Privacy Policy

This Privacy Policy describes how Esper Labs, Inc. ("Esper Labs," "we," "us," or "our") collects, uses, and shares personal information in connection with last30days.dev, its API, and its email, Slack, and Google Calendar integrations (together, the "Service"). Use of the Service is also governed by our Terms of Service.

We may update this policy. When a change affects how we collect, use, or share personal information, we will post it here and update the date above. Continuing to use the Service after a change takes effect means you accept the updated policy.

Information we collect

Information you provide.

• Account information from GitHub sign-in, such as your name, email address, GitHub username, and avatar.
• Research queries, scheduled-report settings, and the reports the Service generates for you.
• Billing records, such as credit purchases, balances, and usage. Payment card details are collected and stored by Stripe, not by us.
• API keys you create. We store a one-way hash and a short prefix, not the full key.
• Messages you send us, such as support requests.

Information from integrations you connect.

• Slack: your workspace and channel identifiers, your linked Slack user, and the commands you send to the last30days app.
• Google Calendar: read-only event data, described in detail under "Google Calendar data" below.

Information collected automatically. Our servers and hosting providers log technical data such as IP address, browser type, device information, pages requested, and request times. We use it to operate the Service, enforce rate limits, and prevent abuse.

Cookies and local storage. We use cookies that the Service needs to work: authentication cookies that keep you signed in, and a signed cookie that counts free searches before sign-in. We use browser local storage for preferences such as the completion sound. We may use analytics tools to understand how the Service is used, such as which pages are visited and which features are used. We configure them so they do not receive the text of your research queries. Where the law requires consent for analytics cookies, we will ask for it. We do not use advertising cookies or session-replay tools.

Public information. To produce reports, the Service retrieves publicly available posts and pages from sources such as Reddit, X, YouTube, TikTok, Hacker News, Polymarket, GitHub, and the wider web. Those results can include public information about the people who wrote or are named in that content.

Please do not put sensitive personal information, such as health, financial, or government ID details, in research queries.

How we use information

• To provide the Service: run research, generate and deliver reports and meeting briefs, process payments, and maintain your account.
• To communicate with you about your account, purchases, scheduled reports, and service changes, and to answer your requests.
• To keep the Service secure and reliable: detect and prevent fraud and abuse, enforce our terms, and diagnose problems.
• To understand usage and improve the Service, including from aggregated or de-identified data.
• To comply with law and respond to lawful requests.

We use AI models to plan research and write reports. Your queries and the public content retrieved for them are sent to those model providers to produce your results. We do not sell personal information, and we do not use your queries or reports to train general-purpose AI models.

Aggregate research trends

We analyze research queries and reports in aggregated, de-identified form to understand how the Service is used and what topics people are researching. We may publish the results, such as popular topics and trends over time. Published trends do not identify you or attribute any query or report to you. This applies to private reports as well as public ones; making a report private keeps it out of public listings but does not exclude it from aggregate counts.

Before publishing, we group queries into broader topics rather than publishing what individual users typed, include a topic only when enough different users researched it, and remove names of private individuals, health-related topics, and other sensitive or identifying details. Meeting briefs and any data from Google Calendar are never included in aggregate analysis, and neither are requests made through the developer API gateway.

Reports and sharing

Every report has a permalink. Anyone who has a report's link can view it, so share links with care. We do not list your reports publicly on the Service.

How we share information

We share personal information only as described in this policy:

• Service providers that process data on our behalf, including Supabase (database and authentication), Vercel and Render (hosting), Stripe (payments), Resend (email delivery), Upstash (rate limiting), and any analytics provider we use.
• AI and data providers that run research, including Anthropic, xAI, Google, Parallel, and ScrapeCreators. If you use the developer API gateway, your requests are forwarded to the model provider you select.
• Integrations you connect, such as Slack, which receive the reports you ask us to deliver to them.
• Legal and safety recipients, such as law enforcement or courts, when we believe disclosure is required by law or needed to protect the rights, property, or safety of you, us, or others.
• Business transfers, to a party in a merger, acquisition, financing, or sale of assets, subject to this policy.
• Professional advisors, such as lawyers, auditors, and insurers, as needed for their services to us.
• Affiliates under common control with Esper Labs.

Google Calendar data

If you connect Google Calendar, we request read-only event access and store only the event fields needed to decide whether to prepare and deliver your own pre-meeting brief. Calendar data is used only to provide meeting briefs to the user who connected that calendar. We do not use it for advertising, sell it, or use it to train general-purpose AI models. Event descriptions and locations are not sent to the meeting-identity providers described below.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Meeting-brief subprocessors. We use Parallel for bounded public-web lookup when an external invitee cannot be identified from the invite alone. Parallel receives only the unresolved external invitee evidence needed for that lookup: their email address, available name, company domain, and one short attendee-specific meeting-title segment. Owner, internal, and resource attendees and unrelated title segments are excluded.

We use Anthropic to evaluate minimized invite evidence and bounded public-search excerpts. Anthropic receives a bounded meeting title and owner aliases for exclusion, plus external attendee slots, available names and domains, organizer flags, and unresolved address evidence. Provider results are temporary and are not stored with the meeting. Only a locally validated person name and safe provenance may become part of the research target.

Retention and control. Synced event rows are removed on a rolling basis seven days after an event ends. Disconnecting Google Calendar removes the stored connection secret and synced event rows and stops pending briefs; completed research follows the retention rules below. You can disconnect from Integrations.

Security. Google refresh tokens are encrypted in managed secret storage. Meeting-target fingerprints use a dedicated keyed digest. Raw invitee addresses, public-search excerpts, URLs, and provider responses are excluded from meeting-target columns, owner-visible failure events, and operational counters.

Retention

We keep personal information for as long as your account is active and as needed to provide the Service. After that, we keep it only as long as needed to meet legal, tax, and accounting obligations, resolve disputes, prevent fraud, and enforce our agreements. Billing records are kept for the period the law requires. When you delete your account, we keep those records with your identity removed.

Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, access controls, and hashed API keys. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your choices

• Access and correction. Email privacy@esperlabs.ai to request a copy of your information or to correct it. We may need to verify your identity first.
• Account deletion. You can delete your account at any time from Account → Settings. Deletion is immediate and permanent. It removes your profile, research reports (so their share links stop working), scheduled reports, meeting briefs, API keys, provider keys, and your Google Calendar and Slack connections. We revoke our access to your Google Calendar, and uninstall our Slack app from any workspace where you were its only user; workspaces you share with teammates keep it. Unused credits and API balance are forfeited and not refunded. We keep purchase and credit-ledger records for tax and accounting, with your identity removed. Stripe keeps its own payment records, and we remove your name and email from your Stripe customer record. If you sign in with GitHub again later, you get a new, empty account.
• Integrations. You can disconnect Google Calendar at any time from Integrations, or revoke access from your Google account settings. From the same page you can unlink your Slack account, which removes the connection between your Slack identity and your last30days.dev account. Unlinking does not remove our Slack app from the workspace. If you installed the app, research run from that workspace keeps using your credits and is saved to your account until a workspace admin removes the app in Slack's app settings.
• Emails. Scheduled report emails include an unsubscribe link. We may still send service emails, such as purchase receipts and account notices.
• Cookies. You can block or delete cookies in your browser, but sign-in and the free-search allowance will not work without them.
• Do Not Track. We do not respond to Do Not Track signals.

International transfers

Esper Labs is based in the United States, and we and our service providers process information in the United States and other countries. Data protection laws there may differ from those where you live. Where the law requires it, we use appropriate safeguards for these transfers.

Notice to users in Europe and the UK

If you are in the European Economic Area, Switzerland, or the United Kingdom, Esper Labs is the controller of your personal data. We process it to perform our contract with you (providing the Service), for our legitimate interests (security, fraud prevention, and improving the Service, where those interests are not overridden by your rights), to comply with legal obligations, and with your consent where we ask for it.

You have the right to access, correct, delete, port, or restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. To exercise these rights, email privacy@esperlabs.ai. You may also complain to your local data protection authority.

California residents

We do not sell or share personal information for cross-context behavioral advertising. California residents may request access to or deletion of their personal information, and we will not discriminate against you for making a request. Under California Civil Code section 1798.83 ("Shine the Light"), you may also ask whether we disclosed personal information to third parties for their direct marketing purposes; we do not. Send requests to privacy@esperlabs.ai.

Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from them. If you believe a minor has given us personal information, contact us and we will delete it.

Third-party sites

Reports link to and embed content from third-party sites, such as YouTube, X, and Reddit. Those sites have their own privacy practices, which this policy does not cover.

Contact us

Questions or requests about this policy: privacy@esperlabs.ai.