1. Information We Collect

We collect information you provide directly to us, information generated through your use of the Services, and information from third-party sources you authorize.

• Account information — name, email address, company, role, and authentication credentials you provide when you create an account.
• Connected data — content and metadata from services you connect (such as email, calendar, CRM, and messaging tools) for the purpose of operating the Services on your behalf.
• Prospect and account data — business contact and company information processed to build, enrich, qualify, and act on go-to-market lists.
• Usage data — log data, device and browser information, IP address, and interactions with the Services.
• Communications — messages, feedback, and support requests you send to us.

2. How We Use Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Services;
• Build, enrich, score, and qualify go-to-market lists and draft outbound communications for your review and approval;
• Personalize the Services, including learning from edits and feedback to improve future outputs;
• Authenticate users, secure the Services, and prevent fraud or abuse;
• Communicate with you about your account, updates, and support; and
• Comply with legal obligations and enforce our agreements.

3. Human-in-the-Loop and Automated Processing

The Services use automated pipelines and AI models to process data and generate suggestions. Customer-facing actions are designed to require explicit human approval before they are taken. We do not use your connected customer data to train third-party foundation models, and we configure our model providers to operate under enterprise terms that prohibit such training where available.

4. How We Share Information

We do not sell personal information. We share information only as described below:

• Service providers — vendors that host infrastructure, process data, and provide model, search, and enrichment capabilities under contractual confidentiality and security obligations.
• At your direction — with third-party services you connect or instruct us to act upon.
• Legal and safety — when required by law, regulation, legal process, or to protect the rights, property, or safety of Revenue Operations, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

5. Data Retention

We retain information for as long as your account is active or as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your data as described below, subject to legal and operational retention requirements.

6. Security

We implement administrative, technical, and organizational measures designed to protect information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. You may disconnect integrations at any time and request account deletion. To exercise these rights, contact us using the details below.

8. International Data Transfers

We may process and store information in countries other than the one in which you reside. Where required, we rely on appropriate safeguards for cross-border transfers of personal information.

9. Children’s Privacy

The Services are intended for business use and are not directed to individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice.

11. Google User Data and Limited Use

Revenue Operations’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Google user data only to provide and improve the user-facing features described below, which are prominent in the product interface.
• We do not use Google user data for advertising of any kind, and we do not sell or transfer it to advertising platforms, data brokers, or information resellers.
• We do not use Google user data to train, create, or improve any generalized or standalone machine learning or artificial intelligence model. The language models we use process your data to produce output for you and are engaged under terms that prohibit training on it.
• We do not transfer Google user data except to provide the features described below, for security purposes such as investigating abuse, to comply with applicable law, or as part of a merger or acquisition after obtaining your explicit prior consent.
• Our staff do not read your Google user data, except where you have given affirmative agreement for us to view specific messages, where it is necessary for security purposes or to comply with law, or where the data is aggregated and anonymized for internal operations.

12. Google Permissions We Request

We request the narrowest scopes that support these features. You can review or revoke them at any time in your Google Account permissions settings, or by disconnecting the integration in the product.

• Read your Gmail messages and settings (gmail.readonly) — to record mail activity for contacts and target companies you already track, to draft replies with real conversation context, to count how much mail your address has already sent that day so we stay within a safe volume, to detect when a prospect replies so we can stop the remaining sequence steps, and to confirm which mailbox you connected. We request no narrower read scope because drafting and reply handling require message bodies.
• Send email on your behalf (gmail.send) — to deliver messages from your own address, and to thread follow-ups into the same conversation. Messages are drafted for your review and are sent only once approved. Where you explicitly turn on autopilot for a segment, you approve that segment's messages in advance; you can review, edit or stop any of them until they send.
• View and edit events on your calendars (calendar.events) — to detect meetings booked with prospects, and to mirror your daily to-do list onto your calendar as a single all-day event. The read-only calendar scopes cannot write that event, so they are not sufficient.

We do not use tracking pixels, open tracking, or click tracking in messages sent through the Services.

13. Google Data We Store

We store the minimum needed for the features above, in two tiers.

• For mail involving contacts you already track or companies on your Targets list, we store message headers (sender, recipients, subject, date), Gmail thread and message identifiers, labels, and the short preview snippet Gmail returns. We do not retrieve message bodies at this tier. Mail from senders outside those scopes is not written to your contact graph.
• For a contact you explicitly accept into your workspace, we additionally retrieve and store the full text body of the relevant messages, with quoted replies and signatures removed. These are held in our database, in file storage, and in a search index that supports the assistant.
• We never download or store email attachments.
• From your calendar we store only the event identifier, the start time, and the email address of the external attendee matched to a prospect. We do not store event titles, descriptions, locations, or the other attendees.
• Google OAuth tokens, encrypted with AES-256-GCM before they are written to our database.

14. Service Providers That Process Google User Data

The following providers process Google user data on our behalf, under contractual confidentiality and security obligations, and only to deliver the features described above. All process data in the United States.

• Supabase — hosts our database and file storage, where message content is held.
• Turbopuffer — hosts the per-workspace search index, which holds message text so the assistant can retrieve it.
• OpenAI — converts message text into the numerical representations used for search, and classifies contacts from subjects and preview snippets.
• Anthropic — powers the assistant, which retrieves message content when you ask it a question that requires it.
• Inference.net — routes model requests and records diagnostic traces of those requests.
• Hatchet — orchestrates background synchronization jobs, which carry message headers and preview snippets.
• Composio — maintains the authorized connection used for Gmail actions.

We do not use analytics or error-reporting services that receive Google user data.

15. Retaining and Deleting Google Data

We retain Google user data for as long as your integration is connected, so the features above keep working. We do not expire it on a fixed schedule.

• Disconnecting your Google account in the product stops synchronization, attempts to revoke our access with Google, and deletes the mail and contact data imported through that connection from our database, file storage, and search index.
• You can independently revoke our access at any time from your Google Account permissions page. We recommend doing this as well as disconnecting in the product.
• You may request deletion of your account and all associated data by contacting us. We will confirm when it is complete.
• Content that another member of your workspace also synced from their own mailbox is retained for that member, and is removed when they disconnect or their data is deleted.

Resources