Privacy Policy

This policy explains what personal information Akagi handles, why, where it is kept, who else handles it, how long we keep it, and the choices and rights you have. We have tried to write it in plain words and to say only what is true.

Contents

1. Who we are
2. What Akagi is
3. Our role: when we decide, and when your organisation decides
4. The information we handle
5. What we do not collect
6. How we use information, and our legal bases
7. AI and your information
8. Who can see your information
9. Service providers we use
10. Where your information is stored, and transfers outside Australia
11. How long we keep information
12. Deleting information, and taking a copy
13. How we protect information
14. If something goes wrong: data breaches
15. Your rights and how to use them
16. Cookies, analytics and browser storage
17. Children
18. Changes to this policy
19. Complaints
20. Contact us

1. Who we are

Akagi is made and run by Nakatomi Pty Ltd (ABN 21 623 035 601), Level 1, 171 William Street, Darlinghurst NSW 2010, Australia ("Nakatomi", "we", "us"). We are responsible for the personal information described in this policy, except where section 3 says your organisation is.

We have chosen to be bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, by opting in under section 6EA of the Act, so they apply to everything in this policy. We also follow the GDPR's requirements where they apply to people we deal with.

• Privacy questions and requests: privacy@akagi.work (our Privacy Officer, Sarah Choo, Nakatomi Pty Ltd)
• General help: support@akagi.work
• Reporting a security vulnerability: security@akagi.work

This policy covers:

• the Akagi web app at app.akagi.work;
• Akagi's connection for AI apps (the address your AI app connects to, and the Akagi plugins for Claude Code and Codex);
• the emails Akagi sends; and
• the Akagi website at akagi.work.

It does not cover the AI apps you connect to Akagi (such as Claude, ChatGPT, Codex or Cursor), or any other service you reach through a link. Those have their own privacy policies. Nakatomi's other services are covered by Nakatomi's own privacy policy at nakatomi.com.

2. What Akagi is

Akagi is shared project memory for teams that work with AI. A workspace is an organisation's place in Akagi. Inside it, projects hold pages and files, and a log of every update: who made it, when, and why. People work on projects in the web app, and through the AI apps they connect to Akagi with their own AI accounts. Akagi keeps each connected AI up to date with what teammates have changed.

3. Our role: when we decide, and when your organisation decides

Privacy law gives different responsibilities to the organisation that decides why and how information is used (a "controller" under the GDPR, and a "business" under Californian law) and to an organisation that handles it on someone else's behalf (a "processor" or "service provider").

If your organisation gave you access to Akagi, your organisation decides how its workspace content is used and who can see it, and requests about that content should usually go to your organisation first (section 15). If you set up a personal workspace for yourself, you are the customer for that workspace.

4. The information we handle

4.1 Your account and sign-in

• Email address, which must be verified. It is how you sign in, how teammates invite and find you, and how we email you.
• Name, which you enter, or which we take from your Google or Microsoft account when you first sign in with it. You can change it.
• Time zone, used to time emails.
• How you sign in. Akagi has no passwords. You sign in with a link we email you, or with Google or Microsoft. The first time you use a Microsoft account, we ask you to confirm its email address with a link opened in the same browser. We record which sign-in methods are linked to your account and an identifier for each from the sign-in provider.
• Proof that you currently use a mailbox, recorded as the date you last confirmed it, needed before you can join or set up a workspace by your company's email domain.
• Sign-in and session records: when you signed in and with which method, and your active browser sessions (stored only as a scrambled, one-way hash of the session code).

Source: you, and Google or Microsoft when you choose to sign in with them (we receive your email address, whether it is verified, your name and, for Google, which Google Workspace domain manages the account).

4.2 Workspaces, projects and membership

• Workspace and project names, purposes and settings; a workspace's linked company email domains and how people may join.
• Who belongs to each workspace and project, their roles, when and how they joined (for example by invitation, or by their email domain), and whether they are suspended.
• Invitations (the invited email address, the role, who invited them, and when) and requests to join (who asked, and who let them in or declined).
• Private folders and files: who may read and change them.
• Audit records of access changes, such as role changes, invitations, joining, someone giving themselves access to a project, and the first save to a wider audience after reading private files.

Source: the people in the workspace, and you.

4.3 Project content

• Pages (text written in the web app or saved by AI apps), and every earlier version of them.
• Files people add (documents, images, video, audio and others), and every earlier version.
• Text we extract from documents (PDF, Word, PowerPoint, Excel and plain-text formats) so that AI apps can read them, image previews and thumbnails we make from pictures and PDFs, and descriptions people or their AI apps give files.
• The update log: for every change, who made it, when, what kind of change it was, a title, the reason given, what the person was exploring next, and which pages and files it touched. Each update records the person, which surface it came through (the web app or an AI app) and, as reported by the AI app, the app and model used.
• Directions (parallel lines of work within a project), with who started each and why; items marked as disputed; links to live documents held elsewhere (such as Google Docs or Notion) with the title and owner people enter.

Project content can contain personal information about anyone, including people who do not use Akagi, if people choose to put it there. The customer is responsible for having the right to add it.

Source: the people in the workspace, directly or through their AI apps.

4.4 Collaboration and activity

While someone works on a project through an AI app, Akagi records a session:

• the person, the AI app and connection used, and the direction they were on;
• the pages and files read and changed, searches, and updates saved;
• a short "working on" line (up to 140 characters) and optional session notes (up to 500 characters) that the AI app writes;
• times.

From this Akagi shows teammates a Working now line, and when a session goes quiet for an hour after something was saved or noted, writes a short handoff note (section 7.1). Akagi also records how far each person and each chat has been told about teammates' updates, and when each person last used an AI on each project, so it can send the right updates and decide when an email is due.

Akagi never records your conversation with your AI. It records only what the AI app sends to Akagi's tools.

Source: the AI apps people connect, acting for them.

4.5 Connected AI apps

When you connect an AI app to Akagi, we keep:

• which app it is (as the app identifies itself), which workspaces and projects you allowed it to see, and what you allowed it to do (read, save changes, add files);
• when it was connected, last used and last checked for updates, and which kinds of AI app have used the connection;
• the credentials that let it reach Akagi. Access passes expire after an hour; the longer-lived renewal codes are stored only as a one-way hash, and stop working after 30 days at most;
• identifiers the AI app sends for each chat or session, so Akagi can keep each chat up to date separately;
• if you use the Akagi plugin for Claude Code, the path of the folder on your computer that Claude Code is working in, so a new chat in the same folder links to the same project. (The Codex plugin sends only a session identifier.)

Workspace Owners and Admins can see which AI apps a member has connected and when the member was last active.

4.6 Emails

We send:

• sign-in and confirmation links, which Google Identity Platform sends for us;
• invitations, when a teammate invites you;
• notices about joining a workspace, for example to Owners when someone joins or asks to join, and to the person when they are let in or declined;
• "while you were away" (FYI) emails about project updates, to people who have used an AI on that project and then not for a day. Each has an unsubscribe link for that project, and you can turn them off in your settings.

We keep a record of which FYI emails were sent, to whom and when, and your email preferences. Our email provider (section 9) keeps delivery records. Open and link tracking are switched off: we do not track whether you open an email or click a link in it.

We do not send marketing emails from Akagi.

4.7 Technical, security and usage records

• Request logs for every request to Akagi: the time, the address requested (without query strings or bodies, and with the private links used for file transfers removed), the result, how long it took, the IP address and the browser or app identifier (user agent), and for AI apps the tool called.
• Load balancer logs with similar details.
• Security and abuse prevention: counts of sign-in emails, workspace creations and requests per IP address and per email address, held briefly in memory; for AI apps that register themselves with Akagi, a hash of the IP address they registered from.
• Error and alert records that let us find faults, which are designed not to include tokens, links or file contents.
• Product analytics in the web app (section 16): which features are used, when, and from what kind of browser and device, under a pseudonymous identifier. Analytics never include the content of pages, files, names, titles, reasons, notes, search terms or email addresses.

4.8 The akagi.work website

If you agree to analytics cookies, we use PostHog to understand how visitors use akagi.work: the pages viewed, where the visit came from, approximate location derived from the IP address (country and city), browser and device type. We do not record your screen or your sessions. If you decline, PostHog counts the visit without cookies (section 16). The site has no advertising trackers. Its fonts and images are served from the site itself. If you use the "Early access" link, it opens an email to us in your own email app, and we receive what you send.

5. What we do not collect

• Your AI conversations. Only what your AI app sends to Akagi's tools: summaries, facts, decisions, files and notes, each with a reason.
• Passwords, because Akagi does not use them.
• Your AI account credentials. Each AI app holds its own access to Akagi; we never see your Claude, ChatGPT or other login.
• Payment details.
• Information from advertising networks or data brokers. We do not buy personal information.

We do not ask for sensitive information (such as health information, racial or ethnic origin, or religious beliefs). Akagi is not designed for it, and customers should not put it in a workspace unless they are allowed to and have decided Akagi's protections are enough.

6. How we use information, and our legal bases

We use personal information only for the purposes below. Where the GDPR or UK GDPR applies, the legal basis for each is shown. Where we act for a customer (section 3), the customer decides the purposes and is responsible for the legal basis, and we follow its instructions.

Where we rely on legitimate interests, we have weighed them against your interests and rights. You can ask us for details and object (section 15).

We do not use personal information for advertising, we do not sell it, and we do not use it to make decisions about you that have legal or similarly significant effects without a person involved.

7. AI and your information

7.1 Akagi's own use of AI: handoff notes

Akagi uses one AI model itself: Google's Gemini, through Google Cloud's Vertex AI, to write short handoff notes when a working session goes quiet, so teammates can see what was done. It runs only for a session that saved something or left a note.

• What is sent: only the session's activity: the project's name, the person's name, the "working on" lines and session notes, the titles and reasons of updates saved, the names and folder paths of files added or looked at, and the names of directions. The contents of pages and files are never sent, and neither is text extracted from files.
• Where it is processed: through Google's global endpoint. Google may process these requests in any of its locations worldwide; they are not kept in Australia.
• What Google keeps: under our Google Cloud agreement, Google does not use this data to train or fine-tune AI models, does not keep cached copies of requests beyond the request itself, and does not store prompts or responses for abuse monitoring. We have not switched on request logging.
• How it is labelled: each note is marked "Auto-summary (AI-written from activity)". If the model is unavailable or over its daily spending cap, Akagi lists the activity instead and labels it "Handoff note (listed from activity, not AI-written)".
• Visibility: a handoff note is shown only to people who can read every page and file it is about.

Akagi does not use AI to describe your files, and does not send file contents to any AI model of its own. We do not use your information to train AI models.

7.2 The AI apps you connect

When you connect an AI app (such as Claude, ChatGPT, Codex or Cursor) and use it with Akagi, that app receives the project content you ask it to read, including private folders you can read, and sends Akagi what it saves. The AI app is provided by another company (for example Anthropic or OpenAI) under your own account and its terms, which you or your organisation chose. That company is not our service provider, and we do not control what it does with the content.

• On some personal AI plans, conversations may be used to train that company's models unless you switch this off in the AI app's privacy settings. Akagi shows this reminder when you connect an AI app and when a private folder is set up.
• Teammates whose files you read through your AI app are relying on your app's settings. Organisations may choose which AI apps their people use.
• Removing an AI app's access in Akagi (Connect your AI → Revoke) takes effect within about 5 seconds, but cannot recall anything the app already received.

When you add a file from ChatGPT, Akagi fetches it from OpenAI's file storage using a short-lived link ChatGPT provides, and only from OpenAI hosts we have approved.

8. Who can see your information

Inside a workspace, people see what their role and the project's settings allow:

• Project members see the project's pages, files, updates (with who made them, when and why), directions, Working now lines and handoff notes, except anything in private folders and files they cannot read. Akagi is built so that people without access to a private folder learn nothing about what is in it, including through search, emails, errors and exports. They may be able to tell that the project changed at a certain time.
• Workspace Owners and Admins see the member list (names, email addresses, roles), invitations, requests to join, which AI apps members have connected and when they were last active, and a rough measure of storage used. They do not automatically see project content; if an Admin gives themselves access to a project, the project's Managers are told.
• When you join a workspace by your email domain, its Owners may be emailed your name and email address.

Outside a workspace, we share personal information only:

• with the service providers in section 9, to run Akagi;
• with the AI apps you connect, as section 7.2 describes;
• if the law requires it, for example a valid court order, or where needed to protect people's safety or our rights. Where the law allows, we will tell the customer first;
• with a buyer or successor if Nakatomi or Akagi is sold or restructured, who must then honour this policy.

We do not sell personal information, and we do not share it for targeted advertising.

9. Service providers we use

These companies ("sub-processors") process personal information for us, under written contracts that limit them to providing their service and require them to protect it. We publish the current list at akagi.work/subprocessors and tell workspace Owners at least 30 days before we add or replace one, so customers can object.

When you choose to sign in with Google or Microsoft, that company also learns that you signed in to Akagi, under its own privacy policy.

10. Where your information is stored, and transfers outside Australia

Akagi runs in Google Cloud's Sydney region (australia-southeast1). The database, file storage, application and security logs, background jobs, keys and secrets are kept there, and database backups in Google Cloud's Melbourne region (australia-southeast2), so they also stay in Australia. Some information is processed outside Australia by the providers in section 9:

Information also travels across the internet, encrypted, between your device and Google's network, and may enter Google's network at a point near you.

Countries. Information may therefore be processed in the United States and other countries where Google or Microsoft operate data centres for their global services.

Safeguards. We disclose personal information outside Australia only to providers bound by contracts that require them to protect it, and we take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles. Where the GDPR or UK GDPR applies to a transfer, it relies on the European Commission's Standard Contractual Clauses (with the UK Addendum) in our providers' data processing terms, or on another safeguard the law recognises. You can ask us for a copy of the relevant safeguards (section 20).

11. How long we keep information

We keep personal information only as long as we need it for the purposes in section 6, or as the law requires, and then delete it or make it anonymous. When we delete something from our live systems, copies in backups are removed as the backups expire.

12. Deleting information, and taking a copy

In the web app, you can:

• Delete your account (Personal settings → Delete account). We remove your account, sign-in methods, connected AI apps, email preferences and analytics identifier on the timetable in section 11. Updates and files you added to a workspace are that workspace's records and stay with it, shown under your name; to have them removed or anonymised, ask the workspace's Owner, who can ask us. If you are the only Owner of a workspace that has other members, you will be asked to hand it over or delete it first.
• Delete a project (project Managers) or delete a workspace (Owners), with everything in it, after a confirmation. Deleted projects and workspaces are removed on the timetable in section 11.
• Take a copy of a project, or a folder of it, at any point in its history: Download a copy makes a ZIP of the files you can open and the updates you can see.
• Change your name and time zone, turn off FYI emails, and opt out of product analytics.
• Revoke an AI app's access (Connect your AI → Revoke).
• Remove people: project Managers can remove someone's access to a project; workspace Owners and Admins can remove or suspend a member.
• Archive a project (it becomes read-only).
• Delete pages and files in a project. As section 11 says, earlier versions remain in the project's history until the project is deleted or a removal from history is requested.

Ask us (section 15) to remove something from a project's history, for example something added by mistake. We act on requests about workspace content when they come from the workspace's Owner, or from a project Manager for that project.

Copies already downloaded or sent to an AI app cannot be recalled.

13. How we protect information

We use administrative, technical and physical measures suited to the information we hold. They include:

• Encryption in transit: connections to Akagi use HTTPS (TLS 1.2 or later), and browsers are told always to use it. Connections between Akagi's services and its database are encrypted.
• Encryption at rest: Google Cloud encrypts the database, backups, file storage, secrets and logs.
• No stored secrets in readable form: sign-in sessions, renewal codes, download links and similar codes are stored only as one-way hashes; the key that signs AI access passes is held in Google Cloud's key management service.
• Workspace isolation: every workspace's records are separated inside the database itself, so one workspace's requests cannot read another's.
• Access checked on every request: membership, roles, private folders and AI app permissions are checked each time; removing access takes effect within about 5 seconds.
• Private folders and files that are hidden from people without access, wherever Akagi shows information.
• Least privilege: each part of Akagi runs with only the cloud permissions it needs; secrets are kept in Google Cloud Secret Manager with per-secret access; our staff's access to production systems is limited to the people who need it and reviewed regularly.
• Protection at the edge: a web application firewall and rate limits in front of Akagi.
• Careful handling of files and untrusted content: uploaded files are checked and scanned for malware when they arrive and are never run; teammates' text is shown to AI apps as quoted information, never as instructions; actions that delete or widen access need the person's explicit confirmation.
• Logs designed without secrets: tokens, links and file contents are kept out of logs.
• Audit records of access changes, which our application cannot alter.
• Monitoring and alerts for faults and suspicious activity.
• Backups, kept in Australia, with restores tested regularly.

No system is perfectly secure, but we work to keep these measures current and to fix problems quickly. If you find a security vulnerability in Akagi, please report it to security@akagi.work.

14. If something goes wrong: data breaches

We have an incident response plan and keep a record of every security incident involving personal information.

For information we control:

• If we suspect an eligible data breach under Australia's Notifiable Data Breaches scheme, we will assess it quickly, and in any case within 30 days. If it is likely to result in serious harm to anyone, we will notify the Office of the Australian Information Commissioner and the people affected as soon as practicable, saying what happened, what information was involved, and what they can do to protect themselves.
• Where the GDPR or UK GDPR applies, we will notify the competent supervisory authority within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to people's rights and freedoms, and tell the people affected without undue delay where the risk is high.

For workspace content we handle for a customer: we will notify the affected customer organisation without undue delay, and in any case within 72 hours of confirming a breach affecting its data. We will tell it what we know, the likely consequences, the measures we have taken or propose, and a contact for more information, and we will keep it updated as we learn more, so it can meet its own obligations.

15. Your rights and how to use them

Depending on where you live, you may have the right to:

• access the personal information we hold about you, and get a copy (including in a portable format);
• correct it if it is wrong, out of date or incomplete;
• delete it, or restrict how we use it;
• object to our using it on the basis of legitimate interests, including for analytics;
• withdraw consent where we rely on it (for website analytics cookies, use the cookie settings link on akagi.work);
• not be treated differently for using these rights.

In Australia, the Privacy Act 1988, which we have opted in to, gives you the right to access and correct your personal information. You can deal with us anonymously or under a pseudonym where that is practicable; because Akagi is a shared workspace tied to a verified email address, it usually is not.

In the EU, the UK and Switzerland, you have the rights listed above under the GDPR, UK GDPR or Swiss law.

In California and other US states with privacy laws, you may have the right to know what personal information we collect, use and disclose, and to access, correct and delete it. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information for purposes that would give you a right to limit it. The categories of personal information we have collected in the last 12 months are those in section 4: identifiers (name, email address, IP address, account and device identifiers), internet or other electronic network activity (request logs, analytics and how you use Akagi), and professional or employment-related information that you or your organisation put in a workspace. We do not draw inferences to build profiles about you. The sources, purposes and recipients of each category are in sections 4, 6, 8 and 9. You may use an authorised agent; we will ask the agent for proof of authority.

How to make a request. Many things you can do yourself in the web app (section 12). Otherwise, email our Privacy Officer at privacy@akagi.work. We will:

• acknowledge your request within 5 business days;
• verify your identity, usually by confirming the request from the email address on your account;
• respond within 30 days. Where the GDPR applies and a request is complex, we may extend this by up to two further months, and will tell you why within the first month.

We will not charge you unless a request is clearly unfounded or excessive and the law allows a fee. If we refuse a request, we will tell you why and how to complain.

Workspace content. For content we handle for a customer, the customer decides. If you ask us about it, we will pass your request to the customer within 5 business days (unless the law prevents us) and help the customer respond. If you are a member of a workspace and want something about you removed from it, you can also ask the workspace's Owner.

16. Cookies, analytics and browser storage

In the Akagi web app

The web app uses only cookies that are strictly necessary for signing in and keeping you signed in. It uses no advertising or third-party cookies.

All are first-party, sent only over HTTPS, and not readable by scripts on the page.

Product analytics. The web app sends PostHog a record when you use a feature (for example "made a project" or "connected an AI app"), with a pseudonymous identifier that is not your name or email address. It does not record what you type or see: no page or file content, names, titles, reasons, notes, search terms or email addresses, no recordings of your screen or sessions, and no automatic capture of page text. It stores nothing on your device: the identifier is held only while the page is open. You can opt out in Personal settings.

Browser storage. The web app keeps a few things in your browser's own storage, which never leaves your device unless you save it: unsaved edits to a page (dropped after 7 days), your light or dark theme, which notices you have dismissed, and an invitation you opened before signing in.

On akagi.work

When you first visit, we ask whether you agree to analytics cookies.

• If you agree, PostHog sets a first-party cookie (named ph_ followed by our project key, ending _posthog) that recognises your browser on later visits, for up to 1 year. Alongside the cookie, it also keeps an identifier in your browser's local and session storage.
• Until you choose, nothing is recorded. The page still loads PostHog's settings, so PostHog sees your IP address, as any website you visit does.
• If you decline, PostHog counts your visit without cookies. The only thing kept on your device is a note of your choice, so we don't ask again. It works out a visitor count from a one-way code made from your IP address, browser details and a random value that changes every day, so it cannot recognise you from one day to the next, and your IP address is not stored.

You can change your choice at any time with the cookie settings link at the foot of akagi.work. We honour your browser's Do Not Track and Global Privacy Control signals as a "decline".

17. Children

Akagi is a work tool for organisations. It is not directed to children, and people under 18 may not use it. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

18. Changes to this policy

We will update this policy when Akagi or the law changes. We will change the version and the date it takes effect, shown at the top of this page, and for material changes we will tell account holders by email or in the web app at least 30 days before the change takes effect, and tell customers in line with our Data Processing Agreement. Earlier versions are available on request.

19. Complaints

If you have a concern about how we handle your personal information, please contact our Privacy Officer first (section 20). We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied, you can complain to a regulator:

• Australia: the Office of the Australian Information Commissioner (OAIC), oaic.gov.au, 1300 363 992.
• European Economic Area: the data protection authority in the country where you live or work, or where the issue happened.
• United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk.
• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).
• United States: your state's attorney general or privacy agency, such as the California Privacy Protection Agency.

20. Contact us

Nakatomi Pty Ltd, ABN 21 623 035 601
Level 1, 171 William Street, Darlinghurst NSW 2010, Australia

Privacy Officer: Sarah Choo, privacy@akagi.work
General help: support@akagi.work
Security vulnerabilities: security@akagi.work