Privacy Policy

1. Scope

This policy applies to the VerifiedGTM website, accounts, paid credits, growth-agent runs, reports, monitoring features, and integrations. It does not control third-party websites or services that you choose to connect or ask us to visit.

2. Information we collect

Information you provide

• Account and communications: email address, password hash, support messages, and account preferences.
• Customer content: project URLs, product descriptions, prompts, notes, uploaded reference images, research inputs, generated reports, screenshots, and other files created during a run.
• Optional credentials and integrations: test-site usernames and passwords, GitHub personal access tokens, Slack webhook URLs, repository choices, and notification settings. Credentials are encrypted in the application database.
• Payment and transaction information: the credit pack purchased, Stripe checkout identifiers, credit balance, and ledger history. Stripe collects and processes card details directly; we do not store full payment-card numbers.

Information collected through use

• Technical and usage data: IP address, browser and device information, request timestamps, authentication and session cookies, error logs, run status, model usage, and estimated processing cost.
• Public and connected-source data: information from public websites, search results, Reddit, GitHub, or another source you direct a tool to review. This may include information about people who are not VerifiedGTM users.

Please do not submit regulated, confidential, or highly sensitive information unless you have the authority to do so and it is necessary for the requested run. VerifiedGTM is not designed to store health records, payment-card data, government identifiers, or production secrets.

3. How we use information

We use information to provide and secure the service, authenticate accounts, process purchases, research user-selected targets, generate and deliver reports or images, publish content when instructed, send transactional notices, prevent abuse, troubleshoot failures, issue credit refunds, improve product reliability, enforce our Terms, and comply with law.

4. AI processing and service providers

Customer content is sent to service providers only as needed to perform a requested task. Depending on the feature, those providers may include:

• Anthropic and OpenAI for text, web-assisted research, image analysis, and image generation.
• Stripe for checkout and payment processing.
• SerpAPI for search results used in research workflows.
• GitHub and Slack when you connect an account or direct us to publish or notify.
• Reddit and public websites when a tool fetches public content at your direction.
• Hosting, email, security, and infrastructure providers that help operate and protect the service.

OpenAI and Anthropic state that content submitted through their business or API services is not used to train their general models by default. They may retain inputs and outputs for a limited period, commonly up to 30 days, for abuse prevention, safety, or legal compliance unless different retention controls apply. Their terms and privacy practices govern their processing.

5. When we disclose information

We disclose information to the providers above, to a connected service at your direction, when reasonably necessary to investigate abuse or protect rights and safety, when required by law, or as part of a merger, financing, acquisition, or sale of assets subject to appropriate confidentiality protections.

We do not sell personal information, share it for cross-context behavioral advertising, or use third-party advertising trackers.

6. Cookies and browser signals

We use essential cookies for sign-in, session continuity, security, and remembered login. We do not use advertising cookies. Because we do not sell personal information or use cross-site targeted advertising, browser “Do Not Track” and Global Privacy Control signals do not change the service’s behavior.

7. Retention and deletion

We keep account data, projects, run inputs, and generated artifacts while your account is active or while needed to provide the service. You can delete individual runs, projects, ideas, and connected credentials in the product where those controls are available. You may request account access or deletion by emailing us.

Deletion is subject to reasonable technical time and legal exceptions. We may retain transaction, tax, security, fraud-prevention, dispute, and backup records for as long as needed for those purposes. Data already sent to a third-party provider is handled under that provider’s retention policy.

8. Security

We use reasonable safeguards appropriate to the service, including encrypted storage for connected credentials and optional test credentials, password hashing, access controls, and encrypted transport for public production traffic. No internet service can guarantee absolute security. You are responsible for protecting your password, limiting connected-service permissions, and promptly disconnecting credentials that may be compromised.

9. Your choices and privacy rights

You may ask to access, correct, export, or delete personal information associated with your account. Depending on where you live, you may also have rights to restrict or object to processing, withdraw consent, appeal a denied request, or receive a portable copy. We may need to verify your identity before completing a request and may deny or limit a request where permitted by law.

Send requests to [email protected]. We will not discriminate against you for exercising a privacy right.

10. California notice

In the preceding 12 months, we may have collected the categories described above: identifiers, customer records, commercial information, internet or network activity, professional information included in customer content, user-generated content, and credentials that may qualify as sensitive personal information.

We collect these categories from you, your use of the service, services you connect, and public sources you direct us to review. We use and disclose them for the business purposes described in Sections 3 through 5. We do not sell or share these categories for targeted advertising, and we do not use sensitive personal information to infer characteristics about you.

California residents may request to know, access, correct, or delete covered information and may use an authorized agent where applicable. Submit a request using the email address in Section 9.

11. EEA and UK users

Where European data-protection law applies, we process account, purchase, and customer content to perform our contract with you; security, support, and service-improvement data for our legitimate interests in operating a reliable service; and information as needed to comply with law. Where consent is the legal basis, you may withdraw it at any time.

Information may be processed in the United States and other countries where our providers operate. Those countries may have different privacy laws. You may have the right to complain to your local supervisory authority.

12. Information about other people

If you submit information about another person or direct us to collect it from a public or connected source, you represent that you have a lawful basis and the necessary authority to do so. You are responsible for using generated prospect, outreach, and research data in compliance with privacy, anti-spam, employment, and other applicable laws.

13. Children

The service is intended for business users age 18 or older. We do not knowingly collect personal information from children.

14. Changes to this policy

We may update this policy as the service or law changes. We will post the revised version here, update the effective date, and provide additional notice when a change is material and applicable law requires it.

15. Contact

For privacy questions or requests, email [email protected].