Privacy Policy
Midnight Teams · midnightteams.com
Last updated: 29 September 2026
This policy explains what Midnight Teams collects, why, who else receives it, and what you can do about it. It covers three groups of people:
- Customers: you signed up and run an AI team in Midnight Teams.
- Visitors: you chatted with a customer's Support teammate on their website, WhatsApp, Slack or email.
- Contacts: a customer's AI team found your public business details while researching prospects, or you appear in a customer's own data.
If you're a visitor or a contact, the customer decides what happens to your data, and we process it for them. See Visitors and contacts.
Who we are
Midnight Teams is operated by Initiators Media, Noida, Uttar Pradesh, India ("we", "us").
- Privacy questions: privacy@midnightteams.com
- Grievance Officer (India): Manish Singh, privacy@midnightteams.com. We acknowledge complaints within 48 hours and resolve them within 30 days.
What Midnight Teams does
You give Midnight Teams your website and, if you choose, access to accounts such as Google Search Console or Meta Ads. AI teammates (Chief of Staff, Marketing, Content, SEO, Sales, Support and others) then plan and do work for your business: audits, content, research, prospect lists, email drafts, campaign plans and customer support. Nothing leaves Midnight Teams without your approval. Teammates draft; you approve, send or publish.
What we collect from customers
| Data | Why | How long we keep it |
|---|---|---|
| Name, email address, login credentials | To create and secure your account | Until you delete the account |
| Workspace settings: teammates, schedules, approval rules, daily limits | To run your team the way you set it up | Until you delete it |
| Your company brief, and pages we crawl from your website | So teammates understand your business | Until you delete it |
| Work in your workspace: missions, comments, chat, memory, documents, email drafts, leads, campaign plans, files you upload | This is the product | Until you delete it |
| Data from accounts you connect (for example Search Console, GA4, Google Ads, Meta Ads) | So teammates can report on and improve your results | Read when a teammate needs it; the results it writes into your workspace are kept until you delete them |
| Your Telegram chat ID, if you link Telegram | To send you approvals and updates | Until you unlink it |
| Billing contact and subscription status | To charge you and apply your plan | As long as tax and accounting law requires |
| Usage records: runs, tokens, credits used | To bill accurately and show your usage | As long as tax and accounting law requires |
| Your own Anthropic API key, if you bring one | To run your teammates on your account | Stored encrypted; deleted when you remove it |
If you join the waitlist, we keep the email address, name, company and website you give us, so we can invite you and understand who is interested. We don't store your IP address with it. We keep it until you sign up, ask us to remove it, or 12 months after launch, whichever comes first.
Visitors and contacts
Visitors. When someone talks to a customer's Support teammate, we process the following on that customer's instructions: the messages on both sides, any contact details the visitor gives, channel identifiers (such as a WhatsApp number or Slack user ID), and their IP address, which is used only for rate limiting and kept for at most one hour. The widget sets no advertising or analytics cookies.
Contacts. When a customer asks their Sales teammate to research prospects, it collects business contact details from public sources: name, role, company, business email and public profiles. It stores them in that customer's workspace. The customer decides whether to contact anyone, and must have a lawful basis for doing so.
In both cases the customer is the controller and we are the processor. Contact the customer first. If you can't identify or reach them, write to privacy@midnightteams.com and we'll pass your request on or help directly.
Google user data
If you connect a Google account, Midnight Teams asks only for the access it needs, for example read-only access to Search Console and Google Analytics. We use this data only to show you, and your teammates, your own results and to recommend improvements inside your workspace.
Midnight Teams' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We don't sell Google user data, and we don't use it for advertising.
- We don't use Google user data to develop, improve or train general AI or machine-learning models.
- People at Midnight Teams don't read your Google data, except when you ask us to (for example for support), when it's needed for security, or when the law requires it.
- We transfer Google user data only to the providers needed to run the feature you asked for, listed below.
You can disconnect Google at any time from the Integrations page, or from your Google Account permissions.
What we don't do
- We don't train AI models on your data. Your workspace data is used only to do your work.
- We don't sell personal data or share it for advertising.
- We don't read your workspace, except to fix a problem you report, to investigate abuse or a security issue, or when the law requires it.
- Teammates don't send email, publish, spend money or change your ad accounts on their own. Those actions need your approval. If you switch on auto-approval for low-risk items, the rules you set decide what goes through.
Who else receives data
These providers process data so Midnight Teams can work. Each is bound by contract to use it only for that purpose.
| Provider | What it does | What it receives |
|---|---|---|
| Anthropic | Runs the AI teammates (Claude models) and the isolated workspaces they work in | The instructions, workspace content and connected-account data a task needs |
| Google (Gemini API) | Support teammate answers and search over your content | Visitor messages and relevant passages from your content |
| Supabase | Database, sign-in and file storage | All account and workspace data |
| Vercel | Hosts the website and dashboard | Request information and server logs |
| Railway | Hosts the chat and background services | Request information and server logs |
| Composio | Connects and refreshes the third-party accounts you link | The access tokens for those accounts, and the requests teammates make through them |
| Firecrawl | Crawls websites you ask us to read | The web addresses and the page content returned |
| Upstash | Rate limiting | IP addresses, kept for at most one hour |
| Resend | Account and notification email | Your email address and the message |
| Dodo Payments | Subscription billing | Billing contact and payment details, handled by the provider |
Only if you switch them on: Telegram (approvals and updates), Slack, WhatsApp (Meta), Notion, Cohere (improves search results), and the accounts you connect, such as Google and Meta.
Anthropic processes data under its commercial terms, which don't allow it to train models on that data. If you bring your own Anthropic key, your teammates run under your own agreement with Anthropic.
Where data is processed
Our providers work internationally, so your data may be processed outside your country, including in the United States and India. Where the GDPR applies, these transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
Cookies
The dashboard uses only the cookies needed to keep you signed in and secure. If we ever add analytics or advertising cookies, we'll update this policy and ask for consent where the law requires it.
Your rights
Depending on where you live (for example under India's Digital Personal Data Protection Act 2023, the GDPR, or US state privacy laws), you can:
- see the data we hold about you
- correct it
- have it deleted
- limit or object to how we use it
- get a copy to take elsewhere
- withdraw consent you've given
- name someone to act for you
Customers can do most of this in the dashboard, including exporting and deleting their workspace. For anything else, write to privacy@midnightteams.com. We reply within 30 days. You can also complain to your local data protection authority; in India, that is the Data Protection Board of India.
Deleting your account
When you delete your workspace, we delete its data from our live systems within 30 days, and from backups within a further 30 days. The exception is records the law requires us to keep, such as invoices. We also ask our providers to delete what they hold.
Security
- Data is encrypted in transit and at rest.
- Each workspace is kept separate at the database level, and we test that separation automatically.
- Tokens for connected accounts are stored encrypted.
- Each AI teammate works in an isolated environment that can reach only its own workspace.
If we find a breach that affects your data, we'll tell you and the authorities as the law requires.
Children
Midnight Teams is for businesses and isn't directed at anyone under 18. If you believe a child's data has reached us, write to privacy@midnightteams.com and we'll delete it.
Changes
If we change this policy in a way that matters to you, we'll tell customers by email before the change takes effect.