Privacy Policy

Airrand · Effective April 2026 · Beta

Airrand ("we", "us", "our") is a beta product operated by Airrand LLC. This policy explains what data we collect, how we use it, and your rights.

Google API Services User Data Policy: Airrand's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

1. What We Collect

We collect the minimum data needed to operate the service:

Account data: your email address and name when you sign in.
Integration credentials: OAuth access tokens and/or API keys for third-party services you connect. These are encrypted at rest using AES-256-GCM and never shared with third parties.
Usage data: agent runs, automation logs, tool call history, and AI model interactions, used to operate and improve the service.
Technical data: IP address, browser type, and timestamps for security and debugging purposes.

2. How We Use It

To provide and operate Airrand.
To run AI agents and scheduled automations on your behalf using the integrations you authorize.
To troubleshoot errors and improve reliability.

We do not sell your data. We do not use your data to train AI models without your explicit consent. We do not use Google user data for advertising or to serve ads.

3. Google API Data — Limited Use

When you connect a Google service, Airrand accesses your data only to perform actions you explicitly request through agents and automations. Access is limited to the specific data needed for each connected service. We do not share Google user data with third parties, use it for purposes unrelated to the service you connected, or use it to develop, improve, or train generalized AI models.

The following describes what data each current Google integration accesses and how it is used:

Gmail

Scopes: gmail.modify, gmail.compose, gmail.settings.basic. Used to read, search, send, draft, label, and manage emails on your behalf when you instruct an agent to do so. Email content is processed transiently to complete the requested action and is not stored beyond what is necessary for logging the agent run.

Google Drive

Scope: drive. Used to read, create, update, and organize files in your Drive when you instruct an agent to do so. File content is processed transiently to complete the requested action and is not stored beyond the agent run log.

Google Sheets

Scopes: spreadsheets, drive. Used to read and write spreadsheet data when you instruct an agent to do so. Spreadsheet content is processed transiently to complete the requested action.

Google Docs

Scopes: documents, drive. Used to create, read, and edit documents when you instruct an agent to do so.

Google Slides

Scopes: presentations, drive. Used to create, read, and edit presentations when you instruct an agent to do so.

Google Calendar

Scope: calendar. Used to create, read, update, and delete calendar events on your behalf when you instruct an agent to do so.

Google Forms

Scopes: forms.body, forms.responses.readonly. Used to create forms and read form responses when you instruct an agent to do so.

Google Analytics

Scope: analytics.readonly. Used to read analytics reports when you instruct an agent to do so.

Google Search Console

Scope: webmasters. Used to read search performance data and manage sitemaps when you instruct an agent to do so.

Google Ads

Scope: adwords. Used to read and manage your Google Ads account when you instruct an agent to do so.

Google Business Profile

Scope: business.manage. Used to manage business listings, reviews, and posts when you instruct an agent to do so.

4. Revoking Google Access

You can revoke Airrand's access to your Google account at any time by removing the integration in the Airrand app, or by visiting your Google Account permissions page and revoking Airrand's access. Upon revocation, we delete the stored access and refresh tokens for that integration.

5. Microsoft Graph API Data

When you connect a Microsoft service, Airrand accesses your data only to perform actions you explicitly request through agents and automations. Access is limited to the specific data needed for each connected service. We do not share Microsoft user data with third parties or use it for purposes unrelated to the service you connected.

The following describes what data each Microsoft integration accesses and how it is used:

Outlook Mail

Scopes: Mail.ReadWrite, Mail.Send, MailboxSettings.ReadWrite. Used to read, search, send, draft, and manage emails on your behalf when you instruct an agent to do so. Email content is processed transiently to complete the requested action and is not stored beyond what is necessary for logging the agent run.

Outlook Calendar

Scope: Calendars.ReadWrite. Used to create, read, update, and delete calendar events on your behalf when you instruct an agent to do so.

Outlook Contacts

Scope: Contacts.ReadWrite. Used to read, create, and update contacts when you instruct an agent to do so.

OneDrive

Scope: Files.ReadWrite.All. Used to read, create, update, organize, and share files in your OneDrive when you instruct an agent to do so. File content is processed transiently to complete the requested action and is not stored beyond the agent run log.

Excel Online

Scope: Files.ReadWrite.All. Used to read and write Excel workbook data (ranges, tables, sheets) stored in OneDrive when you instruct an agent to do so.

SharePoint

Scopes: Sites.ReadWrite.All, Files.ReadWrite.All, Lists.ReadWrite.All. Used to browse, upload, download, move, and manage files in SharePoint document libraries, and to read and write SharePoint Lists, when you instruct an agent to do so.

Microsoft Teams

Scopes: Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Read.All, ChannelMessage.Send, Chat.ReadWrite, ChatMessage.Send. Used to read and send messages in Teams channels and chats when you instruct an agent to do so.

Microsoft Clarity

Authentication: API key. Used to read behavior analytics data (heatmaps, session recordings, and dashboard metrics) from your Clarity projects when you instruct an agent to do so. No OAuth token is stored — only the API token you provide.

6. Revoking Microsoft Access

You can revoke Airrand's access to your Microsoft account at any time by removing the integration in the Airrand app, or by visiting your Microsoft Account permissions page and revoking Airrand's access. Upon revocation, we delete the stored access and refresh tokens for that integration.

7. Canva

When you connect Canva, Airrand accesses your Canva account only to perform actions you explicitly request through agents and automations.

Scopes: design:content:read, design:content:write, design:meta:read, asset:read, asset:write, folder:read, folder:write, comment:read, comment:write, brandtemplate:meta:read, brandtemplate:content:read, profile:read. Used to read and manage your designs, assets, folders, brand templates, and comments when you instruct an agent to do so. Design content is processed transiently to complete the requested action and is not stored beyond the agent run log.

You can revoke Airrand's access to your Canva account at any time by removing the integration in the Airrand app, or through your Canva connected apps settings.

8. Third-Party Integrations (Other)

Airrand also supports integrations with services such as Slack, Meta Ads, HubSpot, Salesforce, Stripe, and many others. When you authorize an integration, we store either an encrypted OAuth token or an encrypted API key to act on your behalf. You can revoke access at any time by removing the integration in the app or revoking access directly in the third-party service's settings.

9. AI Models

Airrand uses large language models to power agents, including models from Anthropic (Claude), OpenAI (GPT), Google (Gemini), and xAI (Grok). The specific model used depends on your configuration. AI outputs may be inaccurate, incomplete, or unexpected. We are not responsible for actions taken based on AI-generated content. See our Terms of Service for more detail.

10. Cookies & Analytics

Airrand uses a small number of cookies and similar technologies:

Essential cookies: we set a session cookie (af_sid) to keep you signed in. This is required for the service to function and cannot be disabled.
Analytics cookies: our public marketing pages use Google Analytics 4 (measurement ID G-5LKN601V46) to understand aggregate, anonymized site traffic. Google Analytics sets cookies such as _ga and _ga_* to distinguish visitors and measure usage.
Advertising cookies: where we run paid advertising, the Google Ads tag (AW-18423315727) records that an ad we paid for led to a signup or a subscription, and sets cookies such as _gcl_* to hold the click identifier. This is conversion measurement for our own campaigns. We do not sell your data, we do not build advertising profiles, and we do not use it to target you on other sites. This is a separate category from analytics and you can accept one without the other.
Local storage: within the app, we use your browser's local storage to remember preferences such as theme and to keep you signed in. This stays on your device and is not used for tracking.

How we ask depends on where you are. On your first visit we show a cookie banner with equally prominent options to accept or reject. Analytics and advertising are listed separately, and you can accept either, both, or neither.

If you are in the European Economic Area, the United Kingdom, or Switzerland: both are off until you turn them on. No Google script is loaded and no _ga or _gcl_* cookie is written unless and until you accept.
Everywhere else: both start when you arrive, and the banner lets you reject either. If you reject, we stop collecting immediately and delete the cookies for that category already on your device.

We determine your region from the country your network connection resolves to (supplied by our CDN, Cloudflare). If we cannot determine it, we treat you as if consent were required and load nothing until you accept.

Essential cookies and local storage are always on, because the Service cannot function without them.

You can change or withdraw your choice at any time — in any region — using the Cookie settings link in the footer of any page. We also honor the Global Privacy Control (GPC) browser signal as a standing rejection, everywhere: if your browser sends GPC, we never load analytics or advertising and never show you the banner, regardless of your region.

You can also control or block cookies through your browser settings, or install the Google Analytics Opt-out Browser Add-on. For more on how Google uses data, see Google's policy. We do not use cookies for cross-context behavioral advertising, and we do not sell or share personal information as those terms are defined under the CPRA.

11. Data Retention

We retain your data for as long as your account is active. You may request deletion of your account and associated data by contacting us at [email protected]. Google user data obtained via OAuth is deleted when you remove the integration or delete your account.

12. Security

Credentials and tokens are encrypted at rest using AES-256-GCM. We use HTTPS for all data in transit. As a beta product, security is taken seriously but no system is perfect — use at your own risk.

13. Contact

Questions? Email us at [email protected].