Privacy Policy

Last updated: 23 October 2026

This policy explains how Wysdom Labs Ltd, trading as Soba (“we”, “us”), collects, uses and shares personal data when you visit internl.app or use Internl, the workspace for issues, pages, messages, a CRM, a team calendar and AI agents (the “Service”).

1. Who we are

Internl is operated by Wysdom Labs Ltd, trading as Soba, a company registered in England and Wales (company number 15494501), whose registered office is at 124 City Road, London, EC1V 2NX, United Kingdom. For the account data of the people who use Internl and the content of their workspaces, we are the controller. Questions about this policy go to [email protected].

2. Information we collect

Account: Your username, display name, email address and profile picture, and a hash of your password if you set one. We never store the password itself.
Sign in with Google or GitHub: If you sign in with Google or GitHub, the account identifier, email address, name and picture the provider returns, so that the same account signs you in next time.
Workspace content: What you and your teammates put in Internl: issues, pages, comments, messages, CRM records and notes, files and images, and conversations with the AI agents. It belongs to the workspace and is visible to its members.
Google Calendar and Gmail: Only if you connect them, as described in section 3.
Other integrations: If you connect Notion, Calendly, Slack, Telegram or GitHub: the identifiers and access tokens they issue, and the content you choose to import or sync from them, such as Notion pages, Calendly bookings, messages in a bridged Slack channel, the Telegram contacts and chats you pick, and GitHub pull requests and deploys.
Billing: The Stripe customer and subscription for your workspace. Card details are held by Stripe and never reach us.
Notifications: If you turn on push notifications, the push subscription your browser gives us.
Logs: Short-lived request and error logs kept by our hosting providers, which include IP addresses.

Internl does not use third-party analytics or advertising tools, and sets only the cookies needed to keep you signed in and to complete a sign-in.

3. Google user data

Internl asks for access to your Google account only when you choose a feature that needs it.

Sign in with Google

Scopes: openid, email, profile. We keep your Google account identifier, email address, name and picture to sign you in and to fill in your profile.

Google Calendar

Scopes: calendar.readonly and calendar.events. When you connect a calendar, Internl reads your calendars and their events from 60 days ago to 180 days ahead, then keeps that copy up to date. For each event it keeps the title, start and end times, location, video link, organizer, attendees, status and visibility. The write access is used only to create, change or delete an event when you do so on Internl’s calendar, and to add a meeting to your calendar when someone books time with you through your Internl booking page.

Your events appear on your workspace’s team calendar. Teammates see an event of yours that is marked private or confidential, or that is on one of your other calendars, only as “Busy”. Attendees are linked to people already in your workspace’s CRM.

Gmail

Scope: gmail.metadata. Internl reads only the From, To, Cc and Date headers of your messages. It never reads or stores subject lines, message bodies or attachments. From those headers it keeps, for each address you correspond with, a name, how many messages you have sent and received, and the dates of the first and last. It also keeps message identifiers, so that a message is not counted twice. This is used to show your workspace who the team talks to, to create CRM people and companies for them, and to show you your own history with a contact.

How Google data is used and shared

It is used only to provide the features described above, which you can see and use in Internl. It is not used for advertising, not sold, and not used to train AI models.
When you ask an Internl AI agent for something that needs it, such as a summary of your history with a CRM contact, the relevant data is sent for that request to the AI model that runs it, on your own computer or with the AI provider your workspace has chosen. It is not kept by Soba or used to train models.
It is shared with nobody else except the hosting providers in section 5, which store it on our behalf, or where the law requires.
People at Soba do not read it, except with your permission, to investigate abuse or a security incident, or where the law requires.

Internl’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deleting Google data

You can disconnect a calendar or a mailbox at any time in Settings → Integrations. Disconnecting revokes Internl’s access with Google and deletes the access tokens and the events or message data synced from that account. CRM people and companies already created from it stay in the workspace until someone deletes them. You can also remove Internl’s access from your Google account settings, and the next sync will stop. To delete your Internl account and everything connected to it, email [email protected] and we will do so within 30 days.

4. How we use information

to provide the Service and the features you turn on;
to run the AI agents you ask for, with the content they need;
to bill your workspace’s subscription;
to send the emails and notifications you ask for, such as sign-in links, invitations and reminders;
to keep the Service secure and reliable, and to investigate abuse.

We do not sell personal data, share it for advertising, or use your workspace content to train AI models. Where the UK or EU GDPR applies, we rely on the performance of our contract with you to provide the Service, on our legitimate interests for security and abuse prevention, and on legal obligation for tax and accounting records.

5. Who we share it with

We share personal data only with the providers that run the Service on our behalf, each under a written agreement:

Vercel: Hosting the website and the app; request logs.
Turso: Databases holding accounts and workspace content.
Cloudflare: Storage of uploaded files and images.
Railway: Hosting the server that keeps pages and presence live between teammates.
Amazon Web Services: Sending email.
Stripe: Payments and subscriptions. Stripe is an independent controller of the payment data it holds.
Soba: Carrying AI agent requests to the computer or AI provider that runs them. Their content is not stored.
GIPHY: The search words you type when you look for a GIF.

Integrations you connect, such as Google, Notion, Calendly, Slack, Telegram and GitHub, receive what you send to them under their own terms. We may disclose personal data where the law requires, and if Soba is part of a merger or acquisition, this policy continues to apply until you are told otherwise.

6. International transfers

Some of our providers operate outside the UK and the EEA. Where personal data is transferred, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the EU standard contractual clauses, as applicable.

7. How long we keep it

Account and workspace content: Until you or your workspace deletes it, then up to 30 days in backups.
Google and other integrations: Until you disconnect them, as described in section 3.
Billing and tax records: 7 years, as the law requires.
Operational logs: 30 days.

8. Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict its processing, to receive it in a portable format, and to withdraw consent. Email [email protected] and we will reply within 30 days, free of charge. In the UK you may also complain to the Information Commissioner’s Office, and in the EEA to your local supervisory authority.

9. Security

Data is encrypted in transit with TLS. Each workspace has its own database, and secrets you store in Internl are encrypted with AES-256-GCM. No system is completely secure. Please report a vulnerability to [email protected] before disclosing it, and we will tell you and the relevant authorities about a breach that affects you, as the law requires.

10. Children

Internl is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email [email protected] and we will delete it.

11. Changes

We will update the date above when this policy changes and, for a material change, email account holders at least 14 days before it takes effect.

12. Contact

For privacy questions or data requests, email [email protected]. See also our Terms of Service. Internl is operated by Wysdom Labs Ltd, trading as Soba, a company registered in England and Wales (company number 15494501), whose registered office is at 124 City Road, London, EC1V 2NX, United Kingdom.