Privacy policy

TandemX ("TandemX", "we", "us") is operated by the company named at the foot of this page. This policy explains what information we collect, why, and the choices you have.

It covers the following services, and the sections below say which one they apply to:

• This website, tandemx.ai.
• DemoX, where you can explore a sample business and try supported work with accounts you choose to connect, at demox.tandemx.ai.
• TandemX and BotX, the employee assistant that works with your requests, files and authorised business information.

You can read this website without an account. There is no sign-in and no checkout on it.

The contact form

If you use the form to discuss your workflow, we receive what you enter: your name, work email, company, role and your description of the work. The form is delivered to us by Web3Forms, a form-handling service. We use it to reply to you and to prepare for the conversation.

Technical data

Like any website, our hosting provider processes technical data needed to deliver pages and keep the service secure, such as IP address, browser type and the pages requested.

Cookies and tracking

If you allow website analytics, we load Microsoft Clarity to understand page visits, clicks and recordings. Enquiry fields are masked; named events contain no form contents. Advertising storage is denied. An anonymous tx_journey cookie shared with demox.tandemx.ai connects this website visit to demo activity only if analytics is also enabled in DemoX. First-party journey events are stored for up to 90 days. Website and DemoX choices are separate; Analytics settings withdraws this website’s collection and removes its stored journey events when the request succeeds. Your choice is stored in this browser for up to 90 days. Hosting security cookies may still be needed.

Try TandemX on a ready-made business, then see what it can do with your own work. DemoX includes fictional sample-business scenarios and supported connected-account features. Sample records are labelled as such; information read from an account you connect is real information from that account.

• Details you give us to start a demo, such as your name, work email and company.
• Requests, conversations, responses, workflow choices and action records needed to run your experience, including messages sent through demonstration mail features.
• Information from accounts you choose to connect, when needed for supported requests. The Google and Microsoft sections below describe these connections.
• What you do in the demo, such as the choices you make and the runs you start.
• Usage analytics, only where you have agreed to them in DemoX’s own settings.

We use this information to provide the experience you request, maintain its history and provide support. Use the supplied fictional records when exploring sample scenarios. For connected-account work, provide only information you are authorised to share and that is needed for the task. Do not put passwords, private keys or other authentication secrets in chat. Optional analytics and sample-demo training sharing are separate choices, described below.

When an employee uses TandemX, BotX processes their requests, conversations, uploaded files and information from the systems they are authorised to connect. Depending on the request and permissions, this can include business documents and records, email, calendar information, and contact details of staff, customers or suppliers.

In that setting the customer decides what is connected and what agents are permitted to do, and we process the data on the customer’s behalf under our agreement with them. If you are an employee, customer or supplier of a company that uses TandemX, that company is your first point of contact for requests about your data.

TandemX uses AI models to read requests, draft replies, classify documents and plan work. To do this, relevant content is sent to third-party AI model providers and processed on our behalf.

We do not use connected-account content to train general-purpose AI models. Processing your request with a model, and keeping the conversation or work history needed to continue it, are separate from model training. Model providers process the relevant content under the terms and settings of the service used; this policy does not promise that every provider has zero retention.

Optional sample-demo sharing

DemoX has a separate, optional choice to share sample-demo inputs and decisions for future model training. It is off by default and is not required to use DemoX. Use only fictional sample information for this choice. BotX conversations, including replies based on connected accounts, are excluded from this optional observation collection. Turning the choice off removes this browser’s optional training records from the collection database; contact privacy@tandemx.ai about records already exported. A customer agreement may impose stricter limits.

DemoX BotX can connect to your own Google account if you choose. The consent screen identifies the requested permissions: read Gmail (gmail.readonly), send email as you (gmail.send), view and edit calendar events (calendar.events), and view and manage Google Drive files (drive), plus your email address. These permissions can be broader than the reads and actions currently supported by the interface. Availability depends on the connection and permissions granted; connecting an account is separate from signing in to DemoX.

• What we access: your Google account email address; the sender, subject, date and text of recent inbox messages (at most 10 per request); your calendar events for the next 14 days; and the names, links and, for up to three recent Google Docs, the text of your recently changed Drive files.
• When we access it: when BotX identifies a request about your email, schedule or documents. It can also read your upcoming calendar when answering a Drive-related request. Access is bounded by the permissions granted; the current connection does not continuously mirror your account.
• Actions on your behalf: BotX can send an email, create or change a calendar event, or save a file to your Drive only when you ask. It first shows you the exact recipients, subject and text, event details, or file, and acts only after you confirm. It never sends, changes or deletes anything automatically, and it never deletes email, events or files.
• How we use it: only to answer or carry out your request, for example to show what needs your attention, plan around your meetings, find a document, or send the email you approved.
• AI processing: to answer, the relevant parts of that data are sent to the AI model providers that process requests on our behalf. A model may also be used only to decide which messages are relevant to your request.
• What we store: encrypted connection credentials, your Google address, your requests, BotX replies, selected message references and confirmed-action details and result links. Conversation and action records can contain quoted, summarised or generated content from your account. We do not maintain a separate full copy of your mailbox, calendar or Drive.
• Sharing: we do not sell Google user data or use it for advertising. We share it only with the providers that process it to answer you, or where the law requires.
• Human access: people at TandemX do not read your Google data unless you ask us to for support, it is needed for security or abuse investigations, or the law requires it.
• Model training: we do not use Google user data to develop, improve or train generalised AI or machine-learning models. It is excluded from optional sample-demo training observations.
• Removing access and data: disconnect Google on the BotX Connectors page to remove the stored connection credentials. DemoX also requests revocation at Google; you can independently remove TandemX in your Google Account permissions. Disconnecting does not erase existing conversations or confirmed-action records. To request their deletion, contact privacy@tandemx.ai; we handle the request subject to applicable legal retention requirements.

TandemX’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You may choose to connect a Microsoft work or school account. The current DemoX Outlook connection requests your account profile, offline access and permission to read mail. It reads up to 10 recent inbox messages to answer supported email requests; it does not grant Outlook sending through this connection. Separate Microsoft 365 or Dynamics read-preview connections use the permissions shown for that product. A connection label does not mean that every Microsoft application or OneDrive action is supported.

Relevant message text and metadata may be sent to the AI services used to answer your request. Connection credentials are stored encrypted. Your requests, responses and selected message references can remain in conversation history. Connected Microsoft content is excluded from optional sample-demo training observations and is not used by us to train general-purpose models.

Disconnecting Outlook or a Microsoft read connection removes the stored connection from DemoX; it does not by itself delete conversation history or guarantee revocation of the application grant in Microsoft. You or your organisation’s administrator can remove that grant in Microsoft’s account or application settings. Contact privacy@tandemx.ai to request deletion of retained conversation or action records.

• Account information, such as your name, email address, company and workplace role.
• Authentication information and connection credentials needed to maintain access you have authorised.
• Messages, files and other information you give BotX, its responses and generated files, and records of work or actions you request.
• Where you choose a configured bank or customer-payment feature: institution and account identifiers, transaction and invoice details, payment references and status, and connection credentials needed for that feature. A provider’s sandbox uses test information; a live connection uses real financial information. Bank-provider consent and payment screens identify the access or transaction requested.
• Permissions and work shared with colleagues, according to the access and sharing choices in your workplace.
• Technical information needed to operate and secure the service, such as device and browser type, IP address, usage records and error logs.

Connecting an external service does not give everyone in your workplace access to your account. Access and actions depend on the permissions you grant and the sharing choices you make. Service-specific disclosures, including the Google section above, apply to information from those services.

• To provide the service you asked for and keep it working.
• To reply to enquiries and provide support.
• To send service notices and, where permitted by applicable law and your communication choices, relevant marketing. You can opt out of marketing.
• To detect and prevent fraud and security threats.
• To maintain audit trails and meet legal obligations.
• To improve our products, as described under "How AI is involved".

We use third-party providers to run our services. The providers involved depend on the feature and configured connection; relevant content may pass through an AI gateway or routing service as well as the model provider. Their applicable service terms, data-processing terms and settings govern their handling of that data.

Hosting and infrastructure

• Cloudflare (hosting, databases, DNS, content delivery and file storage)
• Google Cloud

Forms and communication

• Web3Forms (website contact form)
• Gmail API and Microsoft Graph (connected email and workplace services)

Bank and customer-payment features

• Plaid or Lean, where the relevant bank-feed or payment feature is configured and you choose to use it. Sandbox and live availability depend on the feature; listing a provider does not mean a live bank connection is enabled.

AI and data services

• AI model and routing services, including Google Vertex AI, OpenAI models through configured gateways, Cloudflare Workers AI and, where configured, OpenRouter or Typesafe for model routing or classification
• Microsoft Clarity (website or DemoX analytics, only with the separate consent for that service)

• Cloudflare hosts application data and serves content through its global network. AI, communication and other providers may process information in other countries. We do not promise a single storage or processing country unless a separate agreement expressly provides it.
• Our hosting services provide encryption in transit and at rest. Google and Microsoft connection credentials are additionally encrypted by the application.
• Access depends on the account, workspace and permissions for the feature. Google and Microsoft connections use OAuth; other supported integrations may use separately supplied credentials.
• No service can guarantee absolute security. Contact privacy@tandemx.ai for questions about the controls or data-processing terms needed for your organisation.

If there is a breach

If a personal-data breach requires notification, we will notify the affected customer, individuals or relevant authorities as applicable, without undue delay and within the deadlines required by applicable law. The notification duties and deadlines depend on our role and the circumstances.

We do not sell your personal information. We share it only in these cases:

• With the service providers listed above, to operate our services.
• When required by law, a court order or a regulator, or to protect our rights, safety or property.
• In a merger, acquisition or sale of assets, where information may transfer to the acquiring entity.

• Website enquiries: for as long as needed to respond and to maintain our relationship with you.
• Account information, conversations, uploaded information, workflow and action records: while needed to provide your account and work history, or until a deletion request is completed, subject to applicable legal obligations and any customer agreement. Disconnecting a provider or cancelling paid access does not automatically erase these records.
• Security, billing and audit records: for the period needed for security, accounting, legal obligations or resolving disputes. We do not promise that every record has the same retention period.
• First-party optional DemoX analytics and sample-training observations, and website-to-demo journey events: up to 90 days under the current collection settings. Microsoft Clarity and other providers apply their own retention terms and settings.
• Optional sample-training sharing: withdrawing consent removes this browser’s optional training records from the collection database. Previously exported copies require a separate removal request. We do not claim that these records are anonymous or retained indefinitely.

• Ask for a copy of your personal data, including an export in a standard format.
• Ask us to correct or delete it, or to restrict how we process it.
• Opt out of marketing messages.
• Manage optional analytics and sample-demo training sharing in Demo data settings, or contact us about exported optional records.
• Disconnect connected accounts and manage the information and work you share with colleagues.

To exercise these rights, email privacy@tandemx.ai. We may need to verify your identity and authority over the information requested. We respond within applicable legal time limits and explain any permitted extension or lawful reason we cannot fulfil a request. You may also complain to the data-protection authority responsible for your location.

California

California residents have the right to know, delete and opt out of the sale of personal information. We do not sell personal information as defined under the CCPA.

European Economic Area

EEA residents have rights of access, rectification, erasure, restriction, portability and objection. Our legal bases for processing are performance of a contract, consent, legitimate interests and legal obligations.

Our services are for adult business users aged 18 or over, as stated in our Terms. They are not directed at children. If you believe a child has provided personal information, contact privacy@tandemx.ai so we can investigate and arrange appropriate removal.

We may update this policy. We will post the new version here with a new date, and tell you about material changes by email or in the product where we have a way to reach you.