Privacy Policy

This Privacy Policy explains how Andrew ("Andrew", "we", "us" or "our") collects, uses, shares and protects information in connection with our website at https://agentandrew.ai (the "Website") and our AI operating partner for founders (the "Platform").

You can reach our team at hello@agentandrew.ai. We may update this Privacy Policy from time to time by posting the revised version on this page and updating the "Last updated" date. We encourage you to check this page periodically.

We collect information you provide directly, information generated as you use the Platform, and information from third-party integrations you connect. Depending on how you interact with us, this may include: your name, business email, company name, role and stage; the answers you give us when you apply to the private beta or contact us; and account and profile settings.

When you connect your bank, accounting, payroll, cap table, CRM or other tools, we receive company and financial data from those systems: transactions, balances, invoices, payroll runs, equity holdings, contacts, pipelines, documents and related metadata. We only request the scopes needed to run the workflows you turn on, and where possible we default to read-only access.

We also collect technical information automatically, such as IP address, device and browser type, log data, pages viewed, and general usage of the Platform, to operate, secure and improve the service.

We use information to provide, personalize and improve the Platform, to run the workflows you ask Andrew to perform, to respond to inquiries, to send transactional messages (for example, security alerts, product updates or your Daily Top 5), to detect and prevent fraud or abuse, to comply with legal obligations, and to develop new features.

We do not sell your personal information. We do not use your company or financial data to train foundation models, and we do not share it with model providers to improve their general-purpose models. We use paid, business-tier API access with every model provider we work with, under terms that do not permit your inputs or outputs to be used to train their models. We do not use consumer or free developer tiers for any call that carries your data, because those tiers carry weaker data terms. If a provider changes its terms, we will move the work or stop using that provider rather than send your data under weaker ones.

We also use financial data in aggregate and de-identified form to produce industry benchmarks and research, such as median compensation by role and stage, typical seed and Series A round sizes, or how spending is distributed across categories. No benchmark is shown unless it draws on at least 10 contributing companies, and no figure can be traced back to any single company. This is on by default and you can turn it off at any time in your settings, or by emailing hello@agentandrew.ai. Turning it off does not affect anything else in the product. If you contribute, you can see the benchmarks. Benchmarks are computed by us from aggregated figures, and are never sent to a model provider or used for training.

Financial data — including bank balances and transactions, accounting records, invoices, bills, payroll runs and cap table entries — is treated as your most sensitive information. Access is scoped to the specific integrations you enable, encrypted in transit and at rest, and isolated per company using row-level security in our database.

By default, Andrew reads and organizes this data. Any action that moves money, changes ownership, or writes back to a system of record requires explicit approval from you or an authorized member of your team.

We share information only as needed to run the Platform, with vendors who are contractually bound to protect it. Our current subprocessors are: Anthropic, OpenAI, xAI and Google for model inference; Neon for our managed database; Vercel for application hosting; Cloudflare for file storage; Resend for transactional email; and Apollo for investor and contact research. Each is bound by terms requiring it to protect your data and prohibiting use of it to train general-purpose models. We will update this list as it changes.

We may also share information with our professional advisors, with authorities where required by law, and, in the event of a corporate transaction such as a merger, acquisition or financing, with the counterparty to that transaction under appropriate confidentiality obligations.

If you connect a Google account to Andrew, we access only the data covered by the permissions you grant on Google's consent screen, and only to provide the features you asked for. We use that data to show you what needs your attention and to keep your records current. We do not sell it, we do not use it for advertising, and we do not use it to train any model, including our own. We do not transfer it to anyone except the infrastructure providers listed above who process it on our behalf.

You can disconnect a Google account at any time from your settings. Disconnecting revokes Andrew's access with Google directly and removes the stored credentials, so Andrew can no longer reach your mailbox. Messages we have already synced stay in your account, so you can reconnect later without starting over. To remove them, use Delete mail data in your settings, or email hello@agentandrew.ai and we will remove them for you. You can also review or withdraw Andrew's access from your Google Account permissions page at any time.

Andrew's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We hold two different kinds of information and treat them differently.

Your accounting records — posted journal entries, the documents supporting them, and the audit trail behind them — are your business records. We retain them while your account is active and for as long as tax and accounting law requires, because they are the records you and your accountant may need to rely on.

Everything else we hold to operate the Platform — raw data pulled from connected systems, access tokens, cached transactions not yet posted, and technical logs — is not a business record and is deleted when it is no longer needed to run the service, or sooner on request.

You can delete synced mail yourself from your settings at any time. For anything else, or to delete your account entirely, email hello@agentandrew.ai. We will provide your accounting records to you first, so you keep what you may be required to retain, then remove your data from the Platform and disconnect any linked systems. Where law requires us to keep a copy, we will tell you what and why.

If you close your account, we will contact you about export before removing anything.

We take a defense-in-depth approach to protecting your data. See our Security page for details on data isolation, encryption, passwordless sign-in, infrastructure, least-privilege access and approval-based actions. No system is 100% secure, so please use good judgment about the information you connect and share, and report any suspected security issue to hello@agentandrew.ai.

Andrew is operated from the United States. If you access the Platform from outside the U.S., your information may be transferred to, stored and processed in the U.S. and in other countries where our service providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to certain processing of your personal information, or to request a copy of it in a portable format. You can also opt out of marketing communications at any time using the unsubscribe link in our emails.

To exercise any of these rights, please contact us at hello@agentandrew.ai. We may need to verify your identity before acting on your request. These rights are subject to limitations under applicable law.

We use a small number of cookies and similar technologies to keep you signed in, remember your preferences and understand how the Website and Platform are used so we can improve them. You can control cookies through your browser settings; disabling them may affect parts of the service. We do not use third-party advertising cookies.

The Platform is designed for founders, operators and finance teams and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice (for example, by email or an in-product notice). Your continued use of the Platform after an update means you accept the revised policy.

Questions, requests or complaints about this Privacy Policy can be sent to hello@agentandrew.ai. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.