Legal
Launchbase Privacy Notice
This notice explains how Remotely Works, Inc. handles information when you use Launchbase.
1. Scope
This Launchbase Privacy Notice supplements the Remotely Privacy Policy. It applies specifically to Launchbase, including its Platform, Setbase, Shipbase, and Frontdesk features. If this notice and the general Privacy Policy describe Launchbase data practices differently, this notice controls for Launchbase.
Remotely Works, Inc. ("Remotely," "we," "us," or "our") operates Launchbase. Launchbase lets people authorize software agents to work with workspace data, publish sites, and, when a user chooses, perform operations through connected Google Gmail and Slack accounts.
2. Information we collect
Account and identity information
When you sign in with Google, we receive your Google account subject identifier, verified email address, display name, and, when supplied, hosted-domain identifier. We use the hosted-domain identifier only to enforce an operator-configured Google Workspace domain allowlist. We do not receive or store your Google password.
Workspace and service information
We store information you and authorized agents submit to Launchbase, such as workspace and project names, memberships, collection schemas and records, Guidance, sites and deployment files, invitations, authorization settings, and audit metadata. Workspace members may see the names and email addresses of other active members of that workspace.
Connected-provider information
If you connect Gmail or Slack, we store connection identifiers and display information, the capabilities you approved, encrypted provider credentials, agent assignments, access timestamps, action outcomes, and limited provider-native object identifiers needed for safe retries and audit. Provider credentials are encrypted using AES-256-GCM with keys stored separately from the database.
Operational information
We process request timing, status, normalized route pattern, request identifiers, and cryptographically hashed rate-limit identifiers to operate, secure, and troubleshoot Launchbase. The Launchbase application process does not log raw request paths, request bodies, query strings, access tokens, cookies, provider content, or raw client IP addresses. Infrastructure providers may process network and device information as described in the general Remotely Privacy Policy.
3. Google user data
Google sign-in
Launchbase requests the openid, email, and profile permissions to authenticate you, maintain your account, match invitations, and attribute authorized activity.
Gmail connection
Gmail access is separate from Google sign-in and is optional. A base Gmail connection requests gmail.readonly. If you choose additional capabilities, organize requests gmail.modify, and send requests gmail.send and gmail.compose. Launchbase uses those permissions only to provide user-facing Gmail features that you request through an explicitly assigned agent, such as searching or reading mailbox data, organizing messages, managing drafts, or sending messages.
Gmail message bodies, subjects, snippets, labels, search queries, raw MIME, and attachment contents are processed only for the requested operation. Launchbase does not persist them in its database, logs, traces, or audit records and returns provider-content responses with instructions not to cache them. Content passes through Launchbase and is returned to the agent or MCP client that made the authorized request. That client may retain content under its own terms and privacy practices.
Launchbase does not sell Google user data, use it for advertising, or use it to train generalized artificial-intelligence or machine-learning models. Launchbase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Slack data
Connecting Slack is optional. Launchbase uses delegated user authorization and can act only within the permissions granted to the connecting Slack user. Depending on those permissions and the requested operation, an assigned agent may read or write channel, private-channel, direct-message, search, reaction, pin, or file information available to that user.
Slack message and file content is processed only for the requested operation and is not persisted in Launchbase's database, logs, traces, or audit records. Connection metadata, provider-native object identifiers, access records, and action outcomes may be retained. Before connecting Slack, you are responsible for ensuring that your use and disclosure of other people's communications is lawful and authorized.
5. How we use information
We use information to:
- authenticate users and maintain accounts, sessions, workspaces, memberships, and permissions;
- provide Setbase storage, Shipbase hosting, Frontdesk provider operations, and agent authorization;
- validate, secure, rate-limit, troubleshoot, and improve Launchbase;
- maintain transaction integrity, provenance, and audit records;
- respond to support, privacy, security, and legal requests; and
- comply with applicable law and enforce our agreements.
7. Retention and deletion
We retain account, workspace, content, authorization, provenance, and audit information for as long as reasonably necessary to provide Launchbase, maintain security and transaction integrity, comply with law, resolve disputes, and enforce agreements. Some Launchbase deletions are soft deletions that preserve version history, provenance, or audit records. Backup copies and private orphaned deployment files may remain until their applicable retention cycle expires.
Provider message and file content is not durably stored by Launchbase. Encrypted provider credentials are retained while the connection remains active. Removing a Frontdesk connection deletes its locally stored credentials and assignments, but limited connection, access, action, and audit metadata may remain. Removing a connection does not revoke consent at Google or Slack; you should also revoke Launchbase from the provider's account-security settings.
Launchbase does not currently provide self-service account deletion or a complete account export. To request access, correction, or deletion, email contact@remotely.works. We will evaluate and fulfill verified requests as required by applicable law, subject to legal, security, backup, and integrity exceptions.
8. Your controls
You can review and revoke browser sessions and agent authorizations in Launchbase. Workspace owners control memberships and provider assignments. You can remove or reauthorize a Gmail or Slack connection and independently revoke provider access in your Google or Slack account. Revoking a browser session does not automatically revoke separately issued agent authorizations.
9. Security
We use administrative, technical, and organizational safeguards designed to protect information, including encrypted network transport, encrypted provider credentials, cryptographic hashing of application secrets, private object storage, tenant-aware database controls, short-lived authorization state, restricted service identities, and audit records. No system is completely secure, and we cannot guarantee absolute security.
10. International processing
Remotely is based in the United States. We and our service providers may process information in the United States and other countries whose laws may differ from those where you live. We apply this notice to Launchbase information wherever it is processed.
11. Children
Launchbase is a professional service and is not directed to anyone under 18. We do not knowingly collect personal information from children through Launchbase.
12. Changes to this notice
We may update this notice as Launchbase or legal requirements change. We will publish the revised notice here and update its effective date. When required by law, we will provide additional notice or request consent.
13. Contact us
For privacy questions or requests, contact:
Remotely Works, Inc.228 Park Ave S, PMB 65750
New York, NY 10003-1502
United States
contact@remotely.works