Privacy policy
Last updated: [to fill: date]
This policy says what personal data [to fill: company name] Pte. Ltd. (UEN [to fill], [to fill: registered address]; "we") handles in the Gako service, why, and your rights. Contact for privacy: [to fill: privacy email]. Data protection officer: [to fill: name] (Singapore's PDPA asks every organisation to name one).
There are two groups of people here: customers (people with an account) and recipients (the people our customers write to). We treat them differently.
1. Customers
What we hold: your name, work email, company name, a password (stored only as a one-way hash), your company profile and campaigns, the emails drafted and sent, replies received, billing records (balance, top-ups, charges), and the mailboxes you connect (their password or token stored encrypted). We also keep short-lived security records: the network address of sign-up and log-in attempts, to stop abuse.
During the trial we check that the mailbox you connect is one you already use: we count how many emails in its Sent folder are older than 30 days. We read the count only, not the emails, and keep only whether it passed.
Why: to run the service you signed up for (our contract with you), to bill you, to keep the service safe (our legitimate interest), and to meet legal duties such as tax records.
Payments are taken by [to fill: Paddle.com, as merchant of record]. We do not see or store your card.
Cookies: one cookie that keeps you signed in. No advertising or tracking cookies. Pages load fonts from Google Fonts, which sees your network address [to fill: or host fonts ourselves].
2. Recipients
If you got an email sent through the service, the sender is our customer, named in the email. For your data, the customer is the controller and we process it on their behalf. Ask them first; you can also ask us and we will pass your request on and act on it where we can.
What is held about you: your name, job title, work email address, your company's name, domain, size, industry and country, and facts read from your company's own public website, used to judge whether the customer's offer fits and to write one true line about your company. Emails sent to you and your replies.
Where it comes from: business data providers, reached through treg (a data gateway), such as People Data Labs, Hunter and others [to fill: the list in use at launch]; and your company's own public website, with the page and date each address was found. We do not scrape LinkedIn.
Stopping emails: every email carries a way to say no (a link or a reply). Saying no stops all further emails from that customer at once, and the address stays on a do-not-contact list so it is not written to again.
Your rights: to know what is held, to get a copy, to correct it, to have it deleted, and to object. Where the GDPR or UK GDPR applies, the legal basis is the customer's legitimate interest in contacting businesses, and you may object at any time; you may also complain to your data protection authority. [for a lawyer: check the legitimate-interest basis and the notice duty for data not collected from the person (GDPR article 14) for recipients in the EU and UK]
3. Numbers we pool to improve the service
We record how emails do and how the service is used, and pool those numbers across customers: for each email, its audience, angle, subject style, length, step, send time, the recipient's country, industry and company size, and whether it bounced, got a reply, what kind, or led to a meeting; and which set-up steps and screens people use.
Never pooled: names, email addresses, company names, or the text of any email or reply. The pooled numbers are used only to make the service better (its defaults, its writing, its set-up), are not shared with other customers in a way that shows who anyone wrote to, and are not sold. [for a lawyer: check this is enough for the pooled numbers to fall outside personal data]
4. Who else handles data (sub-processors)
| Who | What for | Where |
|---|---|---|
| Anthropic | AI that drafts emails, scores leads and sorts replies | US |
| [to fill: Render] | Running the service | US (Virginia) |
| [to fill: Supabase] | Storing data | US (East) |
| treg and the data providers it reaches | Finding companies and people, checking addresses | [to fill] |
| Google, Microsoft or the customer's mail host | Sending and receiving through the customer's mailbox | Where the mail host runs |
| [to fill: Paddle] | Payments | [to fill: UK and US] |
Data is moved outside Singapore, mainly to the US. Where it is, we use [to fill: contractual safeguards that give comparable protection, as the PDPA's transfer rules ask]. [for a lawyer: check the transfer wording for the PDPA, and standard contractual clauses for EU and UK data]
5. How long we keep it
- Customer accounts: while the account is open, then 30 days after it is closed (it can be reopened until then), then deleted, except billing records (payments and charges, the company name and the account email), kept 5 years for tax, and whether the email domain had the free trial.
- Recipient data: while the customer's campaign needs it, deleted when the customer deletes it or closes the account, [to fill: and no more than N months after the last email].
- The do-not-contact list: kept, because it is what stops further emails.
- Sign-up and log-in security records: about two days.
- Pooled numbers (section 3): kept, as they hold nothing that names anyone.
6. Security
Passwords are hashed; mailbox credentials are encrypted with a key kept outside the database; each customer sees only their own workspace. [to fill: breach notification promise, e.g. tell affected customers and the PDPC within 3 days of assessing a notifiable breach] [for a lawyer: check]
7. Changes
We will post changes here and email customers about material ones.