1. Information We Collect

We collect information that you provide directly to us when using our services:

Account information
Usage data
Communication data

2. How We Use Your Information

We use the collected information to:

Provide and maintain our services
Improve user experience
Send important updates

3. Data Security

We implement appropriate security measures to protect your personal information.

4. Data Sharing

We do not sell your personal information. We may share data with service providers who assist in our operations.

Mobile and SMS information

We do not sell or rent mobile phone numbers. We do not share SMS opt-in, consent, or messaging data with third parties for their own marketing or promotional purposes. We may share the minimum information needed with communications providers and mobile carriers to deliver messages, prevent fraud, operate the service, and comply with law. Those providers may not use that information for their own marketing.

5. Your Rights

You have the right to:

Access your personal data
Request corrections
Request deletion

6. Changes to Privacy Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page.

7. Google User Data Access and Usage

Our application requires access to specific Gmail data to provide delegated email workflows. Here's a detailed breakdown of what data we access and how we use it:

Data We Access:

Email content for sending and tracking delegated communications
Email metadata (headers, labels, thread information)
Email drafts for managing outreach sequences
Basic profile information for account verification

How We Use Gmail Data:

Sending delegated email messages requested by your workspace
Tracking replies and workflow status
Managing follow-up sequences and email workflows
Generating workflow status and performance reports

Data Protection Commitments:

We only access the minimum required data to provide our services
Email data is processed securely and temporarily
We do not store email content permanently
We do not share your email data with third parties
We do not use email data for purposes outside requested workflow automation
All data access is logged and auditable

Required Gmail API Scopes:

gmail.send: For sending delegated email messages
gmail.readonly: For viewing messages needed to complete requested workflows
gmail.compose: For managing email drafts and templates
gmail.metadata: For processing email headers and labels
gmail.modify: For comprehensive delegated email workflow management

You can revoke our access to your Gmail data at any time through your Google Account settings.

8. Google Workspace APIs Data Usage

We want to explicitly affirm that any data obtained through Google Workspace APIs and related services (including but not limited to Gmail):

Is NOT used to develop, improve, or train generalized artificial intelligence (AI) models
Is NOT used to develop, improve, or train machine learning (ML) models
Is only used for the specific purpose of providing our service functionality, such as email integration, calendar management, and document collaboration
Is handled in strict accordance with Google API Services User Data Policy and Google Workspace requirements
Is only accessed with explicit user consent and for the minimum scope necessary to provide requested features

9. Google Ads Data Access and Usage

When you connect a Google Ads account, STORMY asks Google for the https://www.googleapis.com/auth/adwords scope so it can report on and run the ads you ask it to. Here is what that covers:

Data We Access:

The Google Ads accounts your Google login can reach, with their names and customer IDs
Campaigns, ad groups, ads, keywords, budgets, bids and location targeting
Performance data such as impressions, clicks, calls, conversions and spend

How We Use Google Ads Data:

Reporting to you what your ads spent and what they brought in
Making the changes you approve, or that you have given STORMY standing permission to make within a limit you set, such as pausing a campaign, adjusting a budget or adding keywords
Reading a change back after it is made, so you get a receipt of what happened

How We Store and Protect Google Ads Data:

The long-lived Google access token is encrypted before it is stored, and is used only to act on your own accounts
Google Ads data is processed by AI models only to answer your requests; it is NOT used to develop, improve, or train generalized AI or ML models
We do not sell Google Ads data, share it with third parties for their own purposes, or use it to target advertising
STORMY's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements
You can revoke access at any time by removing Stormy AI under your Google Account's third-party connections, which immediately stops all access

10. Slack Data Access and Usage

When you install our Slack app ("STORMY for Slack") we access Slack workspace data to provide the assistant functionality. Here is a detailed breakdown of what we access, how we use it, and how it is stored:

Data We Access:

Messages you send to STORMY in direct messages, and messages in channels where STORMY is mentioned or invited
Basic workspace and user information (workspace/team name, user IDs, display names, and email addresses) to identify who STORMY is assisting
Channel metadata (names and membership) for channels STORMY is a member of
Message reactions, used to signal task progress

How We Use Slack Data:

Reading and replying to your requests in direct messages and channel mentions
Posting updates, summaries, and interactive approval cards back into Slack
Creating channels, inviting members and posting welcomes when you ask STORMY to set up a client or project
Routing decisions that require human approval to the right person

How We Store and Protect Slack Data:

We only access channels that you explicitly invite STORMY to; STORMY does not read channels it has not been added to
In shared channels, STORMY only acts on messages that mention it or are clearly directed to it — it does not process unrelated channel conversation
Message content is processed to fulfill your requests and is not sold or shared with third parties for their own marketing
Slack data is NOT used to develop, improve, or train generalized artificial intelligence (AI) or machine learning (ML) models
The workspace's bot token is encrypted before it is stored, and every message STORMY posts is logged
When STORMY is removed from a workspace, its token is deleted immediately and STORMY stops receiving that workspace's events
You can remove STORMY at any time from your Slack workspace's app management settings, which immediately revokes our access

Required Slack Scopes:

STORMY requests only the scopes needed to operate: chat:write, chat:write.public, app_mentions:read, assistant:write, im:history, im:read, im:write, mpim:history, mpim:read, channels:history, channels:read, channels:join, channels:manage, groups:history, groups:read, groups:write, reactions:write, users:read, and users:read.email. Each scope maps to a feature described above.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at founders@stormy.ai