What we hold,
and what we do with it.
Written to be read rather than skimmed past. Where the honest answer is “it depends on your deployment”, it says so.
1. What we store
Running the product means holding three different kinds of thing.
- What you put in. Documents you write, files you upload or sync, links you save, folder names, comments, custom metadata, and the text extracted from your files so that search and AI answers can work.
- What we need to run an account. Your email address, a password stored only as a scrypt hash, workspace and team membership, and — for each signed-in session — a description of the device and a truncated IP address. We keep the network prefix rather than the full address: the last part of an IPv4 address is zeroed before it is written down.
- A record of what happened. Which AI connection searched or read what, which requests were refused, portal activity, signature audit trails, and document version history. This record is the point of the product, so it is kept deliberately and shown back to you in the workspace.
2. What happens when an AI reads a document
This is the part worth understanding properly, because it is the one place where your content leaves our control.
When you connect an AI client, you choose which folders that connection may read. Permission is resolved on every single request, not cached into a token. A request for anything outside those folders is refused, and the refusal is recorded.
When a request is allowed, the content is sent to the AI provider that asked for it — Anthropic, OpenAI, or whoever you connected. From that moment, that provider’s retention, training and processing policies apply to what they received, not ours. Revoking a connection blocks its next request immediately; it cannot reach back and recall what has already been sent. If you use the built-in answers instead, the same is true of whichever AI provider your workspace has configured in Settings.
The practical advice: check your provider’s settings before you grant a connection access to anything sensitive.
3. Who else is involved
We do not sell your data, and we do not use the contents of your workspace to train any model of ours.
Content reaches other companies in four ways, all of them yours to start:
- AI providers — when you connect one, as described above.
- Cloud storage you connect — Google Drive, Dropbox, OneDrive, SharePoint or Box, for the folders you choose. Two-way sync means your edits are written back to them. The access tokens for these connections are encrypted before they are stored.
- Email and messaging intake — if your workspace routes attachments in from an email address or WhatsApp number.
- Infrastructure — hosting, object storage and email delivery. Which providers these are, and which country they run in, depends on the folders.id deployment you are using. Ask us and we will tell you exactly.
4. How long we keep things
Deleting a file moves it to trash rather than erasing it, so that a mistake is recoverable. Your workspace can set retention policies that clear things out on a schedule, and legal holds that refuse deletion outright while a matter is live — a hold wins over a retention policy, deliberately.
Closing your account removes your workspace content. Records we are required to keep — or that a legal hold covers — are the exception, and we will tell you if that applies to you.
5. Your rights
Indonesia’s Personal Data Protection Law (UU No. 27/2022) gives you rights over personal data about you: to see it, to correct it, to have it deleted, to withdraw consent, and to get a copy of it. You can do most of this yourself inside the workspace — your account settings, the trash, the activity record and the export tools.
For anything you cannot do from the app, write to halo@folders.id and we will handle it.
TODO (counsel): name the data controller entity, its registered address, the appointed data protection officer, the statutory response window, and the supervisory authority a complaint goes to.
6. Keeping it safe
Passwords are hashed with scrypt and never stored in a form we could read. Connector credentials are encrypted at rest. Every request — from a person, a script token or an AI client — is checked against the same permission model, and a credential can never reach further than the person who created it.
Text extracted from your files is screened for prompt-injection patterns and flagged for review. That screening is a signal to look more closely; it is not a guarantee that every malicious instruction is caught, and we would rather say so than imply otherwise.
7. Changes, and how to reach us
If this policy changes in a way that affects you, we will tell you before it takes effect rather than quietly changing the date at the top.
Questions about any of this go to halo@folders.id. You may also want to read Trust & control, which explains the permission model in more practical terms, or the Terms of service.