Privacy Policy

We collect the information needed to run member accounts, organization access, training, community, support, and the included software tools:

• Account data such as name, email, authentication and session data, and profile details you choose to add.
• Organization and membership data, including roles, invitations, and product access granted to your organization.
• Program activity such as onboarding progress, course progress, action-plan work, quiz responses, and certification status.
• Content you submit, including community posts, direct messages, support tickets, feedback, and questions you ask the Assistant or consultancy tools.
• Purchase and billing records from our payment provider, including order status and access grants. We do not store full payment card numbers.
• Usage and device data such as page views, feature use, approximate location derived from IP address, and browser or device information.
• Files you upload to the platform, including names, sizes, and storage metadata.
• If you connect Gmail, the connected mailbox address, encrypted OAuth tokens, Gmail message and thread identifiers, sender, subject, RFC 822 Message-ID header, timestamps, and short snippets needed to send outreach and detect replies.

You can connect a Gmail account with Google OAuth so the platform can send outreach you create or authorize and detect replies to that outreach. For reply detection, we access Gmail message and thread identifiers, selected headers, timestamps, and a short Gmail-provided snippet. We do not download full message bodies, attachments, drafts, or mailbox settings. Gmail data is used solely for these disclosed purposes. It is never used for advertising, market research, or any undisclosed purpose.

We request scopes only as needed to find replies to your outreach and to send emails you trigger or that an automation you authorize is allowed to send. OAuth tokens are encrypted and stored securely. Disconnecting the integration revokes our Google credential and removes the stored tokens and synced inbound content. We retain non-content message identifiers only to prevent deleted content from being synced again, along with outreach history that you created in the platform. You can also revoke access in your Google account settings. See our Gmail data management guide for details.

Your email content is not reviewed by humans except for support with your explicit consent, when it is necessary for security purposes, or when it is aggregated and anonymized.

We commit to using data obtained through Google APIs, including Gmail data, in accordance with Google's Limited Use requirements. This means: (1) we use Gmail access only to send outreach you create or authorize and to access the limited message metadata and short snippets needed to detect replies; (2) we do not transfer this data to others unless necessary to provide and improve these user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users; (3) we do not use this data for serving advertisements; (4) we do not allow humans to read this data unless we have your affirmative agreement for specific purposes, it is necessary for security purposes, or it is aggregated and anonymized.

We use your data to operate and improve the service: authenticate you, deliver training and member tools, manage organization access, answer questions, provide support, communicate about your account, keep the platform secure, and comply with law. If you connect Gmail, we also use the limited mailbox data described above to send authorized outreach, detect replies, and show related platform outreach history. We may use de-identified or aggregated data to improve features. We do not sell personal data.

Some features send your prompts, questions, and permitted context to model providers through OpenRouter so we can generate answers. Those providers process that data only to return a result. AI output can be incorrect or incomplete. Do not submit special-category or highly sensitive data unless it is necessary and you are permitted to share it.

We use established providers to operate the platform. Depending on the feature, this may include authentication and hosting infrastructure, PostgreSQL database hosting, S3-compatible object storage, Google APIs for optional Gmail access, OpenRouter and underlying model providers, Whop for purchases and membership billing, Resend for email, Inngest for background jobs, Slack for internal operations, and observability tools. These providers process data only as needed to deliver the service, subject to their terms.

If you use Acquisity or another connected third-party product as part of the program, that product is governed by its own privacy policy and terms.

We send transactional and account emails such as verification, password resets, invitations, access notices, and support replies. These emails are required to operate the service. You can opt out of non-essential marketing emails where those are offered.

We retain data for as long as needed to provide the service and as required by law. Billing and access records may be kept after an organization leaves the program. Disconnecting Gmail stops future access and removes the stored OAuth tokens, inbound subject lines, body snippets, and RFC 822 message identifiers. We retain Gmail message and thread IDs, direction, timestamps, and links to platform outreach history to prevent deleted content from being imported again and to preserve audit continuity. Outbound outreach history you created in the platform is retained. You can request deletion of your account or specific content, subject to legal and operational requirements such as purchase records, security logs, and content needed to resolve a dispute. No fixed backup-retention period is currently published. For details or a deletion or retention question, see our Gmail data management guide or contact support.

We protect data in transit with TLS and use the security controls of our infrastructure providers for storage, access control, monitoring, and backups. No system is completely secure. If we become aware of an incident that affects your personal data, we will notify you and regulators as required by applicable law.

Depending on where you live, you may have the right to access, update, export, correct, or delete personal data, or to object to or restrict certain processing. You can update many account details in settings, disconnect Gmail in the product, and revoke OAuth access in your Google account. For other requests, email support@aiacquisition.com. We may need to verify your identity before completing a request.

We use cookies and similar technologies for essential operations such as authentication and security, and to understand how the product is used. You can control some cookies in your browser, but essential cookies are required for core functionality such as staying signed in.

The platform is operated from the United States. If you access the service from another country, your information may be transferred to, stored in, and processed in the United States or other locations where our providers operate. Where required, we use appropriate transfer safeguards.

The service is for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. If changes are material, we will provide reasonable notice, for example in the product or by email. Your continued use after changes become effective constitutes acceptance.

For questions about this policy or your data, email support@aiacquisition.com. This policy is effective as of August 19, 2026.