These Terms govern your use of 20sec.bot (the "Service"), operated by 20sec Inc., a Delaware C corporation ("20sec," "we," "us"). By using the Service you agree to these Terms.

1. The Service

20Bot is an AI agent that chats with you and acts on your behalf against third-party services you connect (Gmail, Google Drive, Slack, GitHub, LinkedIn, HubSpot, Microsoft 365, Stripe, QuickBooks, Dropbox, and others). The Service is provided as-is; we may add, modify, suspend, or discontinue features at any time.

2. Eligibility

You must be at least 13 years old to use the Service, and at least the age of digital consent in your jurisdiction. You represent that you have the right to use and authorize 20Bot to act on any accounts or data you connect.

3. Your responsibilities

• You are responsible for actions the bot takes on your behalf. Review the bot's outputs — especially before sending emails, making payments, modifying shared resources, or contacting third parties.
• You must not use the Service to harass, defraud, spam, or violate any law or third-party right.
• You must not connect accounts you don't own or aren't authorized to act on behalf of.
• You must not attempt to reverse-engineer, scrape, overload, or exploit the Service or its underlying infrastructure.
• You must comply with the Terms of every third-party service you connect — those Terms also apply to your use of the connection.

4. AI outputs — verify before relying

The bot uses large language models (currently Google Gemini and providers reached via OpenRouter / DeepInfra). It can make mistakes, hallucinate details, misread instructions, or produce biased output. You agree to review and verify AI-generated content before relying on it for any important decision. We make no representation that the bot's output is accurate, complete, or fit for any particular purpose.

5. Connected services

When you connect a third-party service via OAuth or an API token, you grant 20Bot permission to act on your behalf within the scope you authorized. We are not responsible for the actions, availability, pricing, or content of those third parties. Their own terms and privacy policies apply to your data within them.

6. Intellectual property

We own the Service, including its code, design, branding, and underlying systems. You retain ownership of the data and content you provide. By submitting content to the Service you grant us a worldwide, non-exclusive, royalty-free license to process it solely to operate and improve the Service.

7. Payment

Some features require a paid plan. Fees are billed in advance and are non-refundable except where required by law. We may change pricing with at least 30 days' notice for existing subscribers.

8. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND. WE DISCLAIM ALL EXPRESS AND IMPLIED WARRANTIES INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ACCURACY. WE DO NOT GUARANTEE UNINTERRUPTED, ERROR-FREE, OR SECURE OPERATION.

9. Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL 20SEC INC., ITS OFFICERS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, BUSINESS, OR DATA, ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE, EVEN IF ADVISED OF THE POSSIBILITY. OUR AGGREGATE LIABILITY FOR ALL CLAIMS SHALL NOT EXCEED THE GREATER OF (A) $100 USD OR (B) THE AMOUNT YOU PAID US IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

10. Indemnification

You agree to indemnify, defend, and hold harmless 20sec Inc. and its affiliates from any claims, damages, losses, liabilities, and reasonable legal fees arising from (a) your use of the Service, (b) your violation of these Terms, (c) your violation of any law or third-party right, or (d) content you submit to the Service.

11. Termination

We may suspend or terminate your access at any time, with or without notice, for any reason including suspected misuse, non-payment, or violation of these Terms. You may stop using the Service at any time by disconnecting all services in the Connect popups and clearing your browser data; you may also request full account deletion via email (see Contact below).

12. Governing law and disputes

These Terms are governed by the laws of the State of Delaware, USA, without regard to its conflict-of-law principles. Any dispute arising from these Terms or the Service shall be resolved exclusively in the state or federal courts located in Delaware, and you consent to personal jurisdiction there. You waive any right to participate in a class action.

13. Changes

We may modify these Terms from time to time. Material changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after the effective date of an update constitutes acceptance.

14. Contact

20sec Inc.
Email: 20sec.app@gmail.com

This Privacy Policy explains what personal data 20sec Inc. ("20Bot," "we") collects when you use 20sec.bot, why we collect it, who we share it with, and what you can do about it.

1. What we collect

• Connected-service tokens. When you connect Gmail, Drive, Slack, GitHub, LinkedIn, HubSpot, Microsoft 365, Stripe, QuickBooks, Dropbox, or any other supported service via OAuth, we store the access token (and, where applicable, refresh token) that the service issues to us. We do NOT store your service password.
• Conversation logs. Each chat turn (your message, the bot's reply, every tool call and its result) is written to a per-visitor JSONL file on our server so the bot can remember context and so we can debug issues. The aggregate stream of turns across all visitors (with sid + content) is also kept in a single file for analytics and improvement.
• Profile facts. When you ask the bot to remember something about you (your timezone, name, preferences, etc.) those facts are written to a per-visitor profile file on our server.
• Account info. If you create a paid account: email, name (optional), Stripe customer + payment metadata (card brand, last-4 only — we do not store full card numbers).
• Technical data. IP address, browser user-agent, request timestamps, error logs. Used for security, abuse prevention, and debugging.
• Browser storage. We use localStorage to remember your bot identity, recent chat history, and UI preferences. No third-party tracking cookies, no ad networks.

2. How we use it

• Connected-service tokens are used only to act on your behalf when you ask the bot to do something with that service (e.g. read your Gmail, post a Slack message).
• Conversation logs and profile facts power the bot's memory across turns, the "what do you remember about me" recall, debugging, and product improvement.
• Technical and account data are used for billing, security, fraud prevention, and customer support.
• We do not sell or rent your personal data to anyone. Ever.
• We do not use your conversation content to train third-party AI models on your behalf. Conversation content is sent to LLM providers (Google Gemini, OpenRouter, DeepInfra) so they can generate the bot's responses; those providers process the data under their own privacy policies, and we only send what's needed to produce a reply.

3. Who we share with

We use the following service providers (sub-processors), each with their own privacy policies:

• Google — Gemini AI models, Google Workspace OAuth.
• OpenRouter and DeepInfra — additional AI model providers.
• Stripe — payment processing for paid plans.
• Hetzner, Contabo and similar infrastructure providers — server hosting.
• The third-party services you choose to connect — whichever they may be (Slack, GitHub, etc.).

We may also disclose data when legally required (subpoena, court order) or to protect rights, safety, or property.

4. Where data is stored

Data is stored on servers operated for us by infrastructure providers, primarily located in the United States and the European Union. Access tokens are stored encrypted on disk. Connections are protected by HTTPS in transit. We are a small team and are not currently SOC 2 or ISO 27001 certified — please do not connect highly sensitive accounts (e.g. enterprise admin tokens, regulated PHI / PCI data, classified information) unless you accept the risk profile of an early-stage product.

5. Your rights and choices

• Disconnect a service: open the Connect popup for that service and click DISCONNECT. The stored OAuth token is deleted immediately.
• Delete all your data: email 20sec.app@gmail.com from the email address associated with your account. We will delete within 7 days and confirm.
• Export your data: request a copy by email; we will provide a JSON export within 14 days.
• Wipe local browser data: use your browser's "Clear site data" tool for 20sec.bot to remove localStorage.
• EU / UK / California residents: you have additional rights under GDPR, UK GDPR, and the CCPA/CPRA including access, correction, deletion, portability, and (where applicable) objection to processing. Email us to exercise these rights.

6. Retention

We keep connected-service tokens until you disconnect or delete your account. Conversation logs are retained for as long as we operate the Service for product improvement and debugging; you may request deletion at any time. Billing records are retained as required by tax and accounting law (typically 7 years).

7. Children

20Bot is not intended for users under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

8. Security

We use industry-standard practices including HTTPS, encrypted-at-rest token storage, principle-of-least-privilege OAuth scopes, and infrastructure access controls. No method of transmission or storage is 100% secure; you use the Service at your own risk.

9. Changes

We may update this Policy from time to time. Material changes will be posted on this page with a new "Last updated" date. If changes are material we will also notify active account holders by email.

10. Contact

20sec Inc.
Email: 20sec.app@gmail.com