1. Introduction

GoodTaco Inc. commits to protecting privacy and explains how we collect, use, share, and safeguard information when users access our services. By accessing the Services, you agree to the practices described herein.

2. Information we collect

We collect several categories of data:

Account data

Name, email, job title/function, intended use (for account creation and management)

Billing data

Payment method details handled by PCI-compliant providers (for subscription processing)

Integration data

Google user data (Google sign-in, Google Sheets, Gmail), Xero, HubSpot, QuickBooks, Airtable data when connected (to provide requested integrations)

Section 4 explains exactly what Google user data we access and how we handle it.

Usage data

Log files, device/browser info, IP address (to operate, secure, and improve Services)

3. How we use your information

We use the information we collect to:

Provide, operate, and maintain Services including integrations with Google, Xero, HubSpot, QuickBooks, Airtable, Railway, AWS, and Cloudflare
Communicate about feature updates, beta invitations, billing, and support
Understand aggregate usage to improve performance and reliability

We never sell or rent Personal Data to third parties.

We do not engage in automated decision-making or profiling with legal effects.

4. Google user data

This section covers the data GoodTaco receives from Google APIs when you sign in with Google or connect Google Sheets or Gmail.

What we access

Google sign-in: your name, email address, and profile picture, to create and sign in to your GoodTaco account.
Google Sheets: only the spreadsheets you choose or that your apps create (the drive.file permission), so your apps can read and write their records. GoodTaco can't see the rest of your Google Drive.
Gmail: the email address of the account you connect, and permission to send email from it (the gmail.send permission). GoodTaco can't read, search, change, or delete any of your email.

How we use it

Sending email: apps that you or your workspace build with GoodTaco send email from a connected Gmail account when they run a step you set up, such as a form that emails a confirmation. Your app decides the recipients and content; GoodTaco sends the email through Gmail as that account. Sent emails appear in the account's Sent folder.
Showing connected accounts: we show the connected address in GoodTaco so your workspace can see which account each app sends from.
AI assistant: when you ask GoodTaco's AI assistant to build or change an app, it can see the addresses of your workspace's connected Gmail accounts, so it can set an app to send from one of them, and the spreadsheet data that app works with. It never sees your Google sign-in or access tokens. Your request is processed by the AI model providers listed in section 6 only to answer it.

We use Google user data only to provide these features to you. We don't use it for advertising, and we don't sell it.

AI and machine learning

GoodTaco doesn't use Google user data, including data from Google Workspace APIs, to develop, improve, or train generalized or non-personalized AI or machine learning models. The AI model providers we use process it only to answer your request and don't use it to train their models.

How we store and protect it

Google access tokens are stored encrypted in our database on Amazon Web Services in the United States. Only GoodTaco's servers and the service that runs your apps use them. The AI assistant never sees them, Gmail tokens are never given to app code, and they're never shown to other people.
GoodTaco doesn't keep copies of the emails your apps send. Our logs record that an email was sent, with Gmail's message ID and the number of recipients, never the addresses or the content.
All data travels over encrypted connections (TLS 1.2 or later).

Who we share it with

We share Google user data only with the service providers in section 6 that run these features for us (Amazon Web Services, Railway, and our AI model providers), and only as needed to provide them. We don't transfer it to anyone else, except when the law requires it.

How long we keep it, and how to delete it

We keep a connected Gmail account's address and tokens until you disconnect it in GoodTaco, which deletes them right away, or until you ask us to delete them.
You can also remove GoodTaco's access at any time in your Google Account at myaccount.google.com/permissions.
To have us delete Google user data, email compliance@goodtaco.ai. We complete deletion requests within 30 days.

Limited Use

GoodTaco's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Legal basis for processing

Personal Data processing occurs only with consent or when lawful. You may withdraw consent by emailing compliance@goodtaco.ai.

6. How and why we share your information

Data sharing occurs solely to deliver Services or comply with law through:

Service providers

Vetted vendors for communications, infrastructure hosting, and payment processing

Legal requirements

When necessary to meet legal obligations or defend rights

Sub-processors

Google LLC: User authentication (OAuth) and optional Google Sheets and Gmail integrations
Railway: Hosting of application servers and databases
Amazon Web Services, Inc.: Cloud infrastructure for user-generated tools and storage
Cloudflare, Inc.: Global edge caching, TLS termination, and traffic acceleration
Daytona: Isolated workspaces where the AI assistant builds apps
Vercel, Inc. (AI Gateway), Anthropic, PBC, Google Cloud Vertex AI, and Amazon Bedrock: AI models that power the AI assistant

Only minimum required data for each function is shared.

7. Data security

Encryption: All Personal Data is encrypted in transit (TLS 1.2+) and at rest within cloud providers
US data residency: All primary production data stores reside within the United States; no production data stored outside the US
Breach notification: Within 72 hours of discovery, affected users and regulators are notified

Security researchers may report vulnerabilities to security@goodtaco.ai through our responsible-disclosure bug-bounty program.

8. Data retention

Active accounts: Data kept for the account's lifetime
Account deletion: Basic contact details archived unless full deletion requested
Backups: Encrypted, rotating backups for disaster-recovery only

Integration-derived data is retained only as long as needed. You may request deletion via compliance@goodtaco.ai.

9. Your rights

You have the following rights with 30-day SLAs (except consent withdrawal, which is immediate):

Access: Obtain a copy of Personal Data
Correction: Fix inaccurate or incomplete data
Deletion: Request data erasure
Withdraw consent: Opt-out of marketing or integrations

Contact compliance@goodtaco.ai to exercise any right.

10. Cookies & tracking

We use cookies strictly for essential authentication and performance. No third-party advertising or cross-site tracking cookies are deployed.

11. Third-party links

External website links are independent of our privacy practices. You should review external policies before providing data.

12. Children's privacy

Services are not directed to children under 13, and we do not knowingly collect information from them.

13. Changes to this policy

Material changes, including any change to how we use Google user data, are announced at least 30 days in advance via email and in-app notice. The Effective Date reflects the latest version.

14. Contact us

Questions or concerns should be directed to compliance@goodtaco.ai.

Privacy policy