Who we are

Ashley is an AI executive assistant product built and operated by Bamco Studio Pty Ltd (ABN available on request), based in Melbourne, Australia. When we say "Ashley", "we", "us" or "our", we mean Bamco Studio Pty Ltd and the Ashley platform at adcom.co.

What data we collect

We collect only what's needed to provide the service:

• Account information — your name, email address, and/or phone number when you sign up
• Tasks and boards — the tasks, boards, notes, and content you create inside Ashley
• Conversation history — messages between you and Ashley across WhatsApp, Slack, and the dashboard
• Memory — facts Ashley learns about you from your conversations, which you can view and delete at any time
• Integration credentials — OAuth tokens for Gmail and Google Calendar, stored encrypted using AES-256 encryption. We never store your passwords.
• Usage data — basic usage information to improve the service (page views, feature usage). No third-party analytics.

How we use your data

Your data is used exclusively to operate Ashley on your behalf:

• Reading and sending emails when you ask Ashley to
• Reading your calendar to include meetings in your briefings
• Sending you WhatsApp messages and reminders you've requested
• Learning about your work and preferences to give better responses
• Generating tasks, summaries, and drafts based on your context

We do not use your data to train AI models. We do not sell, share, or rent your data to third parties. We do not use your data for advertising.

Gmail and Google Calendar access

When you connect Gmail or Google Calendar, Ashley requests the minimum permissions needed:

• Gmail — read, compose, and send emails on your behalf, only when you explicitly ask Ashley to
• Calendar — read your calendar events to include them in your morning briefing and answer questions about your schedule

Ashley's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. Your Google data is not used for any purpose other than operating Ashley features you explicitly request.

Data storage and security

• All data is stored in Supabase (hosted on AWS in the US, with Australian data processing where possible)
• All connections use HTTPS/TLS encryption in transit
• OAuth tokens and credentials are encrypted at rest using AES-256
• Row-level security ensures your data is isolated — other users cannot access your data
• Passwords are never stored — we use Supabase Auth with secure hashing

Your rights

You have full control over your data at all times:

• View — all your data is visible in the dashboard at adcom.co
• Export — contact us at privacy@adcom.co to request a full data export
• Delete memories — delete individual memories at adcom.co/memories any time
• Disconnect integrations — disconnect Gmail, Calendar, or any integration at adcom.co/integrations
• Delete your account — contact us at privacy@adcom.co and we'll delete all your data within 24 hours. Deleted data is held in a secure trash for 30 days before permanent deletion.

If you're located in the EU or UK, you also have rights under GDPR including the right to data portability and the right to object to processing.

WhatsApp and SMS

Ashley only sends you WhatsApp or SMS messages for reminders you've set, briefings you've scheduled, or in direct response to messages you send first. You can stop messages at any time by replying STOP. We use Twilio to send messages — your phone number is shared with Twilio solely to deliver messages.

Third-party services

Ashley uses the following third-party services to operate:

• Anthropic — AI responses (your messages are processed by Claude)
• Supabase — database and authentication
• Twilio — WhatsApp and SMS messaging
• Google — Gmail and Calendar integration (when connected)
• OpenAI — voice note transcription (when you send voice messages)

Data retention

We retain your data for as long as your account is active. When you delete an item it moves to trash and is permanently deleted after 30 days. When you delete your account all data is permanently deleted within 24 hours.

Children

Ashley is not intended for anyone under 16 years of age. We do not knowingly collect data from children.

Changes to this policy

We'll notify you of significant changes via email or WhatsApp before they take effect.

Contact

Questions about your privacy? Email us at privacy@adcom.co — we'll respond within 2 business days.