Villages - Privacy Policy

Version 3.2 - 30 October 2026. Applies to villages.work, the Villages web app, Villages on WhatsApp, the Villages browser extension, the Villages connector for AI assistants (mcp.villages.work), and the paused Villages Mac app for the people who already have it.

Villages exists to hold sensitive things carefully. This policy is written to be actually read. Where it says "we", that means Villages Networks Ltd, the UK company behind Villages, which acts as the data controller. Its founder, AJ (Edward Ashton Johnson), is the person to contact. Contact: aj@villages.work.

The short version

Villages maps your real network, keeps track of the people in it for you, notices when someone you know can help with what you are working on, and drafts the message. To do that it needs to know who you know and what you talk about. It gets that from sources you connect, keeps it in your own encrypted store, and shows it to exactly one person: you. It never sells data, never advertises, never uses anything from Google to train AI models beyond your own account, and never builds a shared profile of anyone by combining what different users know.

What Villages stores

People in your network. Names, roles, companies and links, from files you provide (a LinkedIn export, phone contacts), from sources you connect (below), or from facts you state in conversation.

How you interact. Who you email and meet, how often and when. If you connect your email, Villages also keeps the text of your emails for 12 months from the date each one was sent (see Google, below), so it can remember what you and each person talked about. After 12 months only the notes about people stay. Messages between you and other people are still never kept: their text is looked at once to make notes and then dropped. (Your own conversation with Villages, above, is different.) If you link a call recorder, the transcripts of your calls are kept, with the notes made from them (see Call recorders, below).

Distilled signals. One-line facts about people, each with its source and date, such as "raising a seed round, Aug 2026" or a single short quote from a call that captures what someone needs. Never a chat log.

Your conversation with Villages. What you and Villages say to each other is kept, word for word, so Villages can pick up where you left off and remember what you asked: the messages you send Villages on WhatsApp, or by email to a Villages address, and the replies Villages sends you. Sign-in links are taken out before anything is kept. Each message is sealed (encrypted) before it is written, so the database holds no readable text. It belongs to you, not to a network: there is one conversation with Villages across every network you are in. When Villages answers you, the AI that writes the reply is given your recent messages in that one network, never another network's, through the providers named under "How AI is used". What Villages is given permission to see between you and other people (your mailbox, your chats, your calls) is not part of this conversation and is handled as described under "Where the context comes from".

Who can read your conversation. No one at Villages reads it, unless you ask us to, for security, or where the law requires it. There is no staff review of conversations. The person who runs your network never sees your words. They see what came of a conversation (an ask you agreed to share, your answer to a check-in, a setting you changed) and, if you gave feedback, a short summary of it, never what you wrote.

Your own profile (the "twin"). Distilled facts about you: goals, challenges, constraints, how you work. Each carries where it came from and how confident Villages is. Anything that might be personal or tender (doubt about your own role, health, family, a crisis) is never stored quietly. Villages asks you first, in plain terms: who can know this - anyone, people in your network, people in your close circles, or no one? "No one" means it is not kept. The most sensitive entries are stored in two parts: a locked specific version that only you can unlock in the moment, and a general version ("navigating founder-role doubt") that Villages may use to find people who have been through the same thing.

Account and billing. Your sign-in identity (name and email address, via WorkOS) and, when you subscribe, a Stripe customer reference. Villages never sees or stores your card details.

The waitlist. If you join the waitlist on villages.work, we keep your name, your email address, what you tell us about why you are interested, and which page you joined from. We use them only to decide the order of invitations and to invite you. They are kept in our database in the EU (Supabase, Paris) until you are invited or ask us to remove them; email aj@villages.work at any time.

What Villages never stores

Email attachments, or the text of any email more than 12 months old. Messages between you and other people, or the audio or video of a call. Anything you have asked it to forget. Anything sensitive about you without asking you first. Other people's intimate details (their health, relationships, private difficulties) are never turned into notes or used for anything, even though they may appear in email text Villages holds for you.

Where the context comes from

Each source is connected only if you choose to. Villages does its work on its server. Email and call transcripts are the two sources whose text Villages keeps, for 12 months, as described below. For everything else, anything that has to be looked at passes through in memory, is turned into counts or short notes, and is dropped. It is never written to disk.

The Mac app (paused). Villages used to offer a Mac app that gathered context from WhatsApp and iMessage on your Mac. It is paused and not offered to new people. If you used it, what it gathered stays in your store until you delete it, which you can do from Your data at any time.

Your choice. Making notes from your chats and calls, and looking people up, is on by default because it is what lets Villages spot who could help. If you would rather it didn't, choose "Just who and how often" in Settings ("How deep Villages goes"): Villages then keeps only who you talk to, how often and when, and nobody is looked up. Either way, anything private about the other person (their romantic life, health, family or money difficulties, substances, grief) is dropped by rule, both in the instructions the model follows and by a second check afterwards, and anything tender about you follows your storage setting (below). What was already distilled stays until you delete it.

Your storage setting. You decide what Villages may keep about you when something tender comes up in a call or a chat: ask you each time (the default), keep it visible to Villages only, keep it and let people in your network or only your close circles know the general version, or never keep anything tender. It is in the app, under "What Villages may keep about you", and your AI assistant can change it on your instruction.

LinkedIn. Your connections export (name, headline, company, connection date, and email address where the person shared one with you), uploaded as provided. Only the connections list is used; your LinkedIn messages stay in the file.

Google (Gmail and Calendar). Connected with your permission through Google sign-in. Villages asks for three Google permissions:

• Read-only Gmail, to gather context from your emails.
• Gmail drafts, to put emails it writes for you into your own Drafts folder. Google describes this permission as "manage drafts and send emails". Villages does not send anything unless you press send (see Drafts and calendar invites, below).
• Calendar events on calendars you own, to see who you meet and what about, and to create or answer meeting invites when you ask.

When you connect, Villages goes back up to ten years through your email and calendar to build the picture of your network.

What it keeps from your email. Newsletters, notifications, mailing lists and automated senders are skipped before anything else happens. For the rest, Villages keeps: who each email was between, with their email addresses, and when; the text of the email, without attachments, signatures or the quoted history under a reply, for 12 months from the date it was sent; notes about each person, each with its date and a link to the conversation in your own Gmail that only you can open (for example "Talked about a seed round. From an email, Mar 2026"); and the introductions you have made and received, with who was introduced to whom, when, and what came of it. Emails more than 12 months old are looked at once to make notes and then dropped, and text passes out of your store as it reaches 12 months.

What it keeps from your calendar. Who attended, when and where, and the title and description of meetings with up to twelve other people.

All of it sits in your own encrypted store and is shown only to you. Notes made from your email are not given to your AI assistant through the Villages connector, and are not used in anything Villages suggests to someone else.

Your Google sign-in token is stored on Villages' server, inside your own encrypted store, so the work can continue after you close the page. You can revoke access at any time from your Google account or by disconnecting in Villages. When you disconnect a mailbox, the permission is withdrawn at Google, the token is removed, and everything that came from that mailbox, including email text, is deleted. Deleting your account withdraws the permission at Google as well.

Drafts and calendar invites. When you ask Villages to make an introduction, follow up with someone or arrange a meeting, it writes the email as a draft in your own Drafts folder, or prepares the calendar invite. Nothing goes out until you press send or confirm the invite yourself. To write the way you do, it learns from your own sent emails how you usually greet people, sign off, and how long and formal you are; what it learns is used only for your account. Later, Villages will offer to send these for you once it has learned how you write. That stays off unless you switch it on, you can switch it off at any time, and every email or invite Villages sends for you is recorded in your access log.

Microsoft 365 and Outlook. Connected with your permission through Microsoft sign-in, for people whose email is with Microsoft, through Microsoft Graph. Villages asks Microsoft for the same as it asks Google, in Microsoft's own two permissions:

• Mail (read and write), to gather context from your emails and to put emails it writes for you into your own Drafts folder. Microsoft has no permission that only reads and writes drafts, so this one also allows moving or deleting mail. Villages never moves or deletes your mail.
• Calendars (read and write), to see who you meet and what about, and to create or answer meeting invites on your own calendars when you ask. Villages only ever changes an event it made for you.

Villages never asks for permission to send mail from your Microsoft account. Nothing goes out unless you press send. When you connect, Villages goes back up to five years through your email and calendar. What is kept, for how long, and what happens when you disconnect are the same as for Google, above. Your Microsoft sign-in token is stored on Villages' server, inside your own encrypted store, so the work can continue after you close the page. You can disconnect a mailbox at any time under Your data in Villages: the token is removed and everything that came from that mailbox, including email text, is deleted. Microsoft gives an app no way to withdraw its own permission, so to take Villages off Microsoft's list as well, remove it in your Microsoft account (account.microsoft.com, under Privacy, for a personal account; myapps.microsoft.com for a work one). If your employer's Microsoft 365 restricts outside apps, its administrator has to approve Villages once before you can connect. If you sign in to Villages with Microsoft, that one Microsoft screen both signs you in and connects your email and calendar, and it lists both; your Villages account itself is still held with WorkOS, as for every other way of signing in.

How Villages uses Google data. Villages' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data, whether raw or turned into notes:

• is used only to provide the features described in this policy
• is never used for advertising, and never sold
• is never read by a person, except with your explicit permission, for security purposes, or where the law requires it
• is never used, by Villages or anyone it works with, to develop, improve or train generalised or non-personalised AI or machine-learning models. Google Workspace APIs are not used for this. Where Villages learns from your Google data, such as how you write, that learning is used only for your own account.
• is passed to AI providers only to carry out a task for you, never for them to train their models.

The text of your email and calendar events, and the notes made from it, are processed only by DeepInfra, which holds them in memory for the one request and does not keep them or train on them. [CHECK: add any new memory or search provider] When you ask Villages a question or have it draft a message, Anthropic is given the people involved with how close you are and when you were last in touch, which Villages works out partly from who you email and meet, and their company and city; Anthropic does not train on it and keeps it for up to 30 days.

Call recorders (Fathom, Fireflies, Granola, tl;dv). If you link a recorder, Villages fetches each call's transcript, distils it into a few lines per participant (what they are working on, need or have been through, plus at most one short quote), a few lines about you, and a short note of what the call covered (topics, decisions, next steps, so you can ask "what did we last talk about"). To make these notes, each transcript, with the call's title and date and the names and email addresses of the people on it, is sent to Anthropic (the Claude models), which does not train on it and keeps it for up to 30 days. It also keeps the transcript, without the audio or video, in your own encrypted store for 12 months from the date of the call, so it can remember what was said. Your recorder API key is stored encrypted on the server. Granola notes come either from Granola's own service, with a key you provide, or from its cache on your Mac; both go through the same one-step distillation.

Your AI assistant. When you use Villages inside Claude, ChatGPT or another assistant, that assistant may save distilled facts to your Villages store on your instruction (for example after scanning your calendar through its own connector). The conversation itself stays in your assistant, under your agreement with its provider.

The browser extension (Chrome). If you install the Villages extension, it works on two pages: Gmail and LinkedIn profiles. When you open or write an email, it takes the names and addresses of the people on that email; when you open a LinkedIn profile, the name and the profile address. Each email address is turned into a one-way hash in your browser before anything is sent; the address itself never leaves the page. The extension sends only that hash, the name and, on LinkedIn, the profile address to your own Villages store and asks one question: is this someone I know? If it is, the panel shows what your own store already holds about them. On a LinkedIn profile you open, it also gathers the public work history shown there (the roles and dates in the Experience section) and saves it to that person's profile in your private store, so their background is right when Villages suggests who could help with something. It never runs on the inbox list or on any other website. Nothing is created from a lookup; a person is only matched, never added. The notes you type in its panel, and anything you tell it in the chat box, update that person's profile; the chat text itself is not kept. "Research deeper" runs the same public-web enrichment described below. The extension signs in with the same account as the app and holds its sign-in token in the browser's extension storage; signing out removes it.

Context from your emails, with your say-so. A coming version of the extension can, if you turn it on, gather context from the email you are reading or writing to work out what you are trying to do (a hire, a deal, an introduction, a question), so that Villages can suggest the two or three people in your own network who could help. What leaves your browser is a short line describing the ask, never the message itself. The extension itself sends no email text, and no email text is ever used to build anyone else's profile. This is off until you switch it on, and you can turn it off per site at any time.

Public web research. Villages looks up the public work history of the people you know best, and of anyone else you ask about, including a person you want to reach cold. It searches the public web (which can include someone's public LinkedIn page) and stores a short sourced profile of what that person has publicly said and done. It never logs in to LinkedIn or any other site to collect anything, and a fact is only kept when a page names the person and matches something you already know about them. You can stop the automatic look-ups by choosing "Just who and how often" in Settings, and add anyone to a "don't research" list. Research on people outside your network may be cached and shared between users, because it is drawn entirely from public sources; nothing from your private store is ever included.

Public LinkedIn profiles. Villages may fetch a person's public LinkedIn profile by its exact address, through a provider called Apify, running a tool made by HarvestAPI. This never logs in to LinkedIn, uses nobody's LinkedIn account or password, and never looks for anyone's email address or phone number. Only a fixed list of what the profile shows is kept: the headline and summary, where they are based, their jobs with dates and their own descriptions, education, qualifications, skills, languages, published work, projects, awards and patents, and their photo. Contact details are dropped before anything is saved. A profile that comes back under a different address, or that LinkedIn marks as belonging to someone who has died, is refused. Your own correction always beats what a profile says.

Where fetched profiles and photos are kept. So the same person is not fetched again for every user who knows them, Villages keeps one copy of each fetched profile on its own server for 90 days, and each photo for 180 days, then fetches it again or deletes it. Each is filed under the LinkedIn address only. They hold nothing about who knows whom, no user's name and nothing from anyone's private store. A photo is shown only to a user whose own research found it. Anyone can ask for their copy to be deleted, and it is deleted too when the account of a user who holds that person is erased.

The people in your network (who never signed up)

Your network is made of people, so your Villages store inevitably holds information about them, and they have not signed anything. Here is the deal we hold ourselves to on their behalf. Everything stored about them comes from your own interactions and material, or from what they have published publicly; nothing is collected behind their backs. What is stored is a role, a company and short notes, and, if you connect your email, the text of their emails with you for 12 months from the date each one was sent. It is visible to exactly one person: you. Villages never combines what different users privately know about the same person; there is no shared private profile of anyone, anywhere in the system. (It does keep a shared register of who is who, described under Networks below: a name and fingerprints, and nothing that anyone privately knows.) It also keeps one copy of each public LinkedIn profile it fetches, described under "Public LinkedIn profiles", which holds only what that profile shows. (A network you belong to keeps a directory of its own members, described below. That is built from the network's records, public sources and what each member chose to share, not from anyone's private store.) The most private things about them are deliberately not stored even when they appear in your own material. In legal terms this processing rests on legitimate interests (the same basis as every address book and CRM) and we hold a written assessment of it. If someone in your network objects to being remembered by Villages, they can email us and we will remove them from the relevant store within 30 days.

Networks and communities

If you belong to a network that uses Villages (a founder community, a professional network, a fund's portfolio), the person who runs it, the operator, gives Villages its member list. Here is what that involves.

What the network holds about you. Your name, email address and LinkedIn address from the member list; a photo and a short public professional profile (drawn from the network's records and public sources, which can include your public LinkedIn profile, fetched as described under "Public LinkedIn profiles", sometimes before you join); and what you tell it yourself: what you are strong in, what you are interested in, your plans, what matters most to you at the moment, which other members you already know well, and how often you are happy to be asked to help.

Before you join. When the person who runs a network invites you, Villages may fetch your public LinkedIn profile in this way before you sign up, so that sign-up can recognise you without asking for your LinkedIn address. If you would rather not be looked up, reply to the invitation or email us, and the fetched profile is deleted.

One record of who is who. So that someone who belongs to two networks, or signs in as well as being on a list, is treated as one person and not two, Villages keeps a shared register of identities: a name, and fingerprints of the details that show two records are the same person (your sign-in, your email address, your LinkedIn profile). An email address is kept there only as a one-way fingerprint, not the address itself. Nothing anyone privately knows about you is in it.

Notes the operator adds. An operator can add confidential notes about a member to guide who is suggested to whom. They are never shown to other members and never quoted in anything Villages writes.

Asks and introductions. When you ask the network for something, Villages keeps the ask, who was suggested, who was offered to you, who you chose, what they answered and when, and what came of any introduction. This is kept as a record that is added to and not rewritten, so that reports and suggestions can be worked out from what happened. How quickly people answer is kept so that Villages can learn where and when each person is best reached. In a network, the person who runs it can see how often each of their members replies to the network's emails, counted from replies the member chose to send. Nobody else is shown it: not other members, and not sponsors. Villages never tracks whether you open an email. A link in an email from Villages may go through a short villages.work address that counts the click and takes you straight on; it sets no cookie and changes nothing.

Who makes introductions. Members do not message each other through Villages. You ask, and the person who makes introductions for your network (usually its operator) is given a few people who fit. They choose who to put to you, you choose who you would like approached, and they ask that person, in private. Nobody is approached before you have chosen them, and nobody is introduced before they have said yes.

If someone says no. Their answer goes to the person making the introduction, with the reason if they gave one. That person decides whether to tell you, and in what words. You never see who was considered and not put to you.

Who sees what. Fellow members see your directory entry and where you sit on the network's map. The operator sees the directory, the asks and where each one stands, and can see which members have helped others most and been helped most. Members do not see that. Anyone who sponsors or funds a network sees totals only, and only where enough people stand behind a number that nobody can be picked out.

WhatsApp or email. You can talk to Villages by email or on WhatsApp, and switch whenever you like; the web app works beside either. There is one Villages number for every network. You add your own number, at sign-up or in Settings, and confirm it is yours with a six-digit code Villages sends you on WhatsApp. The code is kept only as a one-way fingerprint, for 10 minutes. Your number is kept sealed (encrypted), so Villages can write back, and as a one-way fingerprint, so it can tell it is you when you write. It is never shown to the person who runs your network or to other members; they see only that you chose WhatsApp. Messages between you and Villages pass through Meta's servers, under WhatsApp's own terms as well as this policy. When you have not written for a day, WhatsApp only lets Villages start with a message Meta has approved in advance: your sign-up code, the monthly check-in, "Can you help?", "Did you two speak?", and news on your own ask. Villages never messages a number its owner has not linked themselves. You can remove your number or switch back to email at any time, in Settings or by telling Villages.

Emails from your network's agent. Villages writes to members on the network's behalf, from the network's own address, signed "Vi". There are three of these, and each asks one thing:

• A monthly check-in asking what matters most to you in the month ahead, starting from what you said last time. Your answer goes to the operator and is used to find the right people for you. What you said stops being used if you have not confirmed it for 60 days.
• "Did you two speak?" a few days after an introduction, if your operator has chosen for Villages to ask. Your answer is recorded as what came of that introduction.
• "Can you help?" when another member has shared a need, without their name, that fits what you know. Villages uses AI to judge the fit. Saying yes tells the operator; it does not put you in touch with anyone.

You can change how often you hear from Villages, or stop any of these, by replying in your own words. Anything else you say about how it is working for you is kept as feedback for the operator. If you ask for something Villages cannot do yet, your request is passed to the operator and to Villages so that it can be considered.

What the operator sees of those emails. The operator can see every email and WhatsApp message Villages has sent the members of their network, including the wording, and how many each member has received in the last three months. For a network's first month the operator is also copied on the ones Villages starts. This is so a person, not only a system, is watching what members receive.

The operator approves first. Unless the person who runs your network turns this off, nothing Villages would start with you by itself goes until they have seen it: the hello, the monthly check-in, "Can you help?", "Did you two speak?" when Villages asks, a suggested connection, and the reminder to choose. They see each message as it would reach you, can change the words, leave you out, or say not this time; only what they approve is sent, by email or WhatsApp. A message they left out is not proposed again for 21 days. Replies to something you did (your options, a sign-in link, a thank you) are never held back.

Other email. Villages also sends invitations, sign-in links and replies to things you ask for, and receives your replies to the network's address. Notes asking someone to speak to you, and introductions themselves, are drafted by Villages and sent by the operator from their own mail.

Your private store stays private. Nothing from sources you connect for yourself is shared with the network, its operator or its members.

Taking it with you, and deleting it. From the network's Settings page you can download what the network holds about you as one file, including the emails and WhatsApp messages Villages has sent you and your conversation with Villages, and you can delete what you have said and done there: your answers, who you said you know, your asks and requests, your replies when you were asked to help, your activity, your preferences, your WhatsApp number, your conversation with Villages, and the record of messages sent to you. An introduction that already happened stays on record for the other person and the operator, with your name but without your words. The operator's confidential notes are not in the download; you can ask for them in writing. Your entry in the member list (name, email address, LinkedIn address, photo and public profile) stays, because the list is the operator's. To be taken off the list altogether, ask the operator or email us and we will do it within 30 days.

If you are not a member of any network, nothing about networks is shown or stored.

Villages for Teams (referrals)

If you use Villages for Teams, a company you run or refer for holds a small shared record: its open roles, who can refer, and the referrals made. Your private store is not part of it. When Villages suggests that someone you know fits a role, that suggestion is computed from your own store and shown only to you; the company sees nothing until you choose to refer someone. A referral shares the candidate's name and the reason you wrote. Their contact details are shared only after you confirm they have agreed to be put forward, and Villages drafts the message you send them first so that consent is real. Past roles captured from a LinkedIn profile you open with the extension go into your private store only. Companies see referrals and their status; they never see your network, your other referrals to other companies, or anyone else's.

Villages for companies (the referral desk)

Some companies use Villages across their own staff to keep track of referrals between colleagues and offices. This works differently from a personal Villages, because the accounts involved belong to the company.

Company email. The company's Google Workspace administrator can give Villages access to staff mailboxes on the company's own domain. The company must tell its staff before switching this on. Each message passes through a detector that looks for referrals and introductions; the text is dropped once that is done and only the finding is kept (who referred whom, when, and where it stands). This never applies to anyone's personal accounts or to a personal Villages.

The company's own systems. The company can connect its recruitment system (JobAdder) so that referrals match the records it already keeps.

Who owns what. What sits in company accounts belongs to the company. Your own relationships are yours: if you leave, you keep your personal Villages and take nothing confidential with you.

Where it lives and who can see it

Your data sits in your own isolated store. Every request is authenticated (sign-in via WorkOS) and can only read or write your own slice; there is no code path to another user's data. Hosting is on Railway in the EU (West) region. Everything is encrypted in transit, and your private store is encrypted at rest with a key of its own, so a copy of the disk is unreadable. The text of your emails, and the email addresses of the people you correspond with, are held in this same encrypted store. Today each store's key is worked out from one master secret held by the server together with your account id; we are moving to a separately generated key per person. Recorder keys and Google and Microsoft tokens held on the server are encrypted the same way. As the infrastructure operator, AJ can technically access the server; in practice your data is accessed only to support you at your request, to debug with your permission, or if the law requires it - never out of curiosity, for sales, or for training.

What Villages does not do with your data

No selling. No advertising. No sharing with third parties beyond the processors listed below. Nothing from Google, raw or turned into notes, is ever used to train a model that learns from more than one person, and no AI provider we work with may train on your data.

How AI is used, and what it keeps

Villages uses AI to turn your material into short notes and to answer your questions. It does this through two AI providers, both US companies, each under a written agreement: Anthropic (the Claude models) and DeepInfra (which runs openly published models on its own servers in the US). The text of your email and calendar events goes only to DeepInfra. Call transcripts from a recorder you link go to Anthropic.

• Neither may train any AI on your data.
• Each gets only the text one task needs, and only for things you have switched on or asked for.
• Most of the work goes to a provider that keeps nothing: the text is held in memory while the answer is worked out, then deleted.
• Anything else is deleted within 30 days at most. We are moving everything to keep-nothing terms and will update this page when that is done.
• Looking people up online uses a search provider (Exa, US) that gets only the search itself: a name and a work detail such as a company. UK company records come from Companies House, the public register.

Villages' own matching model. Villages may train its own model to get better at suggesting the right people. It learns from what happens inside Villages (which introductions were made, what people said came of them, and what members chose to tell Villages directly), and from the transcripts of calls recorded by a service you connect, such as Fathom, Fireflies, Granola or tl;dv, and the notes made from them. It never learns from anything that comes from Google, including your Gmail, your Google Calendar and Google Meet's own recordings, or from notes made from them. If you would rather your activity was left out, email aj@villages.work.

Transfers to the US are covered by the UK's approved safeguards (the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement).

When you use Villages inside your own Claude or ChatGPT, that conversation runs in your own account, under your own agreement with that company.

Processors we rely on

• Railway - hosting, EU West.
• WorkOS - sign-in.
• Anthropic and DeepInfra (US) - AI, as described above.
• Exa (US) - public web search, as described above.
• Apify and HarvestAPI - fetch a person's public LinkedIn profile by its exact address, as described under "Public LinkedIn profiles". They get the profile address and return the public profile; they get nothing from anyone's private store.
• Stripe - subscription payments. Stripe holds your card details; we hold only a customer reference.
• Supabase - a shared database (Paris, EU). It holds public-source research caches; network records (member directories and photos, what members said about themselves, operator notes, asks, offers, introductions and their outcomes, members' preferences and feedback, and the record of emails and WhatsApp messages Villages has sent members); members' WhatsApp numbers, sealed and as fingerprints; the sealed record of what each person and Villages have said to each other; the shared register of who is who (names and fingerprints only); company records for Villages for Teams and the referral desk (staff lists, roles, referrals and where they stand); and the waitlist. Your private store is not in it.
• Resend - sends every email that comes from Villages (sign-in codes, network emails, digests and notifications) and receives replies sent to a network's address. Resend sees the addresses and the message; nothing else.
• Meta (WhatsApp Business Platform, Cloud API; US) - carries the WhatsApp messages between you and Villages' number. Meta sees your number and those messages, and nothing from your private store.
• JobAdder - only as a source, when a company connects its own account.
• Google and Microsoft (through Microsoft Graph) - only as the source of your email and calendar data when you choose to connect them, as described above. From Microsoft that is two permissions, mail and calendars, used as described above.
• Sentry (EU) - tells us when the server breaks. It gets the kind of error and where in our code it happened. It never gets the error's message, your name, your address, the page you were on or anything you wrote. Villages also keeps its own record of failures on its server, with addresses, names in quotes, numbers and links removed before anything is written.
• PostHog - product analytics, hosted in the EU. Our server sends it the names of things that happen (the map opened, a question asked, a share sent, a source connected) with a pseudonymous id and a few counts. It never receives what you asked, who you looked at, a message, a name or an email address. There is no tracking code in the app, the extension or this site, so no cookie banner.
• Vercel - hosts this website.

How long we keep it

For as long as you have an account, with one exception: the text of your emails, and the transcripts of your calls, are kept for 12 months from the date of each email or call, then deleted, leaving only the notes about people. Your conversation with Villages is kept for 12 months from each message, then deleted by a daily job. Your WhatsApp number is kept until you remove it or delete your data. Fetched LinkedIn profiles are kept for 90 days from the fetch and photos for 180 days. Disconnecting a source stops new data from it immediately, and disconnecting a mailbox also deletes everything that came from it. Anything else already distilled stays in your store until you delete it. If you erase your account, your store is removed from the server at once and from backups within 30 days. Recorder API keys and Google and Microsoft tokens are removed the moment you disconnect that source.

Your rights (UK and EU GDPR)

At any time you can: see and export everything Villages holds on you (one click at mcp.villages.work/teams/account, or from the app, gives you a zip of your whole store as readable files); read the access log, which lists every read and write of your store and how it happened; correct anything (your word always outranks the system's inference); delete anything, or erase everything yourself, immediately, with no email needed (the same page, or by asking your AI assistant); object to any processing; and disconnect any source or the whole connector, which stops access instantly. Anything you cannot do yourself, email us and we respond within 30 days, usually much faster.

Children

Villages is for working adults and is not intended for anyone under 18.

Honesty about where we are

Villages is an early product run by a small team (of one). The security is real: authenticated access, per-user isolation, encrypted transport, EU residency, your store and keys encrypted at rest, and registration with the ICO. Villages is going through Google's independent security assessment (CASA) and SOC 2 with an outside assessor. Neither is complete yet. If that matters for your situation, wait; we would rather lose a tester than surprise one. If we ever have a breach or a material change to this policy, you will hear it from us directly and promptly.

Contact and complaints

aj@villages.work for questions, exports, deletions and complaints. Villages is registered with the UK Information Commissioner's Office as a data controller, reference C2045507. You also have the right to complain to the ICO (ico.org.uk) if you believe your data is being mishandled.