Privacy Policy

Introduction

Welcome to Willow, a web-based platform designed to allow organizations to manage and enable access to Artificial Intelligence tools through Model Context Protocol (MCP) seamlessly ("Platform"). The Platform was developed and is owned and operated by Willow Ltd. (“Company” or “we”, “us”, “our”).

We are committed to complying with applicable data protection laws. This Privacy Policy (“Policy”) explains how we collect and use your information when you use our Platform.

This Policy may be amended from time to time. We will post any change to this Policy on our Platform at a reasonable time in advance of the effective date of the change, and we will also make efforts to proactively notify you of the change.

Contact us

If you have any questions, comments or concerns regarding this Policy or our processing of your personal information, please email us at support@withwillow.ai.

What we collect and why

You do not have a legal obligation to provide the above Information; however, if you choose to not share this information with us, we may not be able to allow you to access your account on the Platform, provide you with the functionality of our chat, or handle your inquiry.

Data accessed through connectors

When you or your organization connect a third-party service to the Platform (for example Google Workspace, Slack, or Salesforce), Willow accesses data from that service only to perform the actions you request through Willow tools, such as reading or sending email, or reading calendar events and files.

We do not sell this data, use it for advertising, or use it to develop, train, or improve generalized or foundational artificial intelligence or machine learning models, and we do not allow our service providers to do so. Humans at Willow do not read this data except with your consent, for security purposes such as investigating abuse, or to comply with applicable law.

AI processing by Willow. Some Platform features, such as AI-assisted configuration and security checks on tool activity, send data to the following AI providers through their commercial APIs, under terms that do not permit them to train on our data: Anthropic and OpenAI. Prompt-injection and personal-name detection run on self-hosted models inside Willow's own infrastructure; that data is processed locally and is never sent to the model provider.

Your own AI clients. When you connect your own AI agent or assistant to the Platform, data returned by Willow tools is sent to that client at your request. Your organization chooses and manages that client under its own agreement with that provider.

Google user data

Willow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

You can revoke Willow's access to your Google account at any time from your Google Account permissions page (https://myaccount.google.com/permissions) or by disconnecting the connector in Willow.

Methods and sources for collecting your personal information

We collect the personal information from several sources:

Directly from you, when you use our chat on the Platform or contact us with an inquiry. From your organization, when an admin creates your account on the Platform. Through the device you use to access our Platform.

From third-party services that you or your organization connect to the Platform, such as Google Workspace.

We will not share your information with third parties, except in the events listed below or when you provide us your explicit and informed consent.

Directly from you, when you use our chat on the Platform or contact us with an inquiry. From your organization, when an admin creates your account on the Platform. Through the device you use to access our Platform.

Sharing your personal information

Cookies

When you interact with our Platform, we obtain certain information using automated technologies, such as cookies. A “cookie” is a text file that websites send to a visitor’s computer or other internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser.

Our Platform uses cookies to provide you with an enhanced user experience as well as allowing us to analyze and improve our Platform, as detailed in our cookie management center.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email. You have the option to opt out of the collection of your personal data in compliance with GDPR.

To exercise this option, please visit https://www.rb2b.com/rb2b-gdpr-opt-out. You can always delete or disable cookies. Disabling cookies for future uses is possible either through your browser or device settings. If you want to remove existing cookies from your device, you can do so through your browser settings.Please bear in mind that deleting or disabling cookies may affect your experience when using the Platform.

Data retention and security

We retain your information for as long as you are an active user, and thereafter as needed for record-keeping matters.

We will retain your information for as long as you are an active user of the Platform. Thereafter, we will still retain your personal information as necessary to comply with our legal obligations, resolve disputes, establish and defend legal claims and enforce our agreements.

Willow keeps a record of each tool call in your organization's audit logs so that its administrators can review AI agent activity. By default, this record includes the tool request (for example, a search query) but not the data the tool returns. Your organization's administrator can choose to also record returned data, to record no content at all, and to set a retention period after which this content is removed. You or your organization can request deletion at any time by contacting support@withwillow.ai.

We implement measures to secure your information.

We implement measures to reduce the risks of damage, loss of information and unauthorized access or use of information. However, these measures do not provide absolute information security. Therefore, although efforts are made to secure your personal information, there is no guarantee that it will be immune from information security risks.

Your rights

As a user of our Platform, you have the following rights in relation to your personal information:

‍Right to review your information. You have the right to review, either by yourself or through an authorized representative or a guardian, any information we have stored about you in our databases.

‍Right to request to rectify your information. If, upon reviewing your information, you find your information to be incorrect, incomplete or outdated, you have the right to ask us to rectify your information or delete it. We will inform you within 30 days whether we can comply with your request.

‍Right to have your personal information deleted, under certain circumstances, such as when the information is no longer necessary for the purposes the information was collected for.

Additional Information for Individuals in The United States

Willow Ltd. is providing the following additional information to its clients residing in the United States, pursuant to applicable State privacy laws in the U.S.

We do not sell your information to any third party, or share it for cross-context behavioral advertising. Furthermore, we do not knowingly collect, use or share sensitive information.

We keep the personal information specified below as long as you are an active user of the Platform. Following that period, we shall see to it that the information is not accessed, other than in extraordinary events such as legal claims.

‍Categories of personal information we collect and process and their sources
‍Below are the categories of personal information we have collected and processed over the past 12 months, and the source of that information.

Business purposes for the collection of personal information

Disclosures to third parties

Below are the categories of personal information we shared with third parties over the past 12 months, and the categories of third-party entities we share them with.

Your rights

The right to know. You have the right to know whether we are processing your personal information. If we do, you have the right to know the following information, which we will provide you after we receive your request and verify your identity:

The categories of personal information we collected about you.

The categories of sources from which the personal information was collected.

The purposes for which we collect personal information.

The categories of third parties with whom we share personal information.

The specific pieces of personal information we collected about you.

The right to obtain a copy of your personal information. If your data is available in a digital format, you have the right to obtain a copy of the personal information that you previously provided to us, in a portable and readable format (to the extent this is technically feasible).
The right to delete your personal information. In some cases, state privacy laws provide for the right to request the deletion of your personal information.
The right to correct inaccurate personal information. Once we receive a request from you to correct your data, and verify your identity, we will examine the veracity of the corrected information provided by you, consider your request to correct, and inform you of our decision. To establish the veracity of the personal information as per your request, we will consider all the circumstances pertaining to the personal information the correction of which is requested. We may also require you to provide documentation in support of your request to correct the personal information.
The right to opt-out of processing for solely-automated profiling. You have the right to opt-out of solely-automated processing of your personal information to evaluate, analyze, or predict your personal aspects related to your economic situation, health, personal preferences, interests, reliability, behavior, location, or movements, where that processing is done in furtherance of a decision that produces a legal or similarly significant effect on you.
The right to non-discrimination as a result of exercising your rights.You have the right to not be discriminated by us for exercising the rights granted to you under applicable law. If you exercise your rights, we cannot:

deny you services.

charge different prices or fees for services, also through discounts, benefits, or fines.

provide you with a different level or quality of services.

propose that you receive different prices or tariffs for services.

Please note that we may charge a different fee or provide a different level or quality of services, if the difference is reasonably related to the value we gain from your personal information.

Filing requests
Should you wish to exercise your rights under applicable laws as specified above, please contact us by email at support@withwillow.ai.
To verify your identity, we will ask you to provide additional information, through a verification process in which you will be asked to provide us with two items of information known to you and to us.
Note you may appoint an authorized agent to file requests to exercise your rights on your behalf. To this end, you must provide your authorized agent with written approval to do so. The authorized agent will have to present us with proof, attesting that you authorized them to act on your behalf. Furthermore, we will require verification of your identity, as explained above.
Our response to your requests
We will respond to your requests within 45 days (or within 90 days, where the law permits and we determine it necessary considering the complexity and number of the requests you have filed). If we take longer than 45 days, we will inform you of the extension within the initial forty-five-day response period, together with the reason for the extension.We may deny your request in the following cases:

• If we believe in good faith, based on reasons which are documented in writing, that your request is fraudulent or is an abuse of your rights under applicable law.
• If we conclude that the request is irrelevant, based on all the circumstances at issue (e.g., if you requested to correct your personal information, and we find that it is likely to be accurate).
• If it is contrary to federal or state law.
• Due to discrepancy in the required documentation.
• If the fulfilment of your request turns out to be impossible or involves disproportionate effort.

We will provide you with a detailed explanation including sufficient facts to enable you to meaningfully understand why we cannot fulfil your request.You may appeal our decision to deny your request by submitting a written appeal to support@withwillow.ai.