. Only if you allow analytics, the website counts visits and selected clicks with Vercel Web Analytics. Your browser’s Do Not Track or Global Privacy Control signal keeps analytics off. See Cookies and website privacy below.

02Cookies and privacy

Cookies and website privacy

Choose Essential only or Allow analytics in the website notice. Both let you use the whole website. You can change your choice at any time in Privacy settings, also available in the footer. Choosing Essential only stops future analytics events immediately. Saved changes also apply to other open tabs on the same website.

Preferences the website remembers

• Privacy choice. Local storage named bureau_privacy_v1 records your choice, the notice version and the time you chose it. We honour it for 180 days, then ask again. It contains no visitor identifier. If your browser blocks storage, your choice lasts only for the current page session.
• Appearance. When you change the light or dark theme, theme in local storage remembers your preference until you change it or clear your browser’s site data.
• Currency. When you choose EUR or USD, bureau_currency remembers it in a first-party cookie for one year and in local storage until you change it or clear site data. Without a saved choice, we use the country supplied by our host, or your browser’s region or time zone, to suggest a currency.

These preferences support the choices you make. They are not used for advertising or analytics.

Optional website analytics

With your permission, Noord uses Vercel Web Analytics to understand which public pages people visit and which invitation, sign-in and download buttons they use. It helps us improve the website. Analytics stays off until you choose Allow analytics, and stays off whenever your browser sends Do Not Track or Global Privacy Control.

Vercel’s analytics uses no tracking cookies. It creates a request-derived hash to count visitors and discards its visitor session after 24 hours. Statistics include the visited page, referral source, approximate location, browser and device type. We remove query strings and fragments from tracked page URLs and send only fixed button categories and invitation submission status, never your email or form contents. See Vercel’s analytics privacy information.

We do not use advertising trackers or session recordings on this website. Hosting and security logs needed to deliver and protect it are separate from optional analytics. When you play the launch film, our video delivery provider receives the network request needed to stream it.

03What we store

What we store

• Your Google profile. When you sign in with Google we receive your email address, name, profile picture, Google’s id for your account and your Google Workspace domain. For signing in we request only the openid, email and profile scopes; signing in does not give us your mail, calendar or files.
• Your ChatGPT profile. If you sign in with ChatGPT instead, we receive what OpenAI shares; see Sign in with ChatGPT.
• Google accounts you connect. Only if you choose to connect Google Calendar, Gmail, Google Drive or Google Search Console. What that gives Bureau, and what we keep, is set out in Google user data.
• Workspace content. Channels, messages, reactions, threads, uploaded files, link previews, agent definitions, agent runs and their tool calls, knowledge sources you add, tasks and notifications.
• AI provider keys. A key for Anthropic, OpenAI, xAI, DeepSeek, Mistral, Groq or OpenRouter that an owner or admin adds for the workspace, or that you add for your own agents, is stored encrypted and is used only by that workspace’s agents, or only by yours. It never leaves the server and is never shown back in full.
• Connector tokens. If your workspace connects GitHub, Figma or a custom MCP server, or you connect your own Google account, the resulting tokens are stored encrypted for that workspace or for you.
• Invitations and membership. Invited email addresses, roles, and who joined or was removed.
• Billing. For a workspace on a paid plan, its plan and subscription, and on the models-included plan its model usage; see Payments.
• Operational logs. Server logs with IP addresses, request paths and error details, kept for troubleshooting and abuse prevention. Push-notification tokens for the devices you sign in on.

We do not run advertising or third-party tracking inside Bureau.

04Google user data

Google user data

Bureau asks Google for access only when you use a feature that needs it, and only for that feature. Nothing beyond sign-in is requested until somebody chooses to connect a Google service: you for your own account, a client for its Search Console, an admin for the workspace’s Drive.

What we access, and why

• Sign in with Google (openid, email, profile). Your name, email address, profile picture, Google’s id for your account and, for a Google Workspace account, your company domain. We use them to create and recognise your Bureau account, to show your name and picture to the people you work with, and to let colleagues on the same company domain join the same workspace.
• Google Calendar (calendar.readonly, calendar.events), when you connect your own Google account from your connections in Bureau’s Settings. Agents you ask can read your events and the free and busy times your calendar can see, to find a time for a meeting, and can create an event on your calendar and invite people to it. Creating an event always asks you to approve it first, and you can decline it.
• Gmail (gmail.readonly, gmail.compose, gmail.send), requested only once Google has verified Bureau for these permissions. Agents you ask can search and read your mail, save drafts in your mailbox, and send a message when you ask them to. Drafting and sending ask a person to approve them first, unless your workspace has a rule that allows it. Attachments are listed by name and size; their contents are not read.
• Google Drive (drive.readonly), requested only once Google has verified Bureau for this permission. Agents you ask can search, list and read the files you can see, with Docs, Sheets and Slides read as text. Bureau never uploads, edits, deletes or shares a file.
• Google Search Console (webmasters.readonly, with openid and email). An agency that works with you in Bureau can ask you to connect your Search Console; you decide on your client page, which shows which of your agents will read it before you connect. Your SEO assistant can then list the properties your Google account can read and read their search performance (clicks, impressions, click-through rate and position, by query, page, country, device or date), what Google knows about a page (URL inspection) and your submitted sitemaps. It uses this to tell you how your site is found and to propose changes for you and the agency to decide on. It is read-only and changes nothing in Search Console. Your email address is used only to show which Google account was connected.
• A workspace’s Google Drive. An admin can instead connect the company’s Drive through a Google service account that Bureau makes for that workspace (read-only, drive.readonly). Every agent in the workspace can then read what is shared with that account. It does not use anyone’s own Google account. A service account Bureau made is deleted again when the connection or the workspace is removed.

How we use it

We use Google user data only to provide the features above, which you can see and switch off in Bureau. An account you connect is used only for requests you make: by your own agents, and by the workspace’s shared agents only if you allow that. Nobody else’s request can use it. A client’s Search Console is used only by that client’s own agents that were given it, and only while the client and those agents are active.

To answer a request, the agent’s AI model has to read what was fetched. So the Google data an agent reads for you (an event, an email, a document’s text, Search Console figures) is sent to the AI model provider the agent runs on, for that request, under that provider’s API terms. Which provider that is depends on the agent and the workspace, and a request that provider refuses can continue on another model or account (see Who else processes it). Bureau does not use Google user data to develop, improve or train generalized AI or machine-learning models. We do not sell it, use it for advertising, or use it to decide anyone’s creditworthiness.

People at Noord do not read your Google user data unless you ask us to (for example in a support request), it is needed for security, such as investigating abuse or a bug, or the law requires it.

What we store, and for how long

• Tokens. The access and refresh tokens Google issues are stored encrypted, with a key held only on the server. They are used only for calls to Google and never appear in a message, a tool result or a log. They are kept until the account is disconnected, its owner leaves the workspace, or the workspace is deleted.
• Calendar, Gmail and Drive. Bureau does not copy your calendar, mailbox or Drive. An agent fetches what a request needs when it runs. What it fetched is not written into the record of the run: the record says that the agent used your account, not what came back. The agent’s reply, which may quote or summarize what it found, is a message in the conversation where you asked, and is kept like any other message.
• Search Console. The figures the SEO assistant reads are kept with its answer in the client’s channel, where the client’s people and the agency’s people in that channel can see them. The assistant also writes what it learns about the site into that client’s memory, so the next month starts where the last one ended. Both are kept for as long as the workspace keeps that channel.

Who it is shared with

Google user data goes only to:

• Google, to make the request.
• The AI model provider the agent runs on, or the one a refused request continues on. Each is named under Who else processes it.
• Hetzner, which hosts Bureau.
• The people in the conversation where the agent answers, and Apple when that answer reaches someone’s iPhone or Mac as a notification preview.
• A code sandbox (Vercel or E2B), only if the agent puts it there.
• Wherever you ask an agent to send it, such as an email it sends for you.

We do not transfer it to anyone else, except where needed for security (for example investigating abuse), to comply with the law, or, after asking for your consent first, as part of a merger or acquisition.

Taking access back

• In Bureau. Disconnect Google from your connections in Settings. Bureau asks Google to revoke its access and deletes the stored tokens straight away. A client can disconnect Search Console from its client page, and the agency from its side; the channel is told who did it.
• Leaving a workspace. When you leave or are removed, Bureau asks Google to revoke every account you connected there and deletes its tokens.
• Deleting a workspace deletes every token stored for it, with the rest of its content.
• At Google. You can remove Bureau’s access at any time on your Google Account permissions page. Bureau can then no longer reach that account.
• Everything else. To have messages or memory that came from your Google data deleted, write to hello@getbureau.app.

Limited Use

Bureau’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

05Sign in with ChatGPT

Sign in with ChatGPT

Where Bureau offers it, you can sign in with your ChatGPT account (the button says Continue with ChatGPT). OpenAI asks for your consent and then shares your basic profile with Bureau: your name, your email address and whether it is verified, your profile picture, and OpenAI’s id for your account. Bureau asks only for the openid, profile and email scopes.

• What we keep. OpenAI’s id for your account, so we recognise you the next time; your email address and whether OpenAI says it is verified (only a verified address becomes your account’s address); your name; and the link to your profile picture, which can be shown as your picture to the people you work with.
• What we do not get. Bureau keeps no OpenAI access or refresh token: it reads the identity OpenAI returns at sign-in and nothing else. Signing in gives Bureau no access to your ChatGPT conversations, memory, files or plan.
• Why. To sign you in and to show who you are in your workspaces. Unlike a Google Workspace sign-in, a ChatGPT sign-in never adds you to a company’s workspace by your email’s domain: you join by invitation or make a workspace of your own. If you already have a Bureau account with the same verified email address, ChatGPT is added to it as another way to sign in, and the audit log of each of your workspaces records that.

To remove ChatGPT as a way to sign in, or your account altogether, write to hello@getbureau.app.

06LinkedIn

LinkedIn

LinkedIn. If you connect your LinkedIn account in Bureau, we use LinkedIn's Advertising API with your permission to list the ad accounts you have a role on, to read campaigns, creatives and aggregated reports, and, when you ask an agent to, to create campaign groups, campaigns and creatives in draft status. Agents act only on requests you make and only with your own connection; nobody else in the workspace can use it. We do not post on your behalf, read your messages or connections, collect other members' profile data, scrape linkedin.com, or sell, share or combine LinkedIn data.

Your LinkedIn token is stored encrypted on our server in the EU and is deleted when you disconnect, leave the workspace or the workspace is deleted. Campaign and report data we receive from LinkedIn is kept in the workspace's history for at most 12 months, and deleted within 10 days if you or the ad account's manager asks, or the service ends. The text of a request and the LinkedIn data it needs is sent to the AI model provider the agent runs on to produce the answer. You can disconnect in Bureau's settings and revoke Bureau's access in your LinkedIn settings at any time.

07Payments

Payments

When a workspace owner or admin chooses a paid plan, payment is handled by Stripe (Stripe Payments Europe, Ltd., Ireland). Bureau gives Stripe the workspace’s name and the email address of the person who starts checkout. At checkout, Stripe also receives the billing name and address, a VAT ID if one is entered, and the payment details. Stripe uses them to take payment, write invoices and calculate VAT. Bureau never sees a full card number.

Bureau keeps only what it needs to know where the workspace stands: its plan, its number of seats, the subscription’s status, when the paid period ends, and Stripe’s ids for the workspace’s customer and subscription. Invoices and the payment records behind them are kept for seven years, as Dutch tax law requires, also after a workspace is deleted.

On the models-included plan, Bureau also keeps what its agents’ model usage cost each month, in US dollars at the providers’ list prices, the number of seats each month ended with, and the usage lines it put on invoices. Each line goes to Stripe with the month, the dollars used, included and over, the number of seats, the 30% markup and the exchange rate, so the invoice shows how the amount was reached.

08Where

Where it lives

All workspaces run on one server and one database hosted by Hetzner in Nuremberg, Germany (EU). Uploaded files live on the same host. Nightly encrypted backups are kept for 30 days. This is a single-region closed beta: there is no data-residency choice and no redundancy across regions yet.

09Sub-processors

Who else processes it

• Hetzner Online GmbH (Germany): hosting and storage.
• The AI model provider an agent runs on: Anthropic, OpenAI, xAI, DeepSeek, Mistral, Groq or OpenRouter. Which one depends on the agent’s model and on whose account it runs: a key your workspace or you added; Bureau’s own OpenRouter account, for a workspace on the models-included plan; or, for a workspace without a key of its own, an account Bureau provides with one of these providers. If that provider refuses a request (for example no credit, a rate limit or an outage), the run can continue on the fallback model your workspace chose or on Bureau’s account. Whichever provider answers receives the messages, files and knowledge the agent is given, including what it reads from an account you connected, under that provider’s API terms.
• OpenRouter, Inc. (United States): routing model requests for the models-included plan, on Bureau’s account, and any other request an agent sends through OpenRouter (see above). It passes each request on to the company that hosts the model the agent uses.
• Google: sign-in (OpenID Connect), and Google Calendar, Gmail, Google Drive and Search Console when someone connects them (see Google user data).
• LinkedIn Corporation: the source of the ad data a person connects (see LinkedIn).
• OpenAI: Sign in with ChatGPT (OpenID Connect), when you use it.
• Apple: push notifications to iPhone and Mac clients (device tokens, notification text).
• Vercel: hosts the getbureau.app website and, if you allow analytics, counts visits and selected interactions.
• Resend: sends Bureau’s email: the confirmation of an invitation request, and invitations, sign-in links and hand-off notices about a client.
• Stripe Payments Europe, Ltd. (Ireland): payments, invoicing and tax calculation, for a workspace on a paid plan (see Payments).
• Vercel or E2B: code sandboxes, for agents allowed to use one. A sandbox holds what its agent puts in it, which can include something the agent read from an account you connected.
• GitHub, Figma or a custom MCP server: only if your workspace connects them, and only the requests agents make to them.

We do not sell data and we do not share workspace content with anyone else.

10Retention

How long we keep it

Workspace content is kept for as long as the workspace exists. Deleting a workspace removes it from the live database immediately and from backups within 30 days. Removing a member ends their access at once; their past messages stay in the workspace because they belong to it, and the accounts they connected there are disconnected. Server logs are kept for at most 30 days.

Invitation emails left on getbureau.app (before it, on noord.dev) are kept until we invite you or you ask us to remove them.

11Export and deletion

Export, deletion, and your rights

A workspace owner can delete the whole workspace from Settings. For an export, email hello@getbureau.app from an owner account; we send a JSON export of the workspace within 7 days. A self-serve export is planned.

Under the GDPR you can ask us to access, correct, export or erase your personal data, or object to how it is processed. Write to hello@getbureau.app; we answer within 30 days. You may also complain to the Dutch data protection authority (Autoriteit Persoonsgegevens).

12Security

Security

Traffic is encrypted in transit (TLS). Provider keys and connector tokens, Google’s included, are encrypted at rest with a key held only on the server. Access is scoped per workspace; members of one company cannot read another company’s data. If we learn of a breach affecting your workspace we will tell its owners without undue delay.

13Changes

Changes to this policy

We will update this page as Bureau grows; the date at the top shows the current version and we will email workspace owners about material changes. See also the Terms of Service. Questions: hello@getbureau.app.