Privacy Policy

Autumn's Privacy Policy describes how Autumn collects, uses, and shares your personal information. It also explains your choices about how we use your personal information, including how you can object to certain uses of it and access and update it.

Some important definitions:

Papasan, LLC, doing business as Autumn, and our relevant affiliates are referred to as "Autumn," "we," "us," and "our."

Our public websites, including onautumn.com, are referred to as the "Website."

Our online software-as-a-service platform, including any related APIs provided by Autumn and all related applications, is referred to as the "Services."

Organizations use the Services to make websites, stories and forms and to publish them to their own audiences. We call the people who sign in to Autumn "users," and the people who visit a website or story made with Autumn "visitors."

When an organization publishes a website or story with Autumn, that organization decides what it collects from its visitors (for example, through its forms) and is responsible for it. We process that information on the organization's behalf, to provide the Services to it. This policy describes what Autumn itself does; the organization's own privacy policy applies to how it uses what it collects.

001 Personal Information

We collect personal information when you provide it to us, and when you use our Website and Services, as described below.

A. Information you provide to us

• Account creation: When you create an account, we collect your name, email address and password. We store your password only in a protected (hashed) form.

• Requesting access: When you ask for access to Autumn for your organization, we collect your organization's name and web address, your role, and what you plan to use Autumn for.

• Content you create: We store what you and your organization create and upload in the Services, such as text, images, video, documents, brand details, websites, stories and forms.

• Your communications with us: We collect personal information, such as your email address, when you request information about our Services, request customer or technical support, or otherwise communicate with us. We also collect the contents of messages or attachments you send us, and other information you choose to provide with your communications.

B. Information we collect automatically

• When you use the Services: We record when you last signed in. When you sign up or verify your email address, we use your IP address briefly to limit repeated attempts; we do not keep it.

• Visitors to stories made with Autumn: To show organizations how their stories are read, a story stores a random identifier in the visitor's browser (replaced after 90 days) and a session identifier that ends after 30 minutes of inactivity. We record which story and scenes were viewed, for how long, whether the story was finished, clicks on tracked links and buttons, campaign tags in the address (UTM), the website the visitor came from, the page they landed on, their screen size, a general device type, and their country. We do not keep visitors' IP addresses or full browser details.

• Visitors to websites made with Autumn: We do not store page views or set cookies for websites made with Autumn. Organizations may add their own analytics tools to their stories; those are governed by the organization's own privacy policy.

• Forms on websites made with Autumn: When a visitor submits a form, we store what they entered and any files they attached, for the organization that owns the form. We store the visitor's IP address with a submission only if the organization turns that on. We may email the submission to the organization and, if the organization sets it up, send the visitor a confirmation email. We use the visitor's IP address briefly to limit spam, and may use Cloudflare Turnstile to check that a form was filled in by a person. Each organization chooses how long its submissions are kept; expired submissions are deleted automatically.

Google and Microsoft calendar data

Autumn Scheduling lets members of an Autumn workspace connect a Google or Microsoft calendar so that people can book time with them. This section explains what we access when you connect a calendar, why, and what you can do about it.

What we access

When you connect a Google account, you choose to grant Autumn access to:

• Your email address and basic account identity, so we can show which account is connected and tell connections apart.

• Your list of calendars, so you can choose which calendars Autumn checks for conflicts and which one receives new bookings.

• Your free/busy information for the calendars you select. This tells us when you are busy. It does not include event titles, descriptions, attendees or locations.

• Events that Autumn creates. When someone books time with you, Autumn adds the booking to the calendar you chose, and updates or removes it when the booking is rescheduled or cancelled. The event contains the booking's details, such as the meeting name, time, the guest's name and email, their notes, and a video-call link if you asked for one. Autumn adds no guests to the event, so Google sends no invitations on our behalf.

Microsoft accounts work the same way. For Microsoft, Autumn reads only the start time, end time and busy status of events on the calendars you select.

How we use it

We use Google user data only to provide and improve the scheduling features you see in Autumn:

• showing times you are free on your booking pages

• preventing double bookings

• adding, moving and removing the bookings made through Autumn

We do not use it for advertising. We do not sell it. We do not use it to build user profiles for any other purpose.

We do not send your calendar data to AI model providers, and we do not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models.

Sharing

We share Google user data only:

• with the service providers that host and operate Autumn (such as our cloud hosting, database and email delivery providers), to provide the features above

• when the law requires it

• as part of a merger or acquisition, with notice to you

People who book with you see only the times you are available, never your events.

Storage and security

• Access and refresh tokens are encrypted at rest and never returned by our API.

• Free/busy results are cached for up to 3 minutes and not stored beyond that.

• We keep the IDs of the events Autumn created, so we can update or remove them later.

• All data is sent over HTTPS.

Retention and deletion

• You can disconnect a calendar at any time from Scheduling in Autumn. Disconnecting deletes the stored tokens and the list of calendars immediately. Events Autumn already added to your calendar stay there, because Autumn can no longer reach it; delete them yourself if you want them gone.

• For each booking, Autumn keeps which account and calendar its event was written to (the account's email address and the calendar's ID, never tokens), so reconnecting the same account updates those events instead of duplicating them. This is removed with the booking's guest details (below).

• You can also remove Autumn's access from your Google Account at https://myaccount.google.com/permissions, or from your Microsoft account at https://account.live.com/consent/Manage. If you do, Autumn stops reading your calendar and asks you to reconnect.

• If you leave a workspace, your calendar connections for that workspace are deleted.

• Guest details on bookings (name, email and note), the cancellation reason, the emails Autumn wrote about the booking, and the calendar account details above are cleared 12 months after the meeting, or 90 days after a cancellation. The booking record itself (its time, link and status, with no guest details) is kept so booking counts stay accurate.

• To ask for deletion of any other data, contact privacy@onautumn.co.

Limited Use

Autumn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

002 How We Use Your Information

We do not sell your personal information. We do not share your personal information with third parties for them to market or advertise their products to you.

We use your personal information to:

• provide the Services and the information you ask for, including identifying and communicating with you, managing your information, responding to questions, comments and other requests, and answering requests for customer or technical support;

• administer the Services and communicate with you, including authenticating and verifying identities, telling you about your account and changes to this Privacy Policy, preventing and prosecuting potentially prohibited or illegal activities, enforcing our agreements, and complying with our legal obligations;

• provide features that use AI.

Features that use AI. Some features of the Services use AI models to generate or analyze content, such as writing and editing stories, describing images, video and documents, transcribing audio, and analyzing a brand's look and voice. To provide these features, we send the content involved to our AI model providers (OpenAI, Anthropic, Google and Amazon Web Services). We use these providers through their business services, under terms that do not allow them to use the content we send to train their models.

Consent. We may use personal information for other purposes that are clearly disclosed to you at the time you provide it, or with your consent.

003 Service Providers

We share personal information with companies that help us run the Services, only so they can do that work for us:

• Hosting and infrastructure: Amazon Web Services, Cloudflare and Laravel

• Email delivery: Amazon Web Services

• AI models: OpenAI, Anthropic, Google and Amazon Web Services

• Search: Typesense

• Error monitoring: Sentry

• Images: Unsplash, when you search for stock images

• Spam protection for forms: Cloudflare

We may also share information when the law requires it, to protect our rights or others' safety, or as part of a merger, acquisition or sale of assets, with notice to you.

004 Your Choices

You may have the right to object to or opt out of certain uses of your personal information. Contact us as set out below.

005 Your Privacy Rights

Depending on your location and in accordance with applicable laws, you may have the right to:

• Access personal information about you, consistent with legal requirements. In some cases you may also have the right to receive your electronic personal information or have it transferred to another party.

• Request correction of your personal information where it is inaccurate or incomplete.

• Request deletion of your personal information, subject to certain exceptions prescribed by law.

• Request restriction of, or object to, processing of your personal information.

• Not be discriminated against by us for exercising your privacy rights.

If you would like to exercise any of these rights, please contact us as set out below. We will process such requests in accordance with applicable laws. To protect your privacy, we will take steps to verify your identity before fulfilling your request.

If you are a visitor to a website or story made with Autumn, please contact the organization that runs it first; we will help it respond to your request.

006 Data Retention

We store the personal information we receive as described in this Privacy Policy for as long as you use the Website or Services, or as necessary to fulfill the purposes for which it was collected, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws. Specific periods for form submissions are described above.

007 Security of Your Information

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

By using the Website or Services or providing personal information to us, you agree that we may communicate with you electronically about security, privacy and administrative issues relating to your use of them. If we learn of a security breach, we may attempt to notify you electronically by posting a notice on the Website, by mail, or by sending you an email.

008 Third-Party Websites and Applications

The Website and the Services may contain links to other websites and applications, and other websites and applications may reference or link to ours. These third-party services are not controlled by us. We encourage you to read the privacy policies of each website and application you use. We do not endorse, screen or approve, and are not responsible for, the privacy practices or content of other websites or applications. Visiting them is at your own risk.

009 Children's Information

The Website and Services are not directed to children under 13 (or another age as required by local law), and we do not knowingly collect personal information from children. If you learn that your child has provided us with personal information without your consent, you may contact us as set out below. If we learn that we have collected a child's personal information in violation of applicable law, we will promptly delete it and close the child's account.

010 Supervisory Authority

If you are located in the European Economic Area or the UK, you have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal information violates applicable law.

011 Changes to Our Privacy Policy

We may revise this Privacy Policy from time to time at our sole discretion. If there are any material changes, we will notify you as required by applicable law. You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use the Services after it takes effect.

Contact Us

If you have any questions about our privacy practices or this Privacy Policy, please contact us at privacy@onautumn.co or by mail at:

Papasan, LLC (doing business as Autumn), 121 N Linwood Ave, Baltimore, MD 21224, United States