Pallas Advisory LogoPallas Advisory

Should an AI Assistant Get Your Inbox? Not on a Promise

By 9 min readAI Agents, Tools & Vendors

A Wi-Fi router sealed under a glass bell jar on a walnut desk, beside an antique brass wax-cylinder dictation machine, in a navy-walled office with an orange desk lamp.
Turn off the Wi-Fi. See what's still listening.

Meta’s Muse and OpenAI’s Dots want your inbox and your day. Decide what they get by what they can hear, and by whether anything stronger than a sentence on a privacy page protects it.

Meta’s new assistant would like to read your email. Also your messages and, if you let it shop for you, a way to pay. Muse launched September 8 as a personal agent, free for most of what people need. Three weeks later OpenAI introduced Dots, always-on agents that each get their own cloud computer and, per OpenAI’s setup guide, plug into Slack, your calendar and your email. Both are good at the part they demo. Both ask for the same thing: the run of the accounts your business lives in. A free assistant that wants your whole inbox is a Trojan horse with a privacy page attached. Give them access in proportion to what actually protects your data.

A sentence on a privacy page is enough for things you wouldn’t mind seeing in a stranger’s inbox. Work data needs a contract. Anything that listens to you all day needs to run on your own machine, where nobody has to promise you anything.

Every assistant ships with a promise

Muse’s is a good one. From Meta’s launch post: “Muse doesn’t share a person’s conversations or the data in their VM with Meta’s ad systems.” (The VM is the virtual computer Muse works inside on your behalf.)

That sentence is specific, and I assume Meta meant it when it published it. The problem is that it’s a sentence. Meta can change it with a policy update and an email, and it already runs the opposite policy on its other assistant. In October 2025 Meta announced that starting December 16, in most regions, “we will soon use your interactions with AI at Meta to personalize the content and ads you see.” Same company, two assistants, opposite rules. What protects you is a property of the product page, not of the company.

And the company’s track record on promises is now a court record. On September 25 a jury in Santa Fe found Meta liable for 43.9 million violations of New Mexico’s consumer protection law, for false and misleading public statements about user data, misinformation and hate speech. Among the statements New Mexico put in front of that jury was Meta CEO Mark Zuckerberg’s, from 2010: “We do not and never will sell any of your information to anyone.” The judge hasn’t set the penalty yet, and Meta says it disagrees with the verdict and will keep fighting. The jury’s reading of Meta’s data promises is already on the record. Yes, I have opinions about Meta. So, it turns out, does a jury.

Launch promises are stage one

Cory Doctorow, a longtime tech writer and critic, has a word for the arc, and it isn’t a polite one. Enshittification, in his definition: “first, they are good to their users; then they abuse their users to make things better for their business customers; finally, they abuse those business customers to claw back all the value for themselves. Then, they die.” His worked examples are Amazon, Facebook and TikTok, and Facebook’s is the one to remember: first your feed showed you what your friends had to say, then it filled up with accounts you didn’t follow, then publishers had to pay to reach readers who had already followed them.

You don’t have to buy the whole theory to use its first stage. Free tools with generous terms are what platforms look like on launch day, because launch day is when they need you more than you need them. The promise is part of the welcome. Muse, free with paid plans on top, is on day one of a curve Meta has run before.

Maybe it stays there. I wouldn’t bet a client’s inbox on it. A promise is the cheapest thing a company can give you and the easiest thing for it to take back, and the decision you make about it today has to hold on the day it changes.

Vendors offer a promise, a contract, or architecture

When a vendor tells you your data is safe, it is offering one of three things, and they are not the same strength.

A promise is a sentence the vendor wrote and can rewrite: “not used for training,” “not retained,” “kept separate from ads.” It costs nothing to make and nothing to change. When it changes, your recourse is the cancel button. Tab, a personal assistant that came out of stealth on October 6 at what it says is a $300 million valuation, makes three in a row. Ammar Amdani, one of its founders, gave TechCrunch all three: “Your data is never used to train AI.” “Your card lives in a vault Tab itself never sees.” “Nothing that can be undone happens without your ‘yes.’” Then he added: “Trust is the product.” He’s right, and a product is something its maker can change.

A contract is a promise you both signed. A paid business plan whose terms bar training on your data, a data processing agreement, an admin screen that shows what’s connected. It can still change, but not quietly, and when it breaks you have something to point at. In the Netherlands, where I work, it isn’t optional for client data: the AVG, the Dutch name for GDPR, requires a written agreement with any outside service that processes personal data on your behalf.

Architecture is where the data physically goes. If the model runs on your laptop and nothing leaves it, nobody has to promise you anything, and nobody can change the deal by email. You still have to check that it’s true. But you can check it, which you can’t do with a promise.

Muse has architecture too, on paper: every user gets a dedicated virtual machine on Meta’s servers. You can’t check that boundary from outside. On October 5, 404 Media, an independent tech news site, reported, citing internal documents, that Meta ran a security push starting less than two weeks before launch to fix a run of bugs, at least one of which could let an agent break out of its machine. Meta pays up to $300,000 for a bug like that. Architecture on someone else’s server is a promise you can’t inspect.

I paid for the cloud version and left anyway

I learned the difference on a tool I’d already paid for. I dictated through Wispr Flow, a cloud dictation app: good software, fast, worth the money, paid up through June 2027. Earlier this month I cancelled the renewal and moved to a local app, and the reason wasn’t price.

Dictation hears everything. Client names, project details, the half-formed sentence I’d never type. Wispr Flow’s privacy page is admirably plain about where that goes: “Transcription always happens in the cloud to provide the best speed and accuracy.” A setting controls whether Wispr stores your audio and transcripts afterward. That’s a promise about keeping, not about sending. When I audited my data stack in September, Wispr Flow wasn’t on the list of tools I had a processing agreement with. So I moved the audio somewhere that doesn’t need one.

Shopping for a replacement taught me to read privacy copy word by word. Raycast, a Mac launcher app with built-in dictation, says in its manual that “audio isn’t retained on Raycast servers,” which is a polite way of telling you the audio leaves your Mac. Its privacy page says where: “to our speech‑to‑text partner.” VoiceInk, another option, keeps the audio on your Mac but can send the transcript out for cleanup, and the transcript is the part with your clients’ names in it. I ended up on TypeWhisper, an open-source app that transcribes on the laptop itself.

Even architecture needed checking. TypeWhisper’s website didn’t name a company; I found the developer through Apple’s code-signing certificate instead. And after I’d switched off automatic updates, the app still reached out to its own project site on relaunch, either an update check or its plugin catalogue. A free firewall called LuLu caught it, and I blocked it rather than find out which. A week of watching turned up nothing else. But the firewall couldn’t prove the part that mattered: it lets Apple’s own programs through without asking, and the speech engine I started with is Apple’s. The test that settled it was dumber. I turned off Wi-Fi and dictated. It still worked. That was the whole difference: on one side a promise I’d have had to take on faith, on the other a claim I could test, and did.

You don’t need to do any of that. You need the questions it taught me.

Sort what you hand over by what it can hear

Things you wouldn’t mind seeing leak. Public research, a recipe, a draft with no client in it. A promise is enough. Use the free tools.

Work data. Client email, your CRM, contracts, invoices. Contract or nothing: a business plan whose terms bar training on your data, and a processing agreement if you or your clients are in Europe. If the only thing between a client’s email and an ad system is a privacy page, that tool doesn’t get the inbox.

Anything that listens all day. Dictation, meeting transcription, an agent that watches your screen or reads your messages. It runs on your machine, or it doesn’t run.

That last tier is where Muse and Dots live. An assistant with your inbox, your messages or your calendar sits in the most sensitive category you have, and Muse’s launch post offers a promise, not a contract. Dots ships on both a consumer plan (ChatGPT Pro) and a business one (Business Premium), and which one your team is on decides which terms apply. OpenAI says that by default it doesn’t use data from ChatGPT Business, Enterprise and its other business plans for training, and it offers a data processing addendum. Pro is a consumer plan, and that page doesn’t cover it. Check that your plan is on that list.

Then ask four questions before any assistant gets an account:

  1. Where does it run? On your machine, or on theirs. If the vendor says yours, turn off Wi-Fi and try it.
  2. Is the promise about keeping or about sending? “Not retained” means it arrived.
  3. Does the text leave even if the audio doesn’t? The transcript is the sensitive part.
  4. Is it in something you signed, with a company you can name? If you can’t find out who makes it, there’s nobody to sign with.

And one rule for your team, this month: no personal assistant connected to a work account. Your staff will try these tools whether you’ve approved them or not. Decide now which inboxes they’re allowed to connect: theirs, not the company’s.

If you’re in Europe, the consumer versions haven’t arrived yet: Dots on ChatGPT Pro isn’t rolling out in the European Economic Area, and Muse’s launch covers the US. Use the wait to sort your data, so the day they arrive is a settings decision rather than a judgment call made at the signup screen.

Meta’s promise about Muse may hold. A jury has already said what it thinks of Meta’s last round of data promises. Give an assistant what will still be protected on the day the sentence on the page changes.

Sources and Further Reading

Written with AI. Checked against a standard I publish. Read it.

View all
A corporate org chart of round gold-framed employee portraits connected by brass rods on a cream stone lobby wall; below the bottom row, a lone square frame holding a glowing screen hangs unconnected, and a brass rod lies on the marble floor beneath it.

The box made it onto the chart. The line to it didn't.

Should Your AI Agent Be on the Org Chart? Only With a Human's Name Next to It

Among 813 managers, the AI-employee frame cut error-catching 17%, but only where agents were already on the org chart.

A moonlit lighthouse on a rocky coast at night, its beacon dark while four windows down the tower glow warm orange.

It collects light for a living.

Better-Organized Silence

A knowledge layer nothing consults at the moment of work is not context, it is better-organized silence.

The box is fine. The shadow is the inventory.

You Wouldn’t Run a Stranger’s .exe. Why Is Your Agent Following a Stranger’s Install Prompt?

An agent skill is software that installs with no permission dialog and runs with everything your AI can touch.

The AI Strategist

One email a week: the newest post, what I'm reading, and the occasional odd find. Written for people running small and growing businesses, not for AI insiders.

Subscribe