Effective date: January 31, 2026
This Privacy Notice describes how Natoma Labs, Inc. collects, uses, discloses, and protects personal information in connection with the Natoma Services.
Table of Contents
Natoma— “Natoma” or “we,” “us,” or “our” means Natoma Labs, Inc.
Natoma Platform— “Natoma Platform” or “Platform” means the software-as-a-service (SaaS) platform. The Platform includes all associated services, features, APIs, documentation, and support provided under a customer service agreement.
Services— “Services” means the Natoma Platform and all related services provided by Natoma.
This Privacy Notice applies to different categories of data subjects who interact with Natoma:
Website Visitors— Individuals who visit our website (natoma.ai) to browse information about our services, view documentation, or submit contact forms. This category includes individuals who have not yet established a business relationship with Natoma.
Prospective Customers— Individuals who have expressed interest in our services by requesting demos, downloading resources, or engaging in sales conversations but have not yet entered into a customer agreement.
Customers— Organizations that have entered into a service agreement with Natoma. This includes the designated administrators and authorized representatives who manage the customer account.
End Users— Individual employees, contractors, or authorized users within customer organizations who use the Natoma Services as part of their work activities through their organization’s subscription.
The information we collect varies based on your relationship with Natoma:
Automatically Collected Information:
Information Provided Voluntarily:
In addition to website visitor information, we may collect:
Account and Billing Information:
User Account Information:
Activity and Usage Information:
AI Agent Interaction Data:
When end users interact with AI agents through the platform, we process data that may contain personal information, including:
When customers integrate the Natoma Platform with workplace applications (such as Slack, CrowdStrike, Zoom, Google Services, Asana, or other platforms), we collect and process data, including personal information from those platforms as necessary to provide AI agent services.
Data types processed may include:
The specific data accessed depends on which platforms customers integrate, permissions granted during authorization, and how users interact with AI agents.
Important: Customers control integrations and can disconnect them at any time. Some integrations may process sensitive information such as proprietary code, confidential communications, customer data, or financial information. Customers remain responsible for configuring appropriate access controls.
We use information from website visitors to:
We use information from prospective customers to:
We use customer information to:
We use end user information to:
We may share personal information in the following circumstances:
We share information with trusted third-party service providers who perform services on our behalf, including:
For a list of our data subprocessors, please visit our Trust Center at https://natoma.ai/trust
When end users interact with AI agents through the Natoma Platform, we may share prompts, contextual data, and related information with third-party AI model providers (such as Google Gemini, or other large language model providers) to generate responses. This sharing is necessary to provide the core functionality of the platform.
Important: We select AI model providers that maintain strong data protection practices. However, customers should be aware that when using AI features, their data may be processed by these third-party providers in accordance with their respective privacy policies and terms of service.
When customers configure integrations with third-party applications through MCP servers, we facilitate connections to those applications as instructed by the customer. Data sharing in these circumstances is controlled by the customer’s configuration choices.
When customers integrate workplace platforms (Slack, GitHub, Google Workspace, Salesforce, and 70+ others), we process data through platform APIs to deliver AI functionality, and platform providers may process personal data per their own privacy policies.
If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction.
We may disclose information if we believe it is necessary to:
We may share aggregated or de-identified information that cannot reasonably be used to identify you for research, analytics, or other purposes.
We retain personal information for different periods depending on the category of data subject and the purposes for which the information is used:
We may retain information for longer periods if required by law or to resolve disputes, enforce our agreements, or as otherwise permitted or required by applicable law.
Depending on your location and applicable law, you may have certain rights regarding your personal information:
If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights:
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, or other US states with comprehensive privacy laws, you may have the following rights:
To exercise any of the rights described above, you may contact us, as specified in Section 11. Contact Information at the bottom of this notice.
For End Users:Because we process your personal information on behalf of your employer or organization, we may need to verify your request with your organization before responding. In many cases, your organization’s administrator can assist you with accessing, correcting, or deleting your information.
We will respond to your request within the timeframes required by applicable law (typically 30-45 days). We may need to verify your identity before fulfilling your request.
Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal information violates applicable law.
You may opt out of receiving marketing communications from us by clicking the “unsubscribe” link in our emails or by contacting us at privacy@natomahq.com. Please note that even if you opt out of marketing communications, we will still send you transactional or administrative messages related to your use of our services.
Natoma is based in the United States. If you are accessing our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.
When we transfer personal information from the European Economic Area, United Kingdom, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including:
We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
While we strive to protect your personal information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining industry-standard security practices.
Natoma’s Services are not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will take steps to delete such information. If you believe we have collected information from a child, please contact us at privacy@natomahq.com.
We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will provide notice on our website.
We encourage you to review this Privacy Notice periodically. Your continued use of our services after changes are posted constitutes your acceptance of the updated notice.
If you have questions, concerns, or requests regarding this Privacy Notice or our privacy practices, please contact us:
Natoma Privacy Team
Email: privacy@natomahq.com
Mailing Address: P.O. Box 3939, 1525 Miramonte Avenue, Los Altos, California 94024-999
For Customers with Data Processing Agreements:
If you are a customer with a separate Data Processing Agreement (DPA) or other Agreement, the terms of that agreement will govern our processing of personal information on your behalf and may supplement or supersede portions of this Privacy Notice.
For Platform Integration Specific Privacy Questions:
For questions specific to how we handle data from integrated platforms (Slack, GitHub, Google Workspace, etc.), please email privacy@natomahq.com with the platform name in your subject line.