Privacy Policy

1. Who we are

Agent I2I ("Phos") is a desktop application for teaching and running industrial robot tasks, published by Phos PAI, Inc. ("Phos PAI", "we", "us"). This policy explains what the software and this website collect, why, who else touches it, how long we keep it, and how to have it deleted.

Write to support@phospai.com with any question about this policy or any request under it.

2. The short version

What we do collect is small and specific: enough to know who has a subscription or access we have granted (an email address; if you continue with Google, the name and profile picture on that Google account; and — if you use a password instead — a hashed password held by our identity provider, never by us), enough to enforce the one-computer limit, the licence check-in and the sign-in every 30 days (a machine identifier, a machine name, its operating system, and check-in times), and — only if you send one — the contents of a bug report. Payments are handled by Stripe, and your card details never reach us. There is no analytics, no usage tracking and no crash reporting in Phos, and no tracking cookies on this website. The connections Phos makes on its own are listed in section 3; one of them, the update check of an installed copy, carries a random identifier for that installation.

3. What stays on your computer

This is the product's central claim and it is worth stating precisely.

Phos has three voice features — speech recognition, the command understanding that turns what you say into robot steps, and the voice the rig answers in — and each can run either on the computer in front of you or online. The first time Phos starts, it asks which you want; neither is chosen for you, and you can change each feature on its own in Settings later. The Chat Agent, which helps you edit a program, is off until you turn it on, and then also runs either way.

To run on your computer, Phos needs its local module, which the application downloads from our content-delivery provider only when you choose it. Once it is installed, those features run as local processes on your machine, using models stored on it, and need no API key and no internet connection. Running online is described in section 4.

Whichever you choose, the application must reach our licence service from time to time, and each computer must sign in again through your browser every 30 days (sections 5 and 7). An installed copy also asks our update server for a newer version of itself when it opens and every few hours after; that request names the kind of computer the update is for and carries a random identifier the updater creates once for that installation. None of these connections carries anything about what you teach. On Windows and Linux, version 0.1.1 of the application may also download a spellchecker dictionary from Google's servers, which receive your computer's IP address; later versions make no spellchecker downloads.

Everything a teaching session produces is written to a plain folder on your computer — your tasks, your plans, your recordings and the taught programs. A recording contains the robot's motion telemetry, the actions that were taught, and a timed transcript of the words spoken during the session. When speech recognition runs on your computer, a recording also keeps the microphone audio of each voice session, as the recogniser heard it. It is kept so that a session in which speech was not heard can be diagnosed, and it is an ordinary file in that folder, which you can delete. If other people speak in your cell, it is for you to tell them that voice sessions are recorded, and to obtain any consent the law where you operate requires. None of that is uploaded to us, indexed by us, or visible to us unless you send us a bug report (section 8). It is on your disk and you can browse, copy, move or delete it without the application's help.

The application also writes logs of its own working. They go to your operating system's usual folder for application logs, not to the folder above, and they stay on your computer, apart from the one log a bug report carries (section 8).

4. Running online, with your own account

If you choose to run any of those features online, you supply your own API key for the provider that runs it: OpenAI for speech recognition, command understanding, the voice and the Chat Agent, or — for speech recognition only — AssemblyAI or Deepgram instead. There is deliberately no key of ours anywhere in the product.

Your key is stored only on your device. In the desktop application it is kept encrypted by your operating system's own secret store — the Keychain on macOS, DPAPI on Windows, the desktop keyring on Linux — and is decrypted only inside the application, to hand to its own backend process on your computer; once it is saved, the application's screens are only ever shown it masked. On a computer whose secret store cannot protect it, the key is not saved at all: it is held while Phos runs, and you enter it again the next time. We never receive your key, and the application never sends it to us.

When a feature runs online, what it needs is sent from your computer directly to the provider you chose, under your own account and your own agreement with them:

• speech recognition: the microphone audio of a voice session and of a bug report you dictate, and the phrases you have defined, to help it recognise them;
• command understanding: the words that were heard, with what is needed to interpret them — the words said just before, the steps taught so far, the robot's current state, and any phrases you have defined;
• the voice: the sentences the rig speaks;
• the Chat Agent: what you write to it, and the program it is working on.

It does not pass through us. What that provider does with it is governed by their privacy policy, not this one.

While any feature runs online, the application also checks, each time it starts, that it can open a secure connection to OpenAI — even when the provider you chose is AssemblyAI or Deepgram. That check sends nothing beyond opening the connection.

Phos PAI does not supply, resell or pay for these online services: a feature that runs online always runs under your own account with the provider you chose. If that ever changes, we will update this policy before it does.

5. Signing in

You sign in on our own domain, on a page operated for us by our identity provider, Auth0. There are two ways to do it: Continue with Google, or an email address and password.

• If you continue with Google, Google confirms your identity to Auth0 and shares the email address, name and profile picture on that Google account, which Auth0 keeps with your account. We do not receive your Google password, and we do not get access to your Google account beyond that confirmation.
• If you use an email address and password, Auth0 stores your email address and a hashed password, sends the verification and password-reset mail, and checks your password against known breached-credential lists so that it can warn you or require a change.

A new email address must be verified before it can be used. Google and email/password are separate sign-in methods and are not automatically linked, even when the email address matches. Use the method you originally used to access your account, subscription and activated computers. If you cannot access that method, contact support@phospai.com.

Auth0 also keeps the ordinary security records a sign-in service keeps, such as when and from where a sign-in happened, in order to detect abuse.

Every computer signs in again every 30 days. At least once every 30 days, each computer running Phos asks for a fresh sign-in on our sign-in page, in your browser; a saved sign-in does not count. In between, the application keeps your sign-in session on your computer, encrypted by your operating system's secret store — or, where there is none that can protect it, only in memory while Phos runs. The token the application presents to our licence service carries the time of your last sign-in; the service uses it to refuse a licence when that sign-in is more than 30 days old and to set the licence's check-in deadline no later than 30 days after it, and does not store it.

6. Buying a subscription

To sell you a subscription and to give the application a licence, we collect:

Payment card details never reach us. Stripe's hosted checkout collects them; our systems never see, store or process a card number.

7. Activations and the licence check-in

A subscription covers one computer at a time, and the software must reach our licence service at least once every 30 days to keep working. To make that work we collect, for each activated computer:

• a machine identifier — a one-way hash, computed on your computer, of the identifier your operating system gives it, which lets us tell one computer from another and enforce the one-computer limit, and is of no use outside Phos;
• a machine name — the name the computer goes by (on a Mac, its Computer Name), so you can recognise which of your computers an activation belongs to when you look at your account;
• its operating system — macOS, Windows or Linux;
• activation and check-in times — when the computer was activated, and when it last successfully contacted the licence service, which is what the offline deadline is measured from.

A check-in is a short request from the application to our licence service, made every few hours while Phos is open and the computer is online. It carries your sign-in token, which names your account, its email address and when you last signed in, and this computer's identifier, and it gets back a fresh licence document. It does not carry anything about what you have taught, what you are running, or what is on your computer. Like any internet request it reaches us with an IP address, which our hosting providers log.

The licence document names your account (its identifier and email address), the computer's identifier, your plan and term, and its dates. It is kept on your computer, where the application reads it — including the part of the application that drives the robot, which checks the licence itself before it will teach or run a task. It is not sent anywhere else.

When you move Phos to another computer and release the old one from your account, its activation record is deleted.

8. Bug reports — the one time your machine's data comes to us

Phos has a "Report a bug" feature. A report is written to your disk first and sent afterwards, so that filing one works in an offline robot cell; if the send fails the report stays on your machine and is retried later, and the application shows you when a report has not been sent. Sending happens only because you filed a report. Nothing here is collected in the background.

A report carries a fixed set of diagnostics, with no opt-out — a report without them is a conversation that has to happen twice — so it is worth knowing exactly what they are.

What a report contains

• What you wrote in the report box, whether typed or dictated. Dictation goes through whichever speech recognition you chose (sections 3 and 4).
• About the installation: the application version, your operating system and platform, the Electron, Chrome and Node versions, the browser user agent, the screen you were on, the path of the application's data folder, and the address of the local backend service.
• About the backend: its health report — which includes, among other things, the robot's network address — or the error we got when asking for it; the last 50 lines of its output held in memory; and the last 128 KB of its log file in the report itself, with the whole log file uploaded as an attachment. That log records what the backend did, and can include words it heard. It is never trimmed, so it covers every session on that computer, not only the one the report is about.
• Hardware and saved configuration: your operating-system version and architecture, CPU model and speeds, total and available memory, total and available disk space, and graphics-device and driver details that the operating system makes available. The report also includes your saved robot-cell configuration (including robot and gripper models, connection address, attached devices, tool settings and motion/I/O defaults), your selected speech, language-model and voice providers, and whether testing mode is enabled. It does not read your saved API keys or sign-in session.
• Application logs: the backend, desktop startup, sign-in, licensing, updates and local-model-server logs that exist on your computer. Up to the final 128 KB of each is included in the report, with full available logs attached separately. These logs can include account email addresses, installation paths, earlier sessions and events after you saved the report. Known authentication values, URL query strings and Stripe session links are removed from log copies before they are included, uploaded or exported; the original local logs are not changed. Missing diagnostics are recorded as unavailable.
• The application's own errors: a ring of the last 100 errors the interface itself recorded — console errors, uncaught errors and unhandled promise rejections.
• An interaction trail: the last 200 things you did, in order — the screens you visited and the controls you pressed, each named the way a screen reader would name it, and, for an edit, the name of the field you changed.
• Recent work on your programs: the last 200 entries of the application's requests to its program library and the answers — which include program contents, the names you gave things, and what you wrote to the Chat Agent and what it answered — each cut short at 24,000 characters, with any field named like an API key, an authorization, a password, a secret or a token blanked out. If you filed the report from a program's screen, that program's saved Chat Agent conversation is included too.
• A listing of your recorded runs: for every run in the recordings folder, its name, its date, and each of its files with size and full path. Note that a full path normally contains your computer's user-account name.
• Recorded run data as attachments: the run the report is about, plus the five most recent runs, are uploaded alongside the report. These are the teaching recordings described in section 3 — robot motion telemetry, the taught actions, the timed transcript of what was said during the session, and, where speech recognition runs on your computer, the microphone audio of each voice session. The five most recent can include a voice session that is still in progress, or one you discarded that Phos has not yet cleared away (it clears them the next time it starts): what that session has recorded so far, including, where speech recognition runs on your computer, its microphone audio. This is the only route by which teaching data reaches us, and it travels because you filed a report.

How report contents are limited

The diagnostic collector reads only the selected robot-cell profile and specifically named provider and testing settings. It does not open saved API-key files, the sign-in session store or the process environment. Credential-looking fields are excluded from the configuration snapshot, and saved keys are shown to the application screens only masked (section 4). Automated tests check that planted credentials do not appear in the collected snapshot.

What we cannot control: the report box is free text, what you write to the Chat Agent travels as you wrote it, and a log file records whatever the software printed. Please do not paste passwords, keys or other secrets into a report or into the Chat Agent, and tell us if you think something sensitive travelled with a report so we can delete it.

Where reports go, and what we do with them

Reports are uploaded to a private storage bucket in our own cloud account, in the United States (AWS, region us-west-2). The application sends a report's files to that bucket and to no other address, and only from its own data and log folders. We use them to diagnose the fault you reported and to fix the software. We do not use them for advertising, we do not sell them, and we do not use bug-report contents to build a profile of you.

A copy of every report stays on your own machine, in the application's data folder, whether or not it was sent. You can open that folder, read a report, and delete it yourself.

In Settings → Phos Setup → Bug reports, Save a copy… exports one ZIP to a location you choose (Downloads by default). It contains the report, available logs and all recorded runs listed in that report, which can be more than the five recent runs attached to an automatic upload. You can review it and send it to support yourself; exporting the ZIP does not send it.

9. This website

The site is a set of static pages. There is no analytics, no advertising, and no tracking cookie on it.

• Hosting. Our pages, our installers and our update files are served by our hosting and content-delivery providers, which receive your IP address and the usual request information in order to serve the page, and keep operational logs.
• Fonts. Pages load web fonts from Google Fonts, so your browser makes a request to Google's font servers, which receive your IP address and user agent. No cookie is set by that request.
• Contact and careers forms. If you fill in a form on this site, what you enter — including your name, work email, company, job title, country and message — is delivered to a Phos PAI inbox through a third-party form-delivery service (Web3Forms). We use it to reply to you.
• Checkout and sign-in. These are hosted by Stripe and by our identity provider respectively, on their own pages, and they set the cookies they need to work.

10. Who processes data for us

Each of these acts for us under its own terms and its own privacy policy. OpenAI, AssemblyAI and Deepgram are not on this list: when you run a feature online, they act for you, under your own account and your own agreement with them (section 4). We do not sell personal information, and we do not share it with anyone for advertising. We may disclose information if the law requires it, or to establish or defend legal claims, and we may transfer it as part of a merger, acquisition or sale of assets, in which case this policy continues to apply until you are told otherwise.

Our services are hosted in the United States. If you are outside the United States, using Phos means your information is processed there. Where the law of your country requires a safeguard for personal information transferred to the United States — as the GDPR does in the European Economic Area and the United Kingdom — we rely on the Standard Contractual Clauses approved for that purpose, or on another mechanism that law recognises, including in our contracts with the providers above. A business customer that needs a data processing addendum can ask for one at support@phospai.com.

11. How long we keep things

Two things are already fixed and are not a matter of policy: Stripe keeps the payment and invoice records it is required by law to keep, and what is on your own machine — your recordings, the application's logs, and the copy of a bug report — stays there until you delete it.

12. Getting a copy, or having it deleted

Write to support@phospai.com from the email address on your account, and tell us what you want:

• a copy of the account, subscription, granted-access, activation and bug-report data we hold about you;
• a correction to anything that is wrong;
• deletion of your account and the data associated with it;
• deletion of a specific bug report — tell us roughly when you sent it and what it was about, and we will find it and remove it, along with its attachments.

Two honest limits. Deleting your account deletes your licence record, and the software will stop working at its next check-in; cancel your subscription first if you do not want to keep paying. And we cannot delete the billing records Stripe is legally required to retain, or records we need to keep to defend a legal claim.

We answer every request within 30 days, and we give a copy in a common machine-readable format. We confirm that a request is yours by checking that it comes from the email address on your account, and we may ask for more if we cannot. Someone you have authorised in writing may make a request for you. We will not treat you differently for using any of these rights. If we decline a request, we will tell you why; you can appeal by replying to that answer, and we will answer the appeal within 45 days.

California residents

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect, use and disclose about you, and to receive a copy of it; to have it corrected or deleted; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights. We do not sell or share personal information, as that law defines those words, and the only sensitive personal information involved, a password, is held by Auth0 as a hash and used only to sign you in.

In the last twelve months we have collected these categories of personal information, for the purposes in sections 5 to 9, and disclosed them only to the providers in section 10, for those purposes: identifiers (your email address, the name and profile picture on your Google account if you continue with Google, a machine identifier and name, and IP addresses); customer records (the name, billing address and any business tax identification number you give at Stripe's checkout, section 6); commercial information (your subscription and billing record, and any access we granted you); internet or other electronic network activity (licence check-ins, and the interaction trail and logs in a bug report you send); audio information (microphone audio in a bug report you send, where speech recognition runs on your computer); and professional information you give in a website form.

Europe and the United Kingdom

We sell to businesses in the European Economic Area and the United Kingdom (consumers there cannot buy; see section 2 of the Terms of Service). Where the GDPR or the UK GDPR applies to your information, Phos PAI is its controller, and we rely on these legal bases: performing our contract with you or your organisation, for your account, subscription, licence and support; our legitimate interests in securing our services, in diagnosing and fixing the faults you report, in delivering this website (including the IP addresses our hosting providers and Google Fonts receive, section 9), in keeping installed copies of the software up to date (including the update check's installation identifier, section 3), and in answering what you send us through this website; and complying with the law, for billing and tax records. You also have the right to restrict or object to our processing, to receive your information in a portable form, and to complain to the data protection authority where you live or work.

13. Security

We use industry-standard measures to protect the data we hold: encrypted connections, private storage that is not publicly readable, and access limited to the people who need it. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects you, we will tell you as the law requires.

On your computer, the application keeps your sign-in session and your API keys encrypted by the operating system's secret store (or only in memory, where there is none that can protect them), and its own background process refuses every request that does not come from the Phos window that started it, except a status check, which it answers without asking who is asking; that status check includes the robot's network address and the path of the current recording, which normally contains your computer's user-account name. A bug report's files go only to our bug-report store (section 8). Beyond that, your API keys and your teaching data live on your computer, so the security of that computer is yours to manage.

14. Children

Phos is industrial software sold to businesses and adults. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to us and we will delete it.

15. Changes to this policy

We may update this policy. The date at the top says when it last changed. If a change is material we will give reasonable notice before it takes effect, by email or in the application.

16. How to contact us

Phos PAI, Inc. — support@phospai.com