Privacy policy

Information we collect on this website

Information you give us. When you submit the briefing form, we collect your name, work email, company, and any details you choose to share. We use this only to respond to and prepare for that conversation.

Information collected automatically. Like most websites, we collect standard usage data (pages viewed, referring links, approximate location, and device/browser type) to understand how the site is used and which marketing brought you here.

Information we collect on the Platform

When you create a Platform account, we collect your name, email address, and organization. When you connect a third-party service (such as Google Workspace), we store the credentials needed to maintain that connection, described below. We also keep operational records — which tools were called, when, and whether they succeeded — so we can run the service reliably and give your organization an audit trail.

Google user data

If you connect a Google account, the Platform accesses Google services on your behalf, with your explicit consent through Google’s OAuth screen. Depending on which connectors you enable, this may include reading and managing your Gmail messages, reading files in Google Drive, managing your Google Calendar, and reading Google Docs, Sheets, and Slides.

We use this access for one purpose only: to fulfill requests you or your authorized AI tools make through the Platform. Content retrieved from Google is passed through to serve your request — we do not build server-side copies, caches, or indexes of your Google data, and our operational logs record activity metadata only, never the content of your messages or files.

We do not use Google user data for advertising, do not sell it, and do not use it to train machine-learning or AI models. When your request involves an AI model, the relevant content is sent to the model provider solely to complete that request, under terms that prohibit the provider from training on it.

Port of Context’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect sensitive data

• Encryption in transit. All connections between your clients, our services, and Google are encrypted with TLS.
• Encryption at rest. OAuth access and refresh tokens are encrypted with AES-256-GCM before they are written to our database, with encryption keys held in a dedicated secrets manager under least-privilege access. They are never stored in plaintext. Our databases are additionally encrypted at rest by our cloud provider.
• Access controls. Google credentials are scoped to the individual user who granted them and used only for that user’s sessions. Tenant data is isolated at the database level, API access requires authenticated, hashed credentials, and administrative actions are recorded in an append-only audit log.
• Minimal retention of content. Because Google content is not persisted on our servers, the sensitive data we hold is limited to the encrypted credentials themselves.
• Incident response. If we become aware of a breach affecting your personal information, we will notify you promptly and share what we know as the investigation proceeds, consistent with applicable law.

Retention and deletion

You can disconnect any Google connector at any time from your Port of Context dashboard. Disconnecting deletes the stored credentials for that connection immediately. Deleting your account or your organization removes the associated credentials as well. You can also revoke Port of Context’s access directly from your Google Account permissions. Website form submissions are kept as long as needed to follow up and maintain our business records. To request deletion of anything we hold about you, email privacy@portofcontext.com.

Who we share it with

We do not sell your personal information. We share it only with service providers that help us run the website and Platform: our cloud hosting providers (Google Cloud and Vercel), our identity provider (WorkOS), our observability provider (Datadog, which receives operational metadata only), AI model providers when your request routes a model call through us, and the tools that support this website — PostHog (analytics), Google (advertising measurement), and Attio (our CRM, where briefing requests are stored). We may also disclose information where required by law.

Cookies and similar technologies

• Marketing attribution (first-party). A cookie we set (pctx_attr) records the campaign or link that first brought you to the site, so we can measure which marketing works. It expires after about 90 days.
• Product analytics (PostHog). We use PostHog to understand site usage and, on some sessions, to replay interactions so we can improve the experience. Form inputs are masked. We do not record what you type into fields.
• Advertising (Google Ads). We use Google’s tag to measure conversions from ads we run. This may set cookies used for ad measurement.
• Traffic measurement (Vercel Analytics). Privacy-friendly, aggregate traffic stats.

Your choices

You can block or delete cookies in your browser. You can opt out of personalized Google advertising at adssettings.google.com. To access, correct, or delete information you’ve given us, email privacy@portofcontext.com.

Where we operate

Port of Context is operated from the United States, and this site is intended for a US audience. If you access it from elsewhere, you consent to processing in the US.

Changes to this policy

We may update this policy as the site and Platform evolve. We’ll revise the date above when we do. Questions? Email privacy@portofcontext.com.