Privacy Policy

B2B data processing

AirPunch is a business-to-business platform for companies running ambassador and creator programs. When a customer uses the Service to manage information about ambassadors, creators, applicants, or other contacts, that customer is the controller of the personal data and AirPunch processes it on the customer's behalf as a processor. Customers are responsible for providing appropriate notices and obtaining any permissions required for their programs.

Who we are and how to contact us

AirPunch is operated by AirPunch, a small US-focused team. We provide the AirPunch website and the AirPunch Creator Platform. If you have a privacy question or want to exercise your rights, email us at kirill@airpunch.io.

Data we collect

We collect only the information needed to operate the service you choose to use.

Website lead form

When you request a demo online-presence report, we collect the information you submit, such as your name, email address, business name, website, and social-profile links. We use it to produce and follow up on your report.

Accounts and organizations

For platform users, we collect account and organization information such as your name, email address, and organization membership.

Connected services

Connections are optional and are enabled only when you choose to connect or share a service with us. Depending on the connection, we process the following:

• Google Calendar:with read-only access to calendar events plus your basic Google identity and email, we read events on your primary calendar and, if you select them in AirPunch, other calendars from your own Google calendar list. For each event we read its ID and status, start and end time, time zone and all-day flag, title, description, location, video meeting link, the organizer's email, and the attendees' names, emails and response status (for example accepted, declined or tentative), including whether an attendee is you, the organizer, or a meeting room. We use this only for features you see in AirPunch: a short research brief before a meeting (to prepare it, we may also visit the public website of an attendee's company, found from their email domain, and look up that company's public posts on X), your list of upcoming calls, and suggested contacts and meeting history in your AirPunch CRM. We never create, change, or delete calendar events, and we do not read your email.
• Google Drive: if you explicitly share a folder with our service account as a Viewer, we access only that shared folder to transcribe call recordings placed there and draft call notes.
• Google Drive (export): if you choose to export a document to Google Drive, AirPunch requests the drive.file permission, which only lets it create files in your Drive and access files AirPunch created. It cannot see or open any other files in your Drive. You can revoke access at any time at https://myaccount.google.com/permissions.
• Telegram: if you link your own account by QR code or phone login, the assistant can read chats you permit to prepare daily digests and draft replies. You can exclude chats or folders and disconnect at any time. We do not send messages from your account.
• Email via IMAP: using an app password, we receive read-only access to prepare draft replies; we never send those drafts for you.
• X (Twitter): through twitterapi.io using your API key or ours, we collect public posts and public post metrics for accounts on your watchlist.

Technical data

We collect basic logs and IP address information to run, secure, and diagnose the service. We use cookies only for login and session functionality. We do not use advertising trackers.

How we use data

We use data to provide and improve the features you request, authenticate users, maintain accounts and organizations, secure the service, and communicate about your account or report. Every integration is human-in-the-loop: AirPunch prepares material, and you review and send it. We do not sell personal data or use it for advertising.

To provide AI-assisted features, we may send text you ask us to process—such as transcripts, chats, or calendar events—to AI model providers: Anthropic, OpenAI, or Google, or other model hosts that we reach through OpenRouter, an AI routing service. To prepare a meeting brief, the AI model may also run a web search about the companies and people in that meeting. Under our agreements, Anthropic, OpenAI, and Google do not train on that data, and meeting-brief requests sent through OpenRouter are limited to model hosts that do not collect that data.

Google API Services User Data

AirPunch's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google user data only to provide user-facing features that you request. We do not use it for advertising, sell it, or use it to train generalized AI models. Humans do not read Google user data except with your consent, when needed for security, or as required by law.

Storage and security

We host data with Supabase (Postgres) and Vercel. Connection credentials and tokens are stored encrypted using public-key sealing; only the background worker can decrypt them. Access to personal data is limited to the AirPunch team members who need it to operate and secure the service. No security measure is perfect, but we use reasonable administrative and technical safeguards.

Retention and deletion

You can disconnect a connection in the app at any time. When you do, its tokens or sessions are revoked and deleted. You may request deletion of all of your personal data by emailing us. Website lead-form data is retained until you request deletion.

Service providers

We use the following providers to operate the service:

Vercel, Supabase, Anthropic, OpenAI, Google, OpenRouter, twitterapi.io, and Telegram (MTProto API).

Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, and to withdraw consent for a connection. Contact us to make a request. You can also withdraw consent by disconnecting a connected account in the app.

International transfers

We and our providers may process data in the United States and the European Union. By using AirPunch, you understand that your information may be transferred to and processed in these locations.

Children

AirPunch is not intended for anyone under 18, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this policy as our service changes. We will post the revised policy here and update the date above. For related rules on using AirPunch, read our Terms of Service.