Lieutenant Privacy Policy

Effective date: September 14, 2026

This Privacy Policy explains how Lieutenant, Inc. ("Lieutenant," "we," "us") collects, uses, shares, and protects information when you visit lieutenants.io, use the Lieutenant platform, or connect other services to it.

1. Who this policy covers

Website visitors: people who browse lieutenants.io, request access, or book a call.
Customers and their users: businesses that subscribe to Lieutenant, and the people those businesses authorize to use it.
People whose information appears in a customer's business data: for example, vendors, customers, or employees named in a customer's invoices, emails, or files.

When we process a customer's business data, we do so on that customer's behalf and under our agreement with them. If you are a customer's vendor, customer, or employee, please contact that business with questions about its data.

2. Information we collect

Information you give us

Name, work email, company, and phone number when you request access, book a call, or create an account.
Messages you send us.

Account and sign-in information

Sign-in details handled by our authentication provider, and the role your business assigns you in Lieutenant.

Business data from services you connect

With your authorization, Lieutenant connects to services your business uses and reads (and, where you allow it, writes) business data, which may include:

Accounting: QuickBooks records such as bills, invoices, payments, and journal entries.
Banking and payments: transactions and balances (via Plaid or files you upload).
Point of sale, payroll, and HR: sales, labor, and payroll data (for example Toast, or payroll providers via Finch).
CRM: accounts, contacts, opportunities, and activities (for example Salesforce).
Email and files: messages, attachments, and documents from Google Workspace (Gmail, Google Drive) or Microsoft 365 (Outlook, OneDrive, SharePoint). See Section 4 for Google data.
Meetings and messaging: meeting transcripts (for example Fireflies), and messages exchanged with Lieutenant over Slack, Microsoft Teams, Telegram, SMS, WhatsApp, or voice.

Usage and technical information

Logs of activity in the platform, including actions agents take, approvals, and an audit trail.
Device, browser, and IP address information when you use the website or platform.

Website analytics

We use Google Analytics and Origami to understand website traffic, referral sources, and business interest. These tools may process IP address, browser and device information, referring pages, pages viewed, and website interactions. Origami is used to identify businesses that may be visiting the website; it is not used by Lieutenant to identify individual visitors by name.

3. How we use information

We use information to:

Provide the Lieutenant service, including AI agents that perform finance tasks for your business, such as reading bills, reconciling transactions, drafting and sending messages, preparing reports, and forecasting cash.
Route actions for approval by authorized people at your business, and keep an audit trail of what was done and by whom.
Secure, maintain, troubleshoot, and support the service.
Communicate with you about your account and the service.
Meet legal obligations.

We do not sell personal information, and we do not use customer data for advertising.

4. Google user data

This section describes how Lieutenant handles information received through Google APIs when your business connects a Google Workspace account.

What we access, and why

Google permission	What Lieutenant does with it
Read Gmail messages and settings (`gmail.readonly`)	Reads messages and attachments in the connected mailbox to find bills, invoices, payment requests, and other finance-related correspondence, and gives the agents working for your business the context of an email thread.
Send email on your behalf (`gmail.send`)	Sends messages from the connected mailbox, such as invoice follow-ups and vendor correspondence, when an authorized person at your business approves them or a rule your business configured allows it.
View and manage Google Drive files (`drive`)	Reads documents your agents need, and creates or edits files they produce for your business, such as reports, reconciliations, and month-end close packets.

How we use it. We use Google user data only to provide and improve the user-facing features described above. We do not use it for advertising, we do not sell it, and we do not use it to determine creditworthiness or for lending.

AI and model training. Lieutenant uses AI models to process Google user data so the agents can perform the tasks above. We do not use Google user data to create, train, or improve generalized or non-personalized AI or machine learning models.

Sharing. We share Google user data only with service providers that help us run these features (such as our cloud hosting and AI model providers, see Section 6), only as needed to provide them, and under contractual obligations to protect it; or as required by law, to protect security, or as part of a merger or acquisition with notice to you.

Human access. Lieutenant staff do not read Google user data unless you give us permission (for example, to help with a support request), it is necessary for security purposes such as investigating abuse, or it is required by law.

Storage and security. Google user data is stored in your business's dedicated Lieutenant environment on Amazon Web Services in the United States, encrypted in transit and at rest.

Retention and deletion. We keep Google user data for as long as your business's Google connection and subscription remain active, subject to Section 7. You can revoke Lieutenant's access at any time at https://myaccount.google.com/permissions, or your Google Workspace administrator can remove it. After access is revoked, Lieutenant can no longer retrieve new data. To have data already collected deleted, contact us at privacy@lieutenants.io.

Limited Use disclosure. Lieutenant's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

5. AI processing

Lieutenant's agents send the data needed for a task to third-party AI model providers, such as OpenAI and Anthropic, directly or through OpenRouter, and receive the result. We use these providers under terms that do not permit them to use our customers' data to train their models. We do not use customer data to train generalized AI models.

We share information only:

With service providers that host and operate Lieutenant for us, including cloud hosting (Amazon Web Services), sign-in (WorkOS), secure storage of connection credentials (Nango), AI model providers (see Section 5), and messaging and email delivery (such as Twilio).
With the business you work for, including its authorized users.
With services you connect, when an agent takes an action you or your business authorized, such as sending an email or recording a bill.
For legal reasons, to comply with law, respond to lawful requests, or protect rights, safety, and security.
In a business transfer, such as a merger or acquisition, subject to this policy.

7. Retention

Business records and audit history, such as financial records, approvals, actions taken, and the audit log, are kept for the life of your business's subscription.
Operational data is deleted on a schedule, for example notifications after 30 to 90 days and AI usage records after 365 days.
Backups are kept for a limited period.
When a customer leaves, we provide an export of its data on request and then delete the customer's dedicated environment.

8. Security

Each customer's data is kept in a dedicated environment separate from other customers. We use access controls, approval steps for sensitive actions, and a tamper-evident audit log. No system is perfectly secure, and we cannot guarantee absolute security.

9. Your choices and rights

You can ask us to access, correct, or delete your personal information by contacting privacy@lieutenants.io. If your information is part of a customer's business data, we may refer you to that customer.
You can disconnect any integration, including Google, at any time.
Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or the GDPR.

10. Children

Lieutenant is a business service and is not directed to children. We do not knowingly collect personal information from children.

11. Changes

We may update this policy. If we make material changes, we will post the updated policy here and update the effective date, and notify customers where required.

12. Contact

Lieutenant Inc.

131 Continental Dr. Suite 305

Newark, DE 19713

privacy@lieutenants.io