Privacy policy

Last updated: October 18, 2026

Rulebook is an AI work agent for sales, marketing and customer success teams. It finds the work in your meetings, playbooks and requests, does it in your tools after a person approves it, and keeps a record of what it did. This policy explains which data Rulebook uses, why, who processes it, how long we keep it and how you can reach us.

Rulebook is in early development. Rulebook is operated by Abhishek Humney, Bengaluru, India. In this policy, "we" means Rulebook and its operator, and "customer" means a company that uses Rulebook.

1. The website and the waitlist

When you join the waitlist on getrulebook.com, we store your email address and, if you give it, your company name. We use them only to contact you about Rulebook. We do not sell them and we do not use them for advertising. The website uses no advertising or analytics cookies. Our hosting provider, Cloudflare, processes the requests to the website to deliver it and to protect it.

2. Data from your connected tools

A customer connects the tools that Rulebook may use, for example Google Workspace (Gmail and Google Drive), Slack, HubSpot, Salesforce and Notion. Each connection asks for the smallest set of permissions that the work needs. Rulebook reads and writes only what a task needs:

meeting transcripts and notes that the customer gives to Rulebook, and the recording and transcript of a call when a person sends the Rulebook meeting bot to it;
records in the CRM, such as accounts, contacts, deals and quotes;
messages in the Slack channels and direct messages where people ask Rulebook for help, and the emails that the customer forwards to its Rulebook address;
documents and files that the customer shares with Rulebook, or that Rulebook makes (with Google Drive, Rulebook can open only the files that it made or that a person opened with it);
the names, work email addresses and roles of the people who use Rulebook.

Rulebook uses this data to find work items, plan the steps, ask the right person for approval, do the approved steps (for example, update a deal or save an email draft) and check the result. It keeps a receipt of each step, with the source of each fact. Rulebook does not send an email to a customer's contacts unless a person approves it.

3. AI model providers

Rulebook uses AI models through the business services (APIs) of model providers: today, Anthropic for language tasks and Voyage AI for search embeddings. We send a provider only the text that a task needs. Before each call, Rulebook removes secrets such as passwords, keys and access tokens from the text. The providers process the data under their business terms for these services.

4. Google user data

Rulebook's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features of Rulebook that the customer uses. We do not use it for advertising, we do not sell it, and people at Rulebook do not read it, except with the customer's permission, for security reasons, or when the law requires it.

5. Other service providers

Cloudflare: the website and the waitlist.
Sentry: error reports from our servers. Error reports leave out secrets.
Langfuse: a record of each AI model call (the task, the model, the tokens, the cost and the time), to check quality and cost. It gets no prompts, no model output and no customer text. We use it from when we turn it on in production.
Recall.ai: the meeting bot. When a person sends it to a call, it records the call and makes the transcript.
Our cloud hosting provider: the servers and the database of Rulebook.

We will update this list when we add or change a provider.

6. Security

Rulebook keeps the access tokens of connected tools encrypted (AES-256-GCM, with a separate key for each customer). Data moves over encrypted connections (TLS). Each customer's data is kept apart from other customers' data. Each connection asks for narrow permissions (for example, with Google Drive, Rulebook can open only the files that it made or that a person opened with it), and in Rulebook a person can act only on the work that they own or manage. Rulebook records approvals, changes of owner and status, and each step that changes something in a tool. Rulebook does not hold SOC 2 or ISO 27001 certification today. We build Rulebook to the SOC 2 controls (encryption of stored credentials, least-privilege access, audit logs) and plan a SOC 2 audit as we grow.

7. How long we keep data, and deletion

By default, Rulebook deletes meeting transcripts after 30 days, email drafts and logs after 90 days, and receipts and the audit log after 365 days. The admin of a customer can change these periods, and can keep the records of one work item for a legal hold. A customer can ask us at any time to delete its data, or the data of one person. We delete it within 30 days of the request, and we confirm when it is done. A customer can also remove Rulebook's access in each connected tool at any time. Waitlist entries are kept until you ask us to remove them.

8. Your rights

You can ask us which data about you we have, ask us to correct it, or ask us to delete it. If your company uses Rulebook, your company decides how Rulebook uses its data, and we help it answer your request.

9. Changes

When we change this policy, we update the date at the top of this page. For important changes, we tell customers before the change takes effect.

10. Contact

Questions and requests: support@getrulebook.com