Privacy Policy.

1. Who we are

awkteams (“we”, “us”, “our”) is operated by Pomacs Consortium Pty Ltd, a company registered in New South Wales, Australia. We provide AI-powered software delivery agents that work alongside your engineering team via Slack, GitHub, and Jira.

For privacy enquiries: hello@awkteams.ai

Customers requiring a Data Processing Agreement (DPA) should contact hello@awkteams.ai. We provide a standard DPA meeting GDPR and Australian Privacy Principles (APP) requirements.

2. Information we collect

Account & billing data

• → Name, email address, and company name provided during sign-up
• → Billing details processed by Stripe (we do not store card numbers)
• → Job title, company size, and plan preference from contact forms

Integration credentials

• → Slack OAuth tokens and workspace identifiers
• → GitHub App installation IDs
• → Jira API tokens and project identifiers
• → Google Workspace and Microsoft 365 OAuth tokens, where a user connects P.Chief to their own email and calendar

Integration credentials are encrypted at rest with per-tenant keys managed by a cloud key management service. They are used solely to operate the service on your behalf.

Customer content processing

Slack messages. Slack message content is processed only when agents are explicitly invited to a channel or DM. Message content is used solely to perform the work requested (e.g., reading a ticket description to write code). Message content is not persisted in our analytics systems, is not used for model training, and is transmitted to LLM providers (Anthropic, OpenAI, Google) under commercial API terms that prohibit use of your data for model training.

GitHub code and repository content. Code and repository content is processed via the GitHub App when agents are assigned to work on specific pull requests or issues. Content is transmitted to LLM providers under commercial API terms that prohibit use of your data for model training and is not persisted in our analytics systems.

Jira ticket content. Jira ticket content, comments, and issue metadata are processed by agents when working on assigned tickets. Same handling as above — transmitted to LLM providers under commercial API terms that prohibit training, not persisted in our analytics systems, not used for training. Ticket content is retained while your account is active (section 6).

Attachments & rich media. Files you share with agents in Slack — including images, PDFs, audio, and video — are read by the agent to perform the requested work. Their content is transmitted to LLM providers (Anthropic, OpenAI, Google) under the same commercial API terms that prohibit use of your data for model training, is not persisted in our analytics systems, and is not used for model training.

Email & calendar (P.Chief).If a user connects P.Chief to their own email and calendar (Google Workspace or Microsoft 365), the relevant message and calendar content is processed to perform the requested work and transmitted to LLM providers under the same commercial API terms. Each user connects only their own account; P.Chief does not access other users’ email or calendars. This content is not persisted in our analytics systems and is not used for model training.

Usage & operational data

• → Agent activity logs (task status, completion times, error events)
• → LLM token consumption metrics for billing

Website analytics

On our public website (awkteams.ai) we use Google Analytics to measure site traffic — pages viewed, referrer, approximate location, and browser and device type. Google Analytics 4 does not log or store visitor IP addresses. We use this data only to understand how the website is used; we do not use it for advertising, and we do not use advertising pixels. Google’s handling of this data is described in How Google uses information from sites or apps that use our services and the Google Privacy Policy.

We also use PostHog (PostHog Inc.), on its US Cloud hosted in the United States, for product analytics and session replay on the public website. PostHog records pages viewed, clicks, scrolling and mouse movement, and the page content on screen, so we can see how visitors move through the site and where they get stuck. Anything typed into a form field is masked in the browser before it is sent, so form inputs are not recorded in replays; the contact form is excluded from replay in its entirety. When you submit the contact form, analytics receives only the option you chose in “What would you like?” — not your name, email, or message. Session replays are retained for up to 3 months. We use this data only to understand how the website is used, not for advertising. Neither tool runs until you have answered the cookie notice shown on your first visit: PostHog records no page views, events or replays, and Google Analytics is not loaded. If you reject analytics cookies (section 8), Google Analytics is not loaded and sends nothing, and PostHog sets no analytics cookies or local storage beyond remembering your choice and keeps only a cookieless count of pages viewed and clicks that is not linked across days, with no session replay. PostHog’s handling of this data is described in the PostHog Privacy Policy.

On the signed-in console (console.awkteams.ai) we also use PostHog, but for product analytics only — not session replay, which is disabled there. It records which pages and features signed-in users open, and their navigation and clicks, associated with your user account and organisation, so we can improve the product. It does not record the content shown on the console (integration configuration, cloud identifiers, or credentials): the text of on-screen elements is stripped from every event before it is sent, and no session is ever recorded. This is a separate processing activity from the public-website analytics described above.

3. How we use your information

• → To operate and maintain the awkteams service
• → To authenticate your team and manage access
• → To process billing and send invoices
• → To respond to enquiries and provide support
• → To improve service reliability and performance
• → To comply with legal obligations

We do not sell your personal information. We do not use your data to train AI models.

4. Third-party services

We share data only with processors required to deliver the service:

• → Google Cloud Platform — infrastructure hosting and key management. Processed in Sydney, Australia.
• → Awk Teams embedding service (operated by us) — converting ticket text and agent memory into search vectors so agents can recall prior work. Processed in Australia, on infrastructure we operate outside Google Cloud.
• → MongoDB Atlas — application data storage. Processed in being confirmed — contact us for current detail.
• → Anthropic, OpenAI and Google — LLM inference under commercial API terms that exclude training on your data. Processed in provider-determined — see International transfers.
• → Stripe — payment processing. Processed in United States.
• → PostHog Inc. — product analytics on the public website and the signed-in console, with session replay on the public website only. Processed in United States.
• → Google Analytics — traffic measurement on the public website only. Processed in United States.
• → Slack, GitHub, Atlassian, Google Workspace, Microsoft 365 — integration APIs, accessed with the scopes you grant. Processed in wherever you host your own accounts.

Sub-processor list last reviewed 30 September 2026.

This list of sub-processors may change as we evolve the service. Customers on Enterprise plans receive notice of material changes before they take effect. The current sub-processor list is always reflected on this page.

5. Data security

• → All data encrypted in transit and at rest
• → Per-tenant credential encryption with envelope encryption via cloud key management
• → Per-tenant isolation — separate workloads, a separate database, and separate encryption keys per customer
• → Audit logs retained per your plan tier (30 days to 10 years)
• → Access to customer data limited to essential operations staff
• → Enterprise authentication available via SAML 2.0 (compatible with Okta, Google Workspace, Microsoft Entra ID, and other SAML 2.0 providers via standards compliance). SCIM 2.0 automated user provisioning and deprovisioning available on Enterprise

Our infrastructure inherits compliance from Google Cloud Platform (SOC 2, ISO 27001). Awk Teams’ own SOC 2 certification is on our roadmap.

6. Data retention

• → Account data — retained while your account is active, deleted within 30 days of account closure
• → Agent activity logs — retained per your plan’s audit retention period
• → Conversation history — the Slack and Microsoft Teams threads agents took part in are kept for 21 days after the last activity in the thread, then deleted automatically. The window runs from the last message, so an active thread stays available while work continues
• → Ticket content and agent memory — ticket text, requirements, and what agents learn about your codebase and conventions are kept for as long as your account is active, because agents draw on them for later work. They are deleted with your account, on the schedule above
• → Working copies of content — checkouts of your code, files you share with agents, tool output, the prompts sent to model providers, and service logs that carry any of that content are deleted automatically within 30 days
• → Delivery analytics — outcomes, counts and quality verdicts for each piece of work (not the message text) are kept for 180 days and deleted when your account is deleted. De-identified totals that carry no content and are not linked to you or your team are kept longer, and are detached from your organisation on account deletion
• → Feedback and problem reports — when you ask an agent to report a problem or pass on feedback, or an agent recognises a complaint about the service in what you have written, we keep a support record of what was reported, who reported it and a link to the conversation, so we can respond and improve the service. The agent tells you in the thread when a report is filed. Records are kept until your account is deleted
• → Integration credentials — deleted immediately on deprovisioning or credential rotation
• → Billing records — retained as required by Australian tax law (typically 5 years)
• → Contact form submissions — retained for 12 months, then deleted

Your content is not used to train AI models — not by us, and not by the model providers, whose commercial terms prohibit it. Those providers do retain what is sent to them briefly for abuse monitoring under those same terms; that retention is theirs and is governed by their terms, not set by us. Backup copies taken for operational recovery may persist beyond the windows above.

7. Your rights

Under the Australian Privacy Act 1988 and, where applicable, the GDPR, you have the right to:

• → Access the personal information we hold about you
• → Request correction of inaccurate data
• → Request deletion of your data (subject to legal retention requirements)
• → Export your data in a portable format
• → Object to or restrict certain processing

To exercise any of these rights, contact us at hello@awkteams.ai. We will respond within 30 days.

8. Cookies

We use strictly necessary cookies for authentication session management. On our public website, once you accept analytics cookies, Google Analytics sets analytics cookies (such as _ga) to distinguish visitors and sessions, and PostHog sets cookies and local-storage entries prefixed ph_ (and __ph_) to distinguish visitors and sessions; whichever way you choose, PostHog keeps one __ph_ entry to remember that choice. These are used only for the website analytics described in section 2, not for advertising. On the signed-in console, PostHog also sets a ph_-prefixed cookie to recognise your session for the console product analytics described in section 2. We do not use advertising cookies.

On your first visit a cookie notice asks whether to accept or reject analytics cookies; until you answer, PostHog records no page views, events or replays and Google Analytics is not loaded. If you reject, Google Analytics is not loaded and sends nothing, and PostHog sets no analytics cookies or local storage on this site (beyond remembering the choice) and keeps only a cookieless count of pages viewed and clicks that is not linked across days, with no session replay. If you reject after having accepted, Google Analytics stops sending and its cookies are removed, and PostHog removes its analytics cookies and switches to the cookieless count. The choice is remembered in this browser and can be changed below. You can also block analytics cookies in your browser settings, or block Google Analytics with the Google Analytics opt-out browser add-on.

9. International transfers

Our infrastructure is hosted on Google Cloud in Sydney, Australia. Your account, your team’s configuration and your audit logs are held there. One component — the service that turns ticket text and agent memory into search vectors so agents can recall prior work — runs on infrastructure we operate in Australia outside Google Cloud.

Some processing necessarily happens outside Australia, and processing is a separate question from storage. To carry out the work you request, agents send the relevant content to third-party model providers — Anthropic, OpenAI and Google — which process it under their own published data-residency terms; we do not control the region in which they do so. Those providers retain inputs and outputs briefly for abuse monitoring under those same terms, and do not use your content to train their models. Payments are processed by Stripe, and website and product analytics by PostHog and Google, in the United States. Section 4 lists every recipient.

Where personal information is disclosed outside Australia we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, and where the GDPR applies we rely on appropriate safeguards including standard contractual clauses where applicable. Contact hello@awkteams.ai for a copy of the safeguards relevant to your transfer, or for the Data Processing Agreement described in section 1.

10. Changes to this policy

We may update this policy from time to time. Material changes affecting how we process personal data will be announced at least 30 days before taking effect via email to account holders. The effective date at the top of this page reflects the most recent revision.

11. Data breaches

In the event of a data breach that compromises personal data, we will notify affected customers within 72 hours of becoming aware of the breach, in accordance with GDPR requirements and the Australian Notifiable Data Breaches scheme. Notifications will include what happened, what data was affected, what we are doing to address it, and what customers should do.

12. Children’s data

Awk Teams is a B2B product not intended for use by children under 16. We do not knowingly collect personal information from minors. If we become aware we have collected such information, we will delete it promptly.