Tendle

Privacy Policy

Last updated

1. Who we are

Tendle (tendle.ai) is run by Talys Inc., a Delaware corporation ("Tendle", "we", "us"). Tendle is a directory of connectors for AI agents such as Muse and Grok Bot, and it hosts those connectors at tendle.ai/connectors/{name}. This policy explains what we collect when you use tendle.ai, what we do with it, and the choices you have. Questions go to [email protected].

2. What we collect

When you browse the directory without signing in

  • Page views and prompt copies. When you open a connector's page, we record which connector and which day. When you copy its prompt, we record which connector and the time. To count each person once a day, we turn your IP address into a scrambled code (a keyed hash) using a key that exists only in our server's memory. We never store your IP address itself. The codes, and the key that made them, are replaced at the first page view or copy of each new day (UTC), and only the previous day's total is kept.
  • Your recent searches are listed only in your browser (local storage). A search you run appears in the page's address, so our server receives it to show results, but we don't record it.

When you sign in to add or manage a connector

  • Your account. Sign-in is handled by WorkOS, our sign-in provider. WorkOS holds your email address, your name, your company or workspace name, and, at each sign-in, your IP address and browser type, which it uses to prevent fraud. If you sign in with Google or GitHub, those services share your name and email address with WorkOS. WorkOS also sends our sign-in emails.
  • What you give us for a listing. That includes the connector's name, description, icon, server address, maker, support contact and links, and the contact name and work email that Meta's connector form asks for. We publish the support contact. We do not publish the contact name and work email.

When your agent uses a connector through tendle.ai

When your agent (for example Muse) calls a connector at tendle.ai/connectors/{name}/mcp, the request passes through our server on its way to the connector's server.

  • What we record: the connector, the time, the kind of request, the name of the tool called, and the status code the connector's server answered with. We use this to count how much each connector is used.
  • What we don't record: what you asked the tool to do, what it answered, your IP address, or any key or sign-in token your agent sends. We pass keys and tokens on to the connector's server so it can work, but we never store or log them. We remove your IP address before the request reaches the connector's server.

When you connect an app through Tendle's sign-in at auth.tendle.ai

Some connectors (for example Gmail, Slack or Notion) let you sign in to the app itself. For these, Tendle runs a sign-in service at auth.tendle.ai, and our service provider Composio connects your app account and runs the app's tools.

  • What we store: a random identifier for you, the connector you connected, and the sign-in grant your agent uses (it lasts 30 days). This is stored encrypted, and we store only scrambled versions of the tokens. We do not store your email address, your name or your password for the app.
  • What Composio holds: your connection to the app, including the app's access tokens, and the requests your agent makes and the app's answers, which pass through Composio to run each tool.
  • While you connect, your browser visits Composio's pages, so Composio also receives your IP address and browser details, under Composio's privacy policy.
  • A cookie on auth.tendle.ai remembers your browser, so you don't have to connect again each time (see section 7).

3. How we use it

We use this information to:

  • run tendle.ai and the connectors it hosts, and let you sign in;
  • count views, copies and tool calls, which rank the directory and show us how each connector is used;
  • test connectors and take broken ones out of the directory;
  • keep the service secure and prevent abuse;
  • answer you when you write to us.

We do not sell or share your personal information, and we do not use it for advertising. We pass the content of your tool calls through without reading, storing or logging it.

Where the GDPR or a similar law applies, we rely on these legal bases: for your account and your listings, performing our contract with you; for counts, logs and the codes that count visitors, our legitimate interest in running, ranking and securing Tendle; and, where the law requires us to keep or share information, our legal obligations.

4. Who we share it with

We share information with the service providers that run Tendle, only as much as each needs; with a connector's maker when your agent uses it (section 5); and with your agent, which receives the answers. Our service providers are:

  • DigitalOcean hosts our website, database, sign-in service and backups, in the United States.
  • Cloudflare sits in front of tendle.ai and protects it from attacks. All traffic to tendle.ai passes through it.
  • WorkOS handles sign-in and sends sign-in emails.
  • Composio connects your app accounts and runs app tools for connectors that use Tendle's sign-in (section 2).
  • Google and GitHub handle sign-in, if you choose to sign in with them.

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of our company, in which case this policy continues to apply to it.

5. Connectors and their makers

Each connector is a server run by its maker. That may be the company behind the app, an independent developer, or Tendle through Composio. A connector's page names its maker when we know it. When your agent uses a connector, your requests reach that maker's server. The maker handles them under its own privacy policy. We don't control what makers do with your requests, so read their policies before you connect anything sensitive.

The AI agent you use, such as Muse by Meta or Grok Bot by SpaceXAI, also handles your conversations and the keys you save in it under its own privacy policy.

6. Google user data

When you connect a Google app (such as Gmail, Google Drive or Google Calendar) through Tendle's sign-in, the access you grant is used only to run the tools your agent calls on your behalf. Tendle's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only to provide the features you asked your agent to use.
  • We do not use it for advertising, and we do not sell it.
  • We do not use it to create, train or improve AI or machine-learning models.
  • We do not let people read it, except with your permission, for security, or where the law requires it.
  • We transfer it only to run the tools you use: through Composio, which connects to Google for us, and back to the AI agent you chose; otherwise only for security, as the law requires, or in a merger or sale. Today Google's permission screen, and your Google Account, name Composio.

You can withdraw access at any time from your Google Account's security settings (myaccount.google.com/permissions).

7. Cookies and browser storage

  • If you only browse, tendle.ai sets no cookies of its own. Cloudflare sets one cookie, __cf_bm, for 30 minutes, to tell people from bots.
  • If you sign in, we set a session cookie that keeps you signed in (it lasts up to 400 days or until you sign out), and two short cookies that last 10 minutes while you sign in.
  • If you connect an app through auth.tendle.ai, we set one cookie that remembers your browser for up to a year.
  • While you edit a listing, your unsaved changes are kept in that browser tab until you close it.

All of our cookies are needed for the site to work. We use no analytics or advertising cookies, and no third-party scripts.

8. How long we keep it

  • Counts of views and copies, and a record of each tool call (connector, time, tool, status), are kept indefinitely. They don't identify anyone.
  • The scrambled codes used to count each person once a day, and the key that made them, are replaced at the first page view or copy of each new day (UTC). Database backups keep the codes up to 7 days more.
  • Your account is kept until you delete it (section 10).
  • Sign-in grants at auth.tendle.ai expire after 30 days. Browser records expire after a year. Encrypted backups of them are deleted after 90 days.
  • Server logs of our sign-in service are kept for 14 days. They hold the connector and the outcome of each sign-in, not who you are.
  • Our website's logs record each request to a connector with the same details as our counts (the connector, the kind of request, the tool and the status code), never your IP address, keys or content.
  • Records from our connector tests are kept while the connector exists.

9. Security

We encrypt traffic to tendle.ai and auth.tendle.ai with HTTPS. We encrypt our sign-in service's data and its backups, and limit who can reach our systems. No service is perfectly secure. If you believe you've found a security problem, write to [email protected].

10. Your choices and rights

  • Delete your account from your dashboard's Settings. This deletes your account with WorkOS. If you are the last member of your workspace, it also deletes the workspace and its connectors, unless your company's email domain is verified for it. Contact names and emails you entered on a listing stay while the workspace exists. A deleted connector's address is kept so that no one else can take it over, and its anonymous counts are kept.
  • Disconnect an app you connected through Tendle's sign-in by removing the connector in your agent. Your agent's grant then expires within 30 days. Your connection at Composio, which holds the app's tokens, is not deleted automatically: revoke its access in the app's own settings (for Google, myaccount.google.com/permissions), or write to us.
  • Ask us to see, correct or delete the information we hold about you, or ask any other question about it, at [email protected]. Depending on where you live, laws such as the GDPR or the California Consumer Privacy Act may give you the right to access your information, correct it, delete it, restrict or object to how we use it, receive a copy in a portable form, and complain to a data protection authority. We'll honor these rights, and we won't treat you differently for using them.

11. Children

Tendle is not meant for children under 13, and we don't knowingly collect information from them. If you believe a child has given us information, write to us and we'll delete it.

12. Where your information is processed

Tendle is run from the United States, and our servers are in the United States. We process information in the United States. Our service providers may process it in other countries. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on Standard Contractual Clauses, or on the EU-U.S. Data Privacy Framework where our providers take part.

13. Changes to this policy

If we change this policy, we'll update it here and change the date at the top. If a change is significant, we'll say so on the site before it takes effect. Before we use Google user data in a new way, we'll ask for your consent.

14. Contact

Talys Inc. [email protected]