AM DESK · CURRENT MVP GUIDANCE
Information Security & Responsible Use
Work-account authorisation, data minimisation and responsible use of AM Desk.
Before you connect
AM Desk helps organise work information from services you choose to connect. Before connecting a work account, confirm that you are authorised by your organisation to use this service and share the relevant information. Review your organisation's information security, confidentiality and data protection policies, and our Privacy Notice and Responsible Use Guidance. Connect only accounts and data you are permitted to use, minimise sensitive information, review AI-generated outputs before acting on them, and report any suspected security issue promptly. By ticking the box you confirm you have reviewed this guidance and will take reasonable steps to use AM Desk responsibly. This acknowledgement does not remove AM Desk's own legal and security obligations.
Only approved information
Review internal information security, confidentiality and data protection policies. Use the minimum information needed. Do not add special-category personal data, highly restricted information, passwords or secrets without explicit organisational approval. Consider notice and consent requirements for third-party meeting participants before sharing meeting notes or recordings.
Review, do not delegate responsibility
Check dates, attribution and outputs against their sources before acting. AM Desk does not send messages or make decisions in your work accounts. Current daily summaries and discussion prompts are calculated from stored records, not live AI. Existing AI task advice is restricted to demo tasks; it uses the Lovable AI service with an OpenAI model.
Pilot connections and processing
Gmail and Slack pilot connections require the workspace owner to configure a provider client, then your own provider authorisation. The Lovable connector gateway handles provider credentials and refresh. Gmail requests read-only mailbox permission; AM Desk reads only the label you select over 1, 3 or 7 days, up to 25 messages per sync, storing subject, sender, snippet and source link. Slack requests read-only public-channel and direct-message listing and history; you choose whether AM Desk reads all joined public channels, all DMs, both, or up to 12 specific channels and DMs, over the same limits. These in-app selections limit AM Desk reads, not the broader permissions the provider grants. Source excerpts initially remain plain previews. When you explicitly select Review together, up to five selected canonical excerpts (1,200 characters each), sender, verified account identity, recorded timestamps and source identifiers are processed together by Lovable AI using an OpenAI model. This can include genuinely imported Zoom meeting quotes, not a live Zoom connection. For reconciliation, AM Desk also sends minimal context from up to 20 recent same-scope tasks and 20 pending proposals: identifiers, titles (240 characters), status, assignee (80 characters), due date, explicit client identifier and up to three previously verified evidence quotes (300 characters each). Task notes, client notes and unrelated client scopes are not sent. No attachments, credentials, unrelated messages or source URLs are sent. Evidence quotes are checked against your excerpts. Related obligations can form one proposal; uncertain matches and conflicting dates, owners or status remain for review. Accepting an update adds evidence and review context without overwriting your title, notes, dates, owner or completion state. New task dates and inferred client links remain unset. No-action and insufficient-snippet results are allowed. AI proposals require your review and explicit acceptance. Up to ten batches per account per day; AI usage draws on workspace credits. No automatic processing or retries. You decide which items become tasks. No message sending and no private Slack channels are requested; direct messages are read-only and only when you select them. Zoom and Fathom remain unavailable.
Controls and current limits
Records use account-scoped access rules in Lovable Cloud. Pilot sync is on demand, not scheduled. Disconnect removes the encrypted connection handle after gateway revocation; imported records remain. Automatic retention, organisation administration, an incident-reporting contact and account-wide deletion are not implemented. Privacy, Terms and the DPA remain pending legal review; this acknowledgement does not make the service approved for confidential or restricted data.
Manage access and report concerns
Review permissions regularly. When a connection is available, access must be revocable through the provider. Revoking provider access does not itself erase previously imported records. You can delete individual tasks in the task editor. Report suspected incidents promptly through your organisation’s established incident process; AM Desk’s dedicated contact must be established before external connections open.
Our responsibilities remain
This acknowledgement is not a waiver of statutory privacy duties and does not transfer all liability to you. AM Desk retains its own obligations as controller or processor as applicable. This guidance reflects ISO/IEC 27001-aligned risk awareness, not certification or a claim of compliance. Guidance version: 2026-10-20.2. The authenticated receipt preserves the exact accepted guidance and acknowledgement text, its SHA-256 hash, account ID and server timestamp. The provider separately retains its own authorisation record.