Privacy policy

Concierge, operated by Digimasters Ltd. Last updated 27 October 2026.

Who this covers

Concierge is a private tool. It is used only by people the operator knows: Adam Nagus, members of his household, Digimasters staff, and people at organisations testing Concierge with Digimasters, who sign in with their own work Microsoft 365 account. Each of them connects their own accounts. People who book time through a Concierge booking page are covered in "People who book time" below.

What Concierge accesses

When you connect an account, you sign in on Microsoft's or Google's own page and approve the access listed there. Concierge never receives your password. Depending on what you approve, it can:

• Calendar: read your events, free/busy times and calendar settings (such as timezone), and create, change or delete events.
• Email: read message headers and content, and send email on your behalf.
• Mailbox settings (Microsoft accounts): read your out-of-office, working hours and timezone.
• Folders and rules (only if you use PM Helper): create folders or labels and move messages into them, and, for mailboxes where you allow it, create and change Outlook inbox rules or Gmail filters. This extra permission is asked separately, for that mailbox only.
• Teams (Microsoft work accounts, only when Teams is on for the account): read your chats, the teams and channels you're in, and those channels' messages. Nothing is posted. An organisation's IT approval for Concierge includes this so that it only has to approve once; Concierge reads Teams only for accounts where it's on. It's on when you choose Allow Teams for the account, or, when you connect or reconnect a Microsoft work account and its organisation has already approved it, from then on, unless you turned it off; you can turn it off at any time.
• Teams meetings (Microsoft work accounts, only when Meeting notes from Teams is on for the account: when you turn it on, or, when you connect or reconnect a Microsoft work account and its organisation has already approved it, from then on, unless you turned it off; from transcripts, or from Copilot's notes only if transcripts aren't approved or the account is kept away from AI): find the Teams meetings in that account's calendar, and after each one read its transcript and Microsoft 365 Copilot's notes on it (its notes, action items and where you were mentioned), or, if you choose Copilot's notes only, Copilot's notes alone, in which case Concierge never asks to read transcripts. Your organisation's admin approves this separately, and can approve Copilot's notes without transcripts. When you connect or reconnect a Microsoft work account, Concierge asks Microsoft whether its organisation has approved Teams, transcripts and Copilot's notes, without asking you to sign in again, and turns on what's approved. To show whether meeting notes can work for an account, Concierge asks Microsoft which of these permissions your organisation has approved, reads the names of your licences in that organisation (to see whether you have Microsoft 365 Copilot) and, for your newest Teams meeting, lists its transcripts and Copilot's notes without reading them, when you choose Check now or an assistant you allowed asks.
• Basic profile: your name and email address, to identify the connected account.

For Google accounts this means Gmail and Google Calendar, through the scopes shown on Google's consent screen.

How it uses that data

• To show you and the people you choose a combined view of your calendars and email, and, for Microsoft work accounts where you've turned Teams on, your Teams chats and channels (read live from Microsoft each time, read only, not stored).
• To work out when you are free, and to offer only free times on booking pages.
• To create calendar events and send email when you, or an assistant you have authorised, ask it to, and to mark email read or unread, flag it, move it between folders or delete it when you, or an assistant you have authorised with that access, do so. These change the mailbox in Outlook or Gmail itself; Concierge keeps no copy. Sharing a meeting's notes sends an email from your mailbox to the people you choose, with the notes' summary and what you include (decisions, action items, Copilot's notes), never the transcript. To suggest who to share with, Concierge reads the meeting's invitees from your calendar when you open Share and lists your colleagues and your contacts; the people you share with are kept, encrypted, as your contacts, for next time.
• To answer a meeting invitation (accept, tentatively accept or decline), forward it, or cancel a meeting you organised, when you, or an assistant you have authorised with that access, do so. Concierge does it in your calendar through Microsoft or Google, which tell the organiser or the people invited as they normally would. To show who's invited, with their email addresses, Concierge reads the meeting from your calendar at that moment and doesn't keep the addresses.
• To check that each connection still works.
• Invitations: when an admin, or an assistant working for an admin, invites someone to Concierge, Concierge emails them from its own address, support@digimasters.co.uk, through Microsoft 365 (Exchange Online), with who invited them and how to sign in. Concierge sends only its own emails from that address (invitations, a test an admin sends to themself, for someone with no mailbox connected to Concierge a short notice with only a subject and a link, such as that a statement is ready, and, when Digimasters changes an organisation's AI settings for it, an email to that organisation's admins saying what changed, never a key); nobody can write free-form emails from it. It's sent by a separate Concierge app in Digimasters' own Microsoft 365 organisation that Exchange Online allows to send as that address and nothing else; it can't read any mailbox. The emails have no tracking: Concierge doesn't know whether they're opened. A copy stays in that mailbox's Sent Items, and replies and bounces arrive there, under Digimasters' own Microsoft 365 retention.
• Notifications on your phone (optional, for each phone or computer you turn them on for): when a booking or an email waits for your approval, Concierge sends a short notification (the meeting's title and time and why it needs you, or who wants to email whom and the subject) through your browser maker's push service: Apple, Google, Mozilla or Microsoft. The notification is encrypted end to end, so the push service can't read it.
• To show emails as they were sent: unless an account's owner turns it off, the web app loads pictures an email links to from the sender's servers when you open it, which can tell the sender the email was opened and roughly where. When it's off, pictures load only if you choose to for that email.
• To let an assistant you have authorised know within seconds that something changed: a new email in a mailbox it may read, a change in a calendar it may see, or an approval waiting. For this Concierge listens for new mail in those mailboxes only (and in mailboxes where the action list's Find actions is on, below), through Microsoft's change notifications, Gmail's notifications (sent through Google Cloud Pub/Sub, when set up) and a check every two minutes. The assistant is told which account changed and the message's id, not its content; it reads anything more through Concierge, within its access. So that each assistant is woken only for what its owner chose (for example only important email, or nothing in quiet hours), Concierge reads a new email's headers once when it arrives (sender, recipients, subject, importance, and whether Outlook or Gmail put it in Focused or Primary), never its body, and keeps only labels (such as "newsletter" or "from a client") and scrambled fingerprints of the sender with the notice, for 7 days. Each assistant's notice settings, which can list email addresses, are stored encrypted.
• Teams (only for accounts where you've turned it on, and only while an assistant you authorised may see that account's Teams or the account's Find actions is on): Concierge listens for new messages in your chats and in up to 25 channels you're in, through Microsoft's change notifications and a check every few minutes, and reads each new message once to decide which assistants to tell (who sent it, whether it's a 1:1 chat or mentions you, its importance). Like email, the notice keeps only labels and scrambled fingerprints of the sender, for 7 days; messages are read live when an assistant asks and are never stored. Your own messages don't make notices.
• Actions: to keep a list of what you've been asked to do and what you're waiting on. For accounts where Find actions is on (it is unless the account's owner turns it off), each new email from a person (or from you to only your own addresses, a note to self) and each new Teams message in a 1:1 chat or that mentions you is given to the AI service (below) to find actions, and so is an email or Teams message you choose Make an action on, to fill in its details; replies in an action's conversation (in each of your mailboxes the email reached) are given to it later to tell whether the action is done; and when you're waiting too long, it drafts a chase email for you to send. You can also add actions yourself, and assistants with enough access can add and change them. Nothing is sent for you.
• monday.com (optional, for each person who connects their own monday.com account with a personal API token): to copy that person's own actions to their monday.com boards and keep them in step. Concierge sends each action's title, status, priority, due date, client and project, type, who it's with (by name, and as their monday.com user when one has the same email address, which Concierge looks up in that monday.com account) and a link back to Concierge; never email or Teams content. It reads back changes made in monday.com to the status, priority, due date, person and name of items it made, through webhooks on those boards, and looks up the email address of a monday.com user put in the Person column so it can match them to a Concierge person or contact. monday.com's own terms and privacy policy apply to what is on its boards, which may be stored outside the EU.
• PM Helper (optional): to review a mailbox's recent email headers and propose folders, tags and rules, and to apply the ones you approve. Once a mailbox has PM Helper rules, it reviews the last 30 days of headers again once a week, early in the morning, and lists any new suggestions for you; you can turn this off for each mailbox. It adds suggestions by itself only if you turn that on for the mailbox, and each one can be undone. Unless you turn it off for a mailbox, it also looks once a day at the headers (sender, recipients, subject, date, folder and whether it's been read, not the text) of the last 30 days' mail you've filed in your own folders or labels or archived, at which conversations you've replied in, and at your own Outlook rules or Gmail filters, so it can suggest rules for mail you keep filing or archiving by hand.

Concierge does not sell your data, use it for advertising, or give it to anyone to train AI models. The only training Concierge plans is of its own email sorter, from mailboxes whose owner leaves Training examples on (see "How it is stored").

The AI assistant

Concierge has an optional assistant. The account owner chooses which AI service runs it: Anthropic (Claude), OpenAI, Microsoft Azure OpenAI, Google Gemini, Mistral, OpenRouter, Ollama, or another compatible service. Currently the assistant uses Anthropic (Claude).

Each organisation using Concierge chooses how its AI runs, within its plan: Digimasters' AI service (using the providers and models Digimasters allows), its own keys for a provider it chooses (then that provider's agreement with the organisation applies), or no AI at all; and which providers may see its data. An organisation's own keys are stored encrypted with that organisation's own key and are never shown again, not even to its admins. Digimasters' platform admins can set these choices up for an organisation, its keys included; each change is in that organisation's audit log and its admins are emailed about it. On Digimasters' AI service each person's seat includes a number of AI calls a month; past it, calls draw from a pool the organisation's admins top up. When someone asks for more, their admins see who asked, how many calls and, if they gave one, their reason (stored encrypted), and are told by phone notification and by email sent from the admin's own mailbox to themselves (someone with no mailbox connected gets a short notice from support@ instead). Each month's statement (seats, AI calls by feature, person, model and mailbox, and the charge) is kept encrypted for 7 years as an accounting record, and seen by the organisation's admins, its billing contacts and Digimasters' platform admins. Feedback someone sends (and a screenshot, only if they attach one) is stored encrypted and seen by them, their organisation's admins and Digimasters' platform admins, and kept until 2 years after it's closed; the assistant and assistants (AI agents) also send feedback when asked for something Concierge can't do yet. Help searches that find nothing are counted by their words, to know which guides to write. Pre-sorting with Jev (below) runs only for organisations that allow OpenRouter to see their data.

An account's owner can keep the account away from AI. Then nothing from it is sent to the AI service, for any of the uses below, or to assistants (AI agents), even ones the account is shared with; no training examples are kept for it; and only its busy times, with no details, count when Concierge or an assistant finds free time. Microsoft 365 Copilot's own meeting notes, made inside Microsoft 365, can still be read.

When someone uses the assistant (asking a question, drafting a reply, or a brief they get), the calendar and email details needed for the answer, limited to what that person may see, are sent to that service to write it, and its own API terms apply. Depending on the service, it may be processed outside the EU. Concierge keeps each answer in memory for 15 minutes and doesn't store the conversation. The assistant can look things up and save email drafts, but it can't send email, book meetings or approve anything.

Briefs (summaries sent by email on a schedule) use the same service, separately for each person or assistant who gets one and limited to what they may see. A brief looking back sends the period's email senders, recipients, subjects and first lines, Teams messages' senders and text, meeting titles and times, the summaries and decisions of its meeting notes (for a Teams meeting noted only from Copilot's notes, the summary made from them), and action titles, to write a short summary, highlights and next steps; a brief looking ahead sends recent email senders, subjects and first lines and the day's meeting titles and times, to pick the email worth a look.

Meeting notes use the same service. When someone pastes a meeting's transcript or notes or chooses a transcript file (a Word or PDF file is read on Concierge's server for its text and not kept), a transcript or recap email arrives in a mailbox with Meeting notes from email on (it is for accounts added from 27 October 2026, unless the owner turns it off or keeps the account away from AI), or a Teams meeting's transcript is read for an account with Meeting notes from Teams on from transcripts, the transcript and the meeting's title and time are sent to it to write a summary, the decisions and the action items. For an account set to Copilot's notes only, Concierge never reads a Teams meeting's transcript and its notes are made from Copilot's notes without this service. Copilot's notes from Microsoft aren't sent to it for this (a brief may send a note's summary, as above). To spot those emails, Concierge reads each new email in such a mailbox (its sender, subject, text and attachment names); emails that aren't transcripts or recaps go no further.

PM Helper uses the same service when it's set up. To propose a plan it sends grouped facts about a mailbox's recent email (sender names and domains, counts, how often you reply, and a few example subjects), never message bodies or attachments. When a mailbox is reviewed again, it also sends the PM Helper rules already in force there (the senders, domains and subject words they match, and their folder names), so new suggestions don't repeat them. The weekly review sends these facts only for mailboxes where you've turned AI tagging on. If you turn on AI tagging for a mailbox, each new email's sender, subject and first lines are sent so it can be tagged; this is off unless you turn it on. Learning from what you file by hand doesn't use the AI service.

The action list uses the same service, for accounts where Find actions is on. To find actions it sends each new email from a person (sender, recipients, subject, date and the whole text, or only its first lines if the account's Whole emails switch is off; never attachments) or each new Teams message in a 1:1 chat or that mentions you (with the few messages before it in the chat). To tell whether an action is done it sends the replies in its conversation (the latest in full, if Whole emails is on). To draft a chase email it sends the action's title, who you're waiting on, the original subject and the date. Your own new emails aren't sent to find actions, except one you send only to your own addresses (a note to self), nor new messages in a conversation that already has an open action. When you choose Make an action on an email or Teams message, that one message is sent in the same way to fill in the action's details; nothing is saved until you add it.

If the account owner turns on pre-sorting, each of those new messages first goes to TypeSafe's Jev, through OpenRouter, which answers whether it needs action and whether it's urgent; messages it rules out aren't sent to the AI service. Jev gets the same message details as the AI service would (sender, recipients, subject, date and the text, or only its first lines if Whole emails is off), and OpenRouter is told to use only providers that don't train on the data. TypeSafe hosts Jev in the United States, says it does not train its models on what it receives, and keeps it for as long as it says is reasonably necessary to provide its service. TypeSafe's and OpenRouter's own terms apply.

To show what the AI costs, Concierge records each call it makes to the AI service: the person it was for, the feature (for example the assistant or PM Helper), the model, how many tokens it used, how long it took, any error and its cost, whose key paid, whether it counted against the person's seat, a mailbox's background allowance (and which mailbox) or the pool, and what Digimasters charges for it. It never records what was asked or answered. These records are kept for 13 months and seen only by the account owner, and by each person for their own use.

Who can see it

Each account's owner decides who can see what: none, busy times only, a summary, or full details, separately for calendar, email, Teams and actions. Assistants (AI agents) get access only when the owner grants it, and only at the level granted, and never to an account its owner keeps away from AI. Every read and action, by a person or an assistant, is recorded in an audit log; each person sees the entries about their own accounts and what they and their assistants did. Each assistant works for one person, who sets it up. Concierge's admins (people who manage who can sign in, assistants and the AI settings) see each account's owner and whether it's working, a work account's name and address (not a personal account's), each assistant's owner and token status, AI costs by person and feature, and changes to those settings. Being an admin gives no access to anyone's email, calendar, Teams, location or travel: admins see those only where the owner has shared them, like anyone else. Digimasters' platform admins, who run Concierge for every organisation using it, see each organisation's name, plan and features, how many people, assistants and accounts it has and whether those accounts are working, its AI usage and cost, and the platform's own log of what they changed; never anyone's email, calendar, Teams, meeting notes or actions. A brief that someone sends to another person or assistant is written with that recipient's own access, so it never shows them more than they could see in Concierge. Private events show only as "busy" to everyone except their owner.

How it is stored

• Sign-in tokens are encrypted at rest with your organisation's own key, which is stored only encrypted with a key held outside the database. Each organisation's data is kept apart in the database itself, not only by Concierge's code.
• What is stored for each account, and for how long, is listed below. Everything else, email and Teams messages included, is read live from Microsoft or Google when needed.
• Data is stored and processed on Railway (EU West, Amsterdam). The web app is hosted on Vercel, which also passes the web app's requests to Concierge's servers (encrypted in transit, marked not to be stored, through the Vercel location nearest you) and runs the sign-in check in front of the web app's pages in its US East region, which sees only your session and the page's address, not your data.
• Calendars are kept in sync: event times and free/busy status are stored, and event titles, places, notes, attendees and meeting links are stored encrypted, with your organisation's key.
• Email is read live from Microsoft or Google each time it's shown, and is not stored. The one exception: an email an assistant asked to send to someone new, which waits for the account owner's approval. It is stored encrypted (its text and formatting) until decided and deleted 30 days after.
• For notifications on your phone, Concierge stores each device's push address and keys, encrypted, with a name such as "iPhone" and when it last got a notification, until you turn notifications off on that device or the push service says the device no longer accepts them.
• Files and pictures you add to an email you're writing are held in the server's memory, never on disk or in the database, until the email is sent or saved as a draft, and for at most an hour.
• To tell assistants about changes, Concierge records each new email's message id (not its sender, subject or text), calendar changes and approvals waiting, with the account they belong to, for 7 days, and, for each mailbox an assistant may read, how far it has checked.
• The action list stores each action's status, type, priority, dates and who it's with, and, encrypted, its title, project, where it came from (sender, subject, date and a short excerpt; for an email, its Message-ID and which of your other mailboxes the same email also reached, so it stays one action), a drafted chase email and why Concierge thinks it's done; a history of changes (who, when and what kind, not the content); your contacts (name and email address) and clients (name and email domains), encrypted; and keyed one-way fingerprints of contacts' addresses, of conversations and of emails' Message-IDs, to find them again. Actions from an account are deleted when it's disconnected, and closed actions after 13 months. Each action can be marked as for one of the owner's clients, Personal or Internal; a Personal action is seen only by its owner, their own assistants and the person it's with, never by others who can read that mailbox. To suggest an action's client from its owner's earlier choices, and set it when it's sure, Concierge keeps for each owner the senders' addresses and domains, conversation subjects, Teams chats and mailboxes those choices were about and how many times each client was chosen, encrypted and found by keyed one-way fingerprints. One person's choices are never used for anyone else's actions; this runs on Concierge's own servers and nothing of it is sent to the AI service. An entry is deleted when its owner forgets it, after 13 months unused, and (for a mailbox's own conversations and chats) when the mailbox is disconnected. Each person's view choices for the action list (grouping, colours and folded groups) are kept so they follow them to every device. To learn how often its guesses are right, Concierge also keeps each guess's probability, whether it turned out right, and a keyed one-way fingerprint of the message it was about (no content), for 13 months. In mailboxes whose owner leaves Training examples on (on by default for business and personal accounts, off for client ones), it also keeps, for each message it reads for actions, an encrypted reference to that message (not its content), what the pre-sort and the AI said, and later whether it needed action and the client, Personal or Internal chosen for its action, for 13 months. These are to train a sorter that runs on Concierge's own servers; training reads the messages again at the time and nothing is sent to anyone else.
• The monday.com mirror stores each connected person's API token and who they are in monday.com (name, email address, account name), encrypted; their choices (how actions are split over boards, a daily call budget, which board and columns each destination uses, with board and destination names encrypted); which monday.com item each action is and what was last sent to it (encrypted); a one-way fingerprint of each board's webhook secret; and how many calls were made each day (kept 40 days). Disconnecting deletes all of it and removes Concierge's webhooks from the boards; the boards and items stay in monday.com.
• If you connect Teams for briefs, Concierge stores your Teams workflow link encrypted and posts each brief that goes to Teams to it, as a card with the brief's contents; your workflow (Microsoft Power Automate) puts it in the chat you chose, under Microsoft's terms. Disconnecting deletes the link.
• Meeting notes store each meeting's summary, decisions, action items, who was there, where the transcript came from and Microsoft 365 Copilot's notes when there are any (Copilot's notes include short quotes of the moments you're mentioned), encrypted, for 13 months, and the transcript itself, encrypted, only until its notes are made and for 20 minutes at most (redoing the notes then reads a Teams transcript from Teams again), or, for an account whose owner chose to keep transcripts, for 30 days so the summary can be redone. Deleting after notes is the setting for every account unless its owner chose otherwise (since 27 October 2026; transcripts kept before then still go 30 days after they were read); the action items for the owner become actions like other actions. A fingerprint of a transcript email's id (not its content) is kept so it becomes a note only once. For Teams meetings, Concierge also keeps which calendar meetings it has looked at and Microsoft's ids for their meeting, transcripts and Copilot's notes (ids, no content), for as long as the meeting is in the calendar it keeps, and the result of the last check of whether meeting notes can work for the account (which permissions are approved, the names of any Copilot licences, and whether transcripts and Copilot's notes could be listed), until the next check or until the account is disconnected.
• For each person invited, Concierge keeps their name, email address and role, who invited them (and the assistant that sent it, if one did), when the invitation email was sent and how many times, why the last one failed if it did, and, if an admin made an invite link, a one-way fingerprint of it (never the link itself), who made it and when it expires (14 days), was withdrawn or was used. The link works once, leads to Microsoft's own sign-in and lets in only the invited address. It also records when each person first signed in. These are kept with the person's record; the audit log records each invitation, email, link and test.
• To let people sign in with their own work Microsoft 365, each organisation using Concierge lists the email domains its people use, each proved by a record in the domain's DNS or vouched for by Digimasters on the organisation's word, with the id Microsoft gives for the Microsoft 365 organisation (tenant) each domain is in, and who added and proved it and when. When someone signs in, Microsoft tells Concierge their name, email address and the ids of their account and organisation (never their password); Concierge keeps the ids to recognise them, and lets them in only if their organisation's domain is listed and they were invited, or their organisation lets its people join. Their organisation's own sign-in rules, such as multi-factor authentication, apply. The same mailbox can be connected in more than one organisation using Concierge, for example by someone who works in both; each copy is kept separately, sealed with its own organisation's key.
• Briefs store their settings (which accounts and sections, when, who gets them), with no email content. Each copy sent is stored encrypted, readable only by the person or assistant it went to, and deleted after 30 days; a record that it went (when, to whom, whether it was sent, the counts it showed and its AI cost) is kept for 13 months.
• PM Helper keeps a proposed plan (which can include example senders and subjects) encrypted until you apply or ignore it, and for at most 30 days, and keeps the rules you apply, encrypted, plus keyed one-way fingerprints of suggestions you dismiss (of what they match and the folder they file mail in, not their senders or subjects). To let you undo, it records which messages it moved and where from (message ids only) for 7 days; this record also tells its own moves apart from yours when it learns from your filing. When you change or delete one of its rules, or a new plan replaces them, it keeps the old version (encrypted) for 30 days, so that mail the rule filed isn't mistaken for your own filing. What it reads to learn from your filing isn't stored; only the suggestions are, like other suggestions.

People who book time

If you book or request a meeting through a Concierge booking page, Concierge stores what you enter (your name, email address, company, time zone and answers to the page's questions) with the booking, and puts the meeting in the host's calendar, which sends you an invitation from the host. You get a private link to view or cancel the booking. The first time you book with someone, Concierge first emails you a link, from the host's mailbox, to confirm your address; until you confirm, the time is held for 30 minutes, and Concierge records when you confirmed so you aren't asked again.

• To stop automated abuse, booking pages use Cloudflare Turnstile, which checks your browser is operated by a person. Cloudflare processes data from your browser for this, under Cloudflare's Turnstile privacy policy.
• Concierge counts recent bookings per network address, email address and company to apply limits. It keeps only a one-way fingerprint of these, for at most two days.
• Booking records are kept as a record of the meeting. To have yours deleted, contact the address below.

Keeping and deleting data

How long each kind of data is kept is set out above. Every deletion, by these rules or by a person (deleting a note, disconnecting an account), is recorded in the audit log: what was deleted, how many and why, never the content. The audit log, which records who read or changed what and never content, is kept.

You can disconnect an account at any time. Disconnecting deletes its stored tokens and data straight away (its calendar copy, the actions and meeting notes from it, any transcripts still kept, PM Helper's records and who it was shared with), and revokes Concierge's access where the provider supports it. Kept afterwards: the audit log, the AI usage and action-list records described above (no content), contacts you added to your action list until you remove them, copies of briefs already sent until their 30 days are up, and any folders and rules PM Helper made, which stay in the mailbox until you delete them there. You can also remove Concierge's access yourself: Google at myaccount.google.com/connections, Microsoft personal accounts at account.live.com/consent/Manage, and Microsoft work accounts at myapps.microsoft.com.

Google user data

Concierge's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Contact

For questions, or to ask for your data to be deleted, contact Digimasters Ltd.