Privacy at Holotask

Last updated September 8, 2026. This notice describes the current pilot implementation.

What the service processes

Holotask stores your account email, workspace membership, agent configurations, supplied context, run inputs, source references, generated artifacts, usage records, result feedback labels and optional annotated corrections, external send/booking intent terms and their approval records, and administrative activity including audit event digests and checkpoints. Session data supports authentication and abuse prevention.

Where work happens

Cloudflare provides application hosting, identity database storage, workspace state, artifact storage, transactional email and model inference. Approved source websites receive requests when your tasks retrieve their pages. Payment details are handled by the payment processor when paid billing is enabled; Holotask does not store card numbers.

Access and control

Workspace membership and roles govern access. Source grants are explicit. Artifact downloads require authenticated access to the owning workspace. Instructions cannot grant themselves access to another workspace or external system.

Account security lets you review active sign-ins and revoke other sessions. The listing includes sign-in, refresh and expiry times, plus browser and IP details when available. Browser details are device-reported. Signing out a session does not delete retained workspace work or revoke separately managed API keys. Successful sign-ins and session removals are recorded for 90 days from the feature’s activation; removals include sign-out, revocation and expiry cleanup. This history does not record every request or failed sign-in attempt.

Retention and requests

Automatic cleanup is off by default. In Workspace settings, the owner can preview and schedule retention for completed-run trace content and downloadable artifacts. A new policy has a seven-day export window. Active runs and unresolved reviews retain their evidence. Expired artifacts become inaccessible before their physical storage removal is retried; settings show pending removals.

Saved agent definitions, reusable context, proposals, review records, and billing/audit metadata have separate lifecycles and are not removed by trace retention. Retained artifacts can still contain original result content. Authentication links and codes expire. Use workspace export before content expires; disabling a policy cannot restore data already removed.

Account security also provides a personal data export and account deletion preview. Exporting identity data or changing a deletion request requires a sign-in within the last ten minutes. An account must close or transfer every workspace it owns before scheduling its deletion. The seven-day cancellation window starts when the request is confirmed. API keys are revoked immediately and remain revoked if you cancel. Creating or joining workspaces and issuing new keys are paused while deletion is pending.

Once removal completes, profile and sign-in identities, sessions, personal security history, invitations, API key records and memberships are removed from the active identity database. Shared workspace content, published packages, opaque author IDs and workspace audit/accounting records remain under their own lifecycles. Payment-provider records, copies already exported or installed elsewhere and hosting recovery copies are separate. Workspace settings provides an owner-controlled closure preview and seven-day cancellation window after billing and shared-package dependencies are resolved. Once removal starts it cannot be cancelled; service cleanup is retried until confirmed.

To prevent recovery from reopening deleted identities, a separate private record retains the opaque account or workspace ID, deletion request ID and time. It contains no email, credential or work content. Recovery must preserve these records and reapply removals before access resumes. Separate private retention records also preserve completed trace and artifact expiry decisions through database recovery. These records contain opaque workspace/run references and expiry times, not the removed content, and have no automatic expiry. Hosting recovery copies are not erased immediately by an application deletion. Contact support@sansavision.com for assistance.

Before adding sensitive data

The pilot does not claim a specific data residency commitment, regulated-workload certification, or enterprise compliance guarantee. The legal operator’s contact and production retention terms will be finalized before paid general availability.