This policy explains what OpenScaffold, a product of Sigma AI Software LLC ("we", "us") collects, why, who processes it, and how to have it deleted. Questions go to founders@openscaffold.ai.
What OpenScaffold does
OpenScaffold gives deployment teams, such as forward deployed engineers (FDEs), a coding agent that understands their customer. A team connects its tools: Gmail, Google Drive, Outlook, Slack, Microsoft Teams, Linear, Jira, Confluence, GitHub, Notion, Zendesk, Intercom, Front and Granola. For each customer deployment, the FDE picks which slice of those tools feeds it, for example mail from the customer's domain or one Slack channel. Nothing outside that slice is ingested. FDEs can also upload or paste files (transcripts, ticket exports, emails, notes) into a deployment by hand. OpenScaffold reads that material to build a cited customer profile and plan, and serves it to the FDE's own coding agent (Claude Code, Cursor, Codex or another MCP client) over MCP.
Access is read-only
From Google we request only these scopes: gmail.readonly, drive.readonly, userinfo.email and openid. We never send, delete or modify your mail or files. Access to other connected tools is read-only too.
What we store
- The text of the records that match a deployment's slice, and of files uploaded or pasted by hand (we call these documents).
- Facts extracted from those documents, each with the exact quote it came from.
- Embeddings of the documents, used for search.
- The generated customer profile and plan, including earlier versions.
- Usage logs: the tool calls your coding agent makes, with their ids and search queries.
- Your account details (name, email, workspace membership), held by our sign-in provider.
- Product analytics: the pages you open and buttons you use, session recordings of the app, which agent tools run, errors and server logs, tied to your name and email, and which network your IP address belongs to (looked up with IPinfo). Customer content (plans, profiles, documents, quotes) is masked in recordings and blanked from errors and logs.
We do not hold your OAuth tokens. They are held by our integration provider, Nango. Login tokens for your coding agent are stored only as SHA-256 hashes.
Visitors to openscaffold.ai
On our public site and docs we record the pages you open, where you came from (the referring site and campaign tags), your browser, your IP address and the country it places you in, and a recording of your visit. A first-party cookie and your browser's storage recognise your browser when you come back and count your visits. With each page we also log what your browser sends: language, device type, an approximate location from your IP address, which network that address belongs to (your internet provider, company or a cloud host), and whether it asked not to be tracked. RB2B uses your IP address and cookies to tell us which company a visit comes from (in the US it may also identify the visitor). We use this only to understand who is interested in OpenScaffold.
How we use it
Only to provide OpenScaffold: to build and update each deployment's profile and plan, to let your coding agent search the deployment's material, and to keep the service secure and working. We do not sell your data, we do not use it for ads, and we do not use it to train AI models.
Workspaces are isolated
Each team's workspace is separate. No data crosses customer workspaces. Within a workspace, each agent call sees one deployment at a time. Playbooks, the team's reusable recipes, hold no customer data: every entry is checked by a leak guard before it is saved.
Google user data and Limited Use
OpenScaffold's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide the features you see in OpenScaffold.
- We do not transfer it to anyone except as needed to provide those features (the subprocessors below), to comply with the law, or as part of a merger, acquisition or sale of assets, with notice to you.
- We do not use it for advertising, we do not sell it, and we do not use it to train generalized AI or ML models.
- No human reads it unless you give us consent, it is needed for security (for example investigating abuse), it is required by law, or it is for internal operations on aggregated, anonymized data.
Subprocessors
These companies process data on our behalf, only to run OpenScaffold:
- Vercel: hosting, plus Web Analytics and Speed Insights (pages viewed, referrer, country, device and page load times; no cookies).
- Neon: Postgres database.
- Clerk: sign-in and organizations.
- PostHog: product analytics, session recordings, error tracking and logs (customer content masked).
- IPinfo: tells us which network (internet provider, company or cloud) a visitor's IP address belongs to (the public site and the app).
- Nango: OAuth and syncing from connected tools. It caches synced records.
- RB2B: identifies the companies visiting openscaffold.ai (the public site only, never the app).
- Anthropic models via Vercel AI Gateway: read document text to extract facts and write the plan.
- Voyage AI via Vercel AI Gateway: embeddings.
- Hatchet: background job orchestration.
- Porter on AWS: background workers.
Retention and deletion
We keep a deployment's data until the deployment is deleted. Deleting a deployment deletes its documents, search chunks, extracted facts, plan versions and related records. Disconnecting a tool revokes its access in Nango. To have your data or account deleted, email founders@openscaffold.ai.
Changes
If we change this policy, we will post the new version here and update the effective date above.