Privacy Policy

1. Controller and contact

GoTom (gotom.app) is the controller of the data described in this policy. For privacy questions or requests, contact hello@gotom.app.

2. Data we collect and why

Account: your name, email address and authentication data through Supabase, including “Sign in with Google”, to create and protect your account.

Company: the profile, products, ideal customer profile (ICP) and attachments you provide to configure B2B prospecting.

Prospects: professional data from public sources such as Google Maps/Places, websites and public directories, which you process through GoTom for B2B prospecting.

Integrations: email content from the mailbox you connect and meeting data from Cal.com or Calendly when connected, to manage replies, sequences and meeting preparation.

Technical data: activity and error logs, and basic Vercel analytics, to operate, secure and improve the service.

3. Google (Gmail) and Microsoft (Outlook) data

gmail.send / Mail.Send: send outreach emails from your mailbox that you approve or that your autopilot is enabled to send.

gmail.readonly / Mail.ReadWrite: read only to detect replies, bounces and unsubscribe requests relating to emails sent by GoTom, and continue or stop the sequence. Although Mail.ReadWrite grants broader permissions, we limit its use to this purpose.

userinfo.email / User.Read: identify the connected email address.

We store OAuth tokens encrypted with AES-256-GCM. You can disconnect your mailbox in the app at any time; doing so deletes its tokens. You can also revoke access in your Google account permissions or your Microsoft account.

4. Limited Use of Google data

GoTom follows the Limited Use requirements for data received from Google APIs, as described in the statement below.

GoTom's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Gmail data, use it for advertising, or use it to train generalized AI models. We only transfer this data to provide features authorized by the user, for security, or to comply with legal obligations, in accordance with the Limited Use requirements.

No human reads this data except with your explicit consent for specific data, when necessary for security or abuse investigations, to comply with the law, or when it is aggregated and anonymized for internal operations.

5. Use of artificial intelligence

We process necessary content, such as prospect data or a received reply, with language model providers (OpenAI, DeepSeek and Google Gemini) only to deliver the requested feature. OpenAI classifies replies and drafts messages; under the OpenAI API terms, the data it receives is not used to train its models. No provider uses this content to train AI models, including generalized models. This processing is carried out in accordance with Google's Limited Use requirements.

6. Processors and third-party services

We share only the data needed for each feature with Supabase (database and authentication), Vercel (web hosting and basic analytics), OpenAI (a subprocessor that classifies replies and drafts AI messages), DeepSeek and Google Gemini (AI), Google Maps Platform and Apify (prospect research), Cal.com and Calendly (if connected), and Google and Microsoft (mailboxes). These providers process data to deliver their services, for the purposes described here and under their applicable terms.

7. Retention and deletion

We retain your data while your account is active and it is needed to provide the service. The text of replies read from Gmail is deleted 90 days after receipt; we retain the date, sender and intent of the reply as metadata for metrics. You can request deletion of your account and data at hello@gotom.app; we will handle it within a reasonable period, no later than 30 days. If a legal obligation requires us to retain information, we will explain why and restrict its use to that obligation. Disconnecting your mailbox revokes access in Google, deletes its OAuth tokens and deletes the text of those replies.

8. Security and international transfers

We apply access controls and technical and organizational measures to protect information; no system guarantees absolute security. Our providers may process and host data on servers in the United States and other countries. We apply the contractual safeguards and measures required by the rules governing these transfers.

9. Your rights

Under Colombia’s Law 1581 of 2012 (Habeas Data) and equivalent rules applicable to you, you may request access, correction, updating or deletion of your data, and revoke authorization for processing where applicable. Email hello@gotom.app with your request; we will verify your identity proportionately and respond within applicable legal deadlines.

10. Children

GoTom is intended for people aged 18 or older. We do not knowingly collect data from children; if you discover that a child has provided information to us, contact us to request its deletion.

11. Changes to this policy

We will publish changes on this page and update the date shown. We will communicate material changes through the app or by email; if the use of Google data changes, we will seek renewed consent before using it for the new purpose.