Data & permissions
Know what you share. Know what you authorize.
These workflow boundaries describe the evolving experience. Client access and new disclosures need review before broader release. Read the active Privacy Policy for its current scope.
People and shared content
Hosted messaging sends account/profile, contact or invitation details, conversation content and selected attachments to the platform. Authorized participants see content shared in their conversation; check the recipient and participant list.
Accepted hosted content can be read by the service. End-to-end encrypted messaging is not promised. A human message is not automatically an agent request in the private provided-context workflow.
Device storage
Desktop working history, profiles and supported workflow records can be stored locally. Providers may keep their own local files and history. Mobile candidates add protected storage and installation identity; actual OS, backup, export and deletion behavior require device qualification.
Protected storage is not a blanket promise that every cached message or exported file is encrypted or automatically removed.
Work computers and AI providers
A supported authorized request sends selected instructions and context to an eligible online work computer. Its provider receives the input needed for that workflow. Review the exact context and permission scope before requesting work.
Provider credentials stay on the work computer for the supported draft path. A phone login does not grant arbitrary desktop files or commands. Private supplied-context drafting grants no files, shell, browser, connectors or Office tools.
Local project tools have separate permissions and provider configuration. Training, retention and human review differ by provider; check the selected service’s settings and terms.
Call media and notifications
Human Calls route microphone audio through the media service and retain call relationship/state/outcome metadata. AI voice additionally processes intelligible audio and selected authorized context through the voice worker and AI provider; proposed work is a separate reviewable record.
Transport encryption does not establish end-to-end secrecy from media or AI processors. Disabling application recording or transcription does not establish provider retention, processing region or deletion.
Mobile incoming-call candidates use device delivery addresses and expiring call identifiers with APNs/FCM. A push invitation does not start the microphone, and provider acceptance does not prove delivery. Physical background/locked-device behavior remains unqualified.
Service configuration, regions and metadata/proposal retention/export/deletion must be reviewed before broader release. No fixed retention period or Canadian-only processing is promised here.
Separate permissions
Identity sign-in, Gmail authorization, provider authentication, host enablement and microphone consent are separate. A role, website checkbox or legal page cannot broaden an app or connector permission.
The private operator portal is separate from customer access. It supports permissioned operational review, not public sign-in, listening rights or a customer checkout. Contact support through the verified email path.
Changing access and deleting records
Blocking changes a relationship; disconnecting withdraws a connection’s local use; signing out ends a session. Archiving hides supported history without proving erasure. Uninstalling does not establish deletion of hosted records, provider data or backups.
Deletion and export require the applicable reviewed process. Another person’s downloaded copies and provider records are outside a local disconnect action. Do not erase retained execution evidence to clear an unknown outcome.
Ask support@buenhoj.com about support, privacy or the applicable data request process without emailing credentials or private files.