Buttons

Privacy Policy

Last updated: 8 July 2026

This Privacy Policy explains how Autono Holdings Inc. ("Buttons", "we", "us") collects, uses, stores, and shares information when you use the Buttons platform at buttons.sh and desk.buttons.sh (the "Service"). Buttons lets you create and operate AI agents that act on your behalf across the tools you connect, including Google services.

Information we collect

Account & identity. When you sign in with Google we receive your name, email address, profile picture, and a Google account identifier, via our authentication provider (Clerk).
Google user data you authorize. With your explicit consent on Google's permission screen, the Service accesses data from Google APIs to perform the tasks you direct your agents to do (see below).
Usage & operational data. Logs, device/browser information, and records of actions your agents take, used to operate and secure the Service.

Google user data we access, and why

We request only the Google scopes needed for the features you use. Depending on the permissions you grant, this may include:

Google Calendar (calendar, calendar.events, read-only variants) — to read, create, and manage events at your direction.
Gmail (gmail.readonly) — to read and summarize messages when you ask an agent to act on your mail.
Google Drive (drive) — to read, create, and organize files and folders on your behalf.
Docs, Sheets, Slides (documents, spreadsheets, presentations) — to read and edit documents you ask an agent to work on.
Contacts & profile (contacts, contacts.other.readonly, user.emails.read, user.phonenumbers.read, user.organization.read) — to look up people and details needed to complete tasks (e.g., addressing an email or invite).

We access this data only to provide the features you request. We do not access Google data for any purpose you have not enabled, and you can revoke access at any time (see "Your choices").

Limited Use disclosure

Buttons' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We use Google user data only to provide and improve user-facing features of the Service.
We do not use Google user data to train, develop, or improve generalized or standalone AI/ML models, and we do not transfer it to models that do.
We do not sell Google user data, and we do not use it for advertising.
Humans do not read your Google user data except with your affirmative agreement for specific messages, as necessary for security or to comply with law, or where the data is aggregated/anonymized for internal operations, as permitted by the policy.

How agents process your data

To carry out a task you direct, the Service passes the minimum necessary content to the large-language-model provider you select for your agent (for example, Anthropic or OpenAI). We integrate these providers under agreements that prohibit using your content to train their models and that use zero-data-retention processing where the provider supports it. We do not retain Google content longer than needed to complete the task and maintain the Service.

Sub-processors

We share data with service providers acting on our behalf, only as needed to run the Service:

Clerk — authentication and session management.
Cloudflare — hosting, storage, and network security.
Pipedream — connector infrastructure for third-party integrations.
The model provider you select (e.g., Anthropic, OpenAI) — model inference, under no-training terms.

We do not sell your personal information or Google user data to anyone.

Storage, security & retention

Data is stored on Cloudflare infrastructure and protected in transit (TLS) and at rest. OAuth tokens are held securely and used only to make the API calls you authorize. We retain account data while your account is active and Google-derived content only as long as needed to provide the Service, then delete or anonymize it. Retention periods: operational logs are kept for 30 days; Google-derived task content is deleted within 24 hours of task completion; account data is retained until you delete your account.

Your choices

Revoke Google access at any time at myaccount.google.com/permissions.
Delete your account and associated data by contacting us at bobak@autono.co.
Access, correct, or export your data — email us and we will respond consistent with applicable law (including GDPR/CCPA where relevant).

Children

The Service is not directed to children under 13 (or the age required by your jurisdiction), and we do not knowingly collect their data.

Where we operate

The Service is intended for users in the United States and is not offered to individuals in the European Union or the United Kingdom. We process data in the United States and other locations where our providers operate; by using the Service you consent to this processing.

Changes

We may update this policy; material changes will be posted here with a new "Last updated" date and, where required, notified to you.

Contact

Autono Holdings Inc. — bobak@autono.co — 8240 Byron Ave, Miami Beach, FL 33141.