Privacy Policy

1. Identity and scope

GoPrise AI is the commercial identity of GoPrise AI, Inc., a corporation organized in the State of Delaware, United States, which operates this platform. This Privacy Policy describes, concretely and grounded in how the product actually works, what information we process when a company and its users use GoPrise AI.

2. Information we collect

We collect information in three categories: (a) what you or your company give us directly; (b) what is generated automatically as you use the service; and (c) what comes from integrations your company chooses to connect. Each is detailed in the sections below.

3. Information provided by users and companies

Creating an account only requires a valid email address (passwordless sign-in via a "magic link"); we take your initial name from the local part of that email unless you set it otherwise. At the company level, depending on what you configure, we may store: company name and slug; billing details (address, city, state, postal code, country, tax id); operational settings (language, timezone, currency, tax rate, billing email, email signature, working hours, holidays, document numbering); your supplier directory (name, phone/WhatsApp, email); and the content you add to the Knowledge Base or to each AI Employee's configuration (e.g., business description and FAQs).

• User account: name, email address, WhatsApp number (optional, if you configure it to receive internal notifications).
• Company: name, slug, account status, billing details (address, city, state, postal code, country, tax id).
• Company settings: language, timezone, currency, tax rate, billing email, email signature, working hours, holidays, document numbering.
• Suppliers registered by your company: name, phone/WhatsApp, email address.
• Configuration content: business description, FAQs, and documents you upload to the Knowledge Base.

4. Information generated by using the service

As you use GoPrise AI, the platform generates its own operational records: conversations and messages with your AI Employees (internal, or with suppliers/clients where applicable), the state and history of each business process (workflow) you run, quotes, purchase orders, supplier invoices, job requisitions and applications (Recruitment), and appointments/reservations (Customer Service/Sales), depending on the modules your company has installed. We also keep an internal audit trail of relevant changes (via `spatie/laravel-activitylog`, with the company, IP address, and user agent recorded against each entry) and internal platform telemetry (AI usage and cost per Employee, daily statistics) that is used exclusively for internal product operation and is never shown to companies or used to bill them for AI tokens or cost.

5. Integration data

If your company connects an integration (e.g., Google or WhatsApp), we store a local connection reference and the external account identifier needed to route actions and inbound events. For Google integrations migrated to Activepieces, OAuth access and refresh tokens remain in our self-hosted Activepieces service and are not copied into GoPrise. Content sent or received through an integration is processed to perform the requested function and, when it becomes a business record, is stored in GoPrise as part of the relevant process.

6. Google user data ("Google User Data")

When a company connects a Google account, we request specific OAuth scopes, one per real capability the company activates — never all of them by default, and always through Google's own authorization flow, initiated by a company administrator. The scopes the platform can request today are: `email`; Gmail (`gmail.send`, `gmail.readonly`); Calendar (`calendar.events`, `calendar.readonly`); Google Sheets (`spreadsheets`); Google Drive (`drive`); and Google Ads (`adwords`).

• Gmail — sending emails and reading inbound messages and attachments needed for supplier communication, Recruitment, or invoice intake. PDF invoices and candidate documents needed by a business process are copied promptly into GoPrise storage.
• Google Calendar — what it's used for: creating, checking availability for, updating, and cancelling events to schedule meetings or appointments (Sales/Customer Service), also via self-hosted Activepieces.
• Google Sheets — reading, searching, creating, appending, and updating spreadsheets used by configured business processes, through Activepieces.
• Google Drive — listing and reading selected folders for Recruitment and uploading business documents when a configured process requests it. Downloaded candidate documents are stored in GoPrise when they enter Recruitment. Drive OAuth is handled through Activepieces.
• Google Ads — what it's used for: creating and pausing the company's own real advertising campaigns via the Google Ads API (read and write), when the company uses the Marketing module. Direct, native OAuth connection with Google.
• Storage and automation: Activepieces temporarily stores execution inputs, outputs, logs, and files in its database for up to seven days for retry and diagnosis. Business documents GoPrise must retain are copied into normal GoPrise storage. Google OAuth tokens for Gmail, Drive, Calendar, and Sheets remain encrypted within Activepieces and are not copied to GoPrise.
• How to disconnect: a company administrator can disconnect each account from Integrations. GoPrise immediately stops using it, removes dependent automation flows, and requests deletion of its Activepieces App Connection. Activepieces 0.87 does not provide a provider-grant revocation operation; disconnecting GoPrise therefore does not by itself guarantee revocation of the Google grant.
• How to revoke access directly from Google: at any time, independent of the above, you can revoke GoPrise AI's access from your own Google account at https://myaccount.google.com/permissions.
• How to request deletion of your data: write to us using the contact address in this policy (see "Contact"); there is no additional self-service mechanism today for deleting already-processed Google data beyond that channel.
• Advertising: the Google data we process is NOT used for advertising. The product's only advertising-related feature (Google Ads) uses the company's own Google Ads account data to manage ITS OWN campaigns — we never use Gmail, Calendar, Sheets, or Drive data to advertise anything, ours or a third party's.
• AI model training: Google data reaching our AI provider (Gemini, via Prism) is sent only as part of a single inference call to complete the task requested at that moment (e.g., drafting an email or extracting a candidate's name from a PDF) — it is not used to train or retrain GoPrise AI's or any third party's models. We do not turn this data into fine-tuning jobs.
• Sharing with providers: Activepieces is open-source automation software that we self-host and operate as part of our service infrastructure. It processes Google data transiently to execute the integrations. Google, our hosting/storage providers, and the other providers listed below may also process data as necessary for the requested feature. We do not sell Google data.
• Retention and deletion: Activepieces execution data is retained for up to seven days. Disconnecting stops future use and requests deletion of flows and the App Connection; business history already created remains subject to our general retention policy. To revoke the grant directly at Google, use your Google Account permissions.

7. Compliance with the Google API Services User Data Policy (Limited Use)

GoPrise AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google data exclusively to provide or improve user-facing features related to the requested feature; we do not use this data for our own or third-party advertising (see the previous section); we do not sell this data or transfer it to third parties except to operate the requested feature, comply with the law, or as part of a duly disclosed merger/acquisition; and no human reads the content of this data except with your explicit consent, to provide technical support you requested, for security purposes, or to comply with the law.

8. WhatsApp/Meta and other communication integrations

We use the Meta API (WhatsApp Cloud API) directly, with no intermediary (BSP), both for (a) the company's own communication channel with its internal users/clients, and for (b) a platform-owned number that AI Employees use to communicate with suppliers (e.g., to send a purchase order). Inbound Meta webhooks are verified via the `X-Hub-Signature-256` signature. We also support Telegram (via its Bot API) under the same model: each company has its own webhook, verified with a secret token. The content of messages sent/received through these channels is kept to associate it with the relevant business process (a conversation, a message, a delivery status). Candidate data: when a company uses GoPrise AI for its selection processes, its candidates' data (CV, answers, results and, if selected, their hiring documents) is processed on behalf of that company, which is the controller; GoPrise AI acts as processor. The candidate's authorization is asked before processing it and the evidence is kept; they can exercise their rights with the company or by writing to us.

9. Artificial intelligence (Gemini)

Every language-model call in GoPrise AI goes through a single internal component (the AI Orchestrator, built on `prism-php/prism`) and currently uses Gemini (`gemini-3.1-flash-lite`) as the only configured provider. The content you send (chat messages, documents to analyze, the AI Employee configuration relevant to the task) is sent to this provider only as part of an inference call to answer that specific request — not as part of any training or fine-tuning process for any model. We internally log the cost and volume of these calls (`ai_usage_logs`, daily statistics) exclusively for internal platform operation and billing; this information is never shown to companies or used to bill them for AI tokens or cost — company billing is based on Tasks (real interventions performed), not technical AI consumption.

10. Purposes of processing

We process your data to: provide the contracted service and run the business processes you configure; authenticate you (magic link / Google sign-in); process payments and manage your subscription; send transactional communications (e.g., the magic-link email, confirmations); enable and operate the integrations you choose to connect; keep an internal audit trail of relevant changes; and comply with legal, accounting, or reporting obligations. We do not use your data for third-party advertising and we do not sell it.

11. Providers and subprocessors

To deliver the service we rely on the following external providers, each receiving only the information necessary for the function it performs:

• Google — sign-in authentication, and the Gmail, Calendar, Sheets, Drive, and Ads integrations described above.
• Stripe — payment and subscription processing. Card tokenization happens directly in the browser via Stripe.js/Elements; the full card number never reaches our servers.
• Amazon Web Services (AWS) — file storage (S3) in production, and transactional email delivery (SES) when configured that way.
• Meta (WhatsApp Cloud API) — WhatsApp messaging, both for the company's own channel and for the number used to communicate with suppliers.
• Telegram — messaging via its Bot API, when a company connects that channel.
• Activepieces — self-hosted automation infrastructure used to hold Google OAuth credentials and execute Gmail, Drive, Calendar, and Sheets actions and triggers. Execution data and temporary files are retained for up to seven days.

12. International data transfers

The providers listed in the previous section (Google, Stripe, AWS, Meta, Telegram) operate cloud infrastructure that may be located outside your company's country. For example, our AWS storage configuration defaults to the `us-east-1` region unless another region is explicitly configured. When these providers process personal data outside your country, they do so under their own international-transfer and compliance mechanisms; we recommend reviewing their respective privacy policies for details.

13. Security

We apply technical controls that are verifiable in the platform's code: per-company data separation at the database level (every relevant table is company-scoped and additionally protected at the authorization layer); role- and permission-based access control per company; encryption at rest for sensitive credentials (e.g., integration tokens and internal AI configuration); signature/secret verification on every inbound webhook (Meta, Telegram, Activepieces); and payment tokenization directly in the browser via Stripe, so that card numbers never transit our servers. We do not claim to hold a specific security certification (e.g., SOC 2 or ISO 27001) because we do not have one today.

14. Retention

We keep your information for as long as your account and your company's account are active, and for a reasonable additional period to meet legal, accounting, or reporting obligations, and to preserve the integrity of the history of business processes already run (e.g., the history of a purchase order or a conversation is not deleted just because it finished). We do not currently have specific, codified retention periods per data type; if your company needs a specific contractual period, please contact us.

15. Deletion of information

You can disconnect any integration at any time from Integrations. This immediately stops GoPrise from using it and requests deletion of its automation flows and Activepieces App Connection. Because that API does not revoke the provider grant, you should also revoke access from your Google Account permissions when you want provider-level revocation. Business records already created remain subject to the general retention policy. For broader deletion requests, contact us using the address in Contact.

16. Your rights and controls

You can exercise direct control over your data from the app: disconnect any integration (`/company/integrations`), and revoke GoPrise AI's access from your own Google account at https://myaccount.google.com/permissions at any time. For access, correction, export, or deletion requests you cannot resolve directly from the app, contact us using the address listed in "Contact".

17. Cookies and sessions

We use a session cookie to keep you signed in, a CSRF token cookie (Laravel's standard protection against request forgery) to protect form submissions, and a `public_locale` cookie to remember your language preference (Spanish/English) on the public site. We do not use third-party analytics or advertising cookies or scripts (for example, we do not use Google Analytics, Meta Pixel, Segment, Mixpanel, or equivalent tools).

18. Minors

GoPrise AI is a B2B software tool, intended to be used by authorized personnel of a client company in the context of their work. It is not directed at minors and we do not knowingly solicit information from minors.

19. Changes to this policy

We may update this Privacy Policy when what the product actually does with your data materially changes. The date of the latest update is shown at the top of this page; we recommend reviewing it periodically.

20. Contact

For questions about this Privacy Policy, about your data, or to request access, correction, or deletion, write to us at [email protected].

21. Effective date

This policy takes effect on the "Last updated" date shown at the top of this page.