Privacy Policy

Last updated: July 27, 2026

This Privacy Policy explains how SoGood AI Inc. ("SoGood", "we", "us") collects, uses, and shares information when you use the SoGood.ai website and services (the "Service"). SoGood AI Inc. is the controller of the personal data described here. If you have questions, contact us here, or write to us at 570 Broome Street, 23B, New York, NY 10013.

This policy covers our Free, Pro, and Expert plans. If you process your own customers' personal data through the Service, that processing may also be governed by a separate data processing agreement — contact us here.

---

1. A Quick Summary

• We collect what we need to run the Service: your account details, what you do in the app, payment records, and data your projects and AI agents create or process.
• We never train AI models on your data, and we don't sell your personal information for money. Using advertising cookies may count as "sharing" or a "sale" under some US state privacy laws — you can turn those off anytime via Cookie settings in the footer.
• We use analytics and advertising cookies only with your consent where consent is required, and you can change your choice anytime via Cookie settings in the footer.
• Depending on where you live, you have rights over your data — see Section 11.

2. Definitions

• "Personal Data" — information that identifies or relates to an identifiable person.
• "Customer/Project Data" — the business information you submit and the data your AI agents create, collect, or process for your project (including data about your own customers or contacts that you route through the Service).
• "Usage/Service Data" — technical and operational data about how the Service is used (logs, metrics, session recordings, device and browser info). Some Usage/Service Data — for example, IP address, session recordings, and account or visitor identifiers — can be linked to you, and we treat that data as Personal Data.

3. Information We Collect

You provide:

• Account — name, email, and login, managed through our authentication provider (Clerk).
• Payment — handled by Stripe. We receive billing records and the plan/Credit status; we do not receive your full card number.
• Support and communications — messages you send us.
• Project inputs — the idea, business details, and instructions you give the Service.

Collected automatically:

• Technical data — IP address, browser and device type, and general location.
• Usage data — pages viewed, features used, timestamps, and session identifiers.
• Session recordings: replays of your interactions with the site (pages, clicks, and scrolling), captured by our analytics providers with typed input masked.
• Cookies and similar technologies — see Section 8.

Created or processed by your AI agents:

• Customer/Project Data — websites, content, plans, contacts, and messages your agents generate or handle for your project.
• Connected accounts — if you connect a mailbox or other account, data needed to operate that connection (see Section 6).

4. How We Use Information

We use information to:

• Provide, operate, secure, and maintain the Service and your projects.
• Run the AI agents and the actions you authorize (Section 6 of the Terms).
• Process payments, Credits, and subscriptions.
• Communicate with you about your account, support, and service changes.
• Understand and improve the Service, using de-identified/aggregated data where possible.
• Detect, prevent, and address fraud, abuse, and security issues.
• Comply with legal obligations and enforce our Terms.

5. AI Providers — and No Training on Your Data

To generate output, the Service sends the relevant inputs to our AI Model Providers (today, Anthropic / Claude). This is a pass-through for inference: your inputs and the AI Output are processed to serve your request and are not stored by the Model Provider to train its models.

We do not use your Customer/Project Data, prompts, or AI Output to train, fine-tune, or improve generalized AI models, and we contractually require our Model Providers not to train on data we send through their APIs. (Anthropic does not train its models on API inputs by default.) We may use de-identified, aggregated data to operate and improve the Service.

6. Connected Accounts (Gmail and Social)

If you choose to connect your Gmail account, the Service may access Google user data you authorize — including email messages, threads, recipients, senders, subject lines, timestamps, and message bodies — only to provide connected-mailbox functionality. We use it to send email from your connected account, sync replies and threads into your project, and show mailbox activity to you.

Google user data is not sold, not used for advertising, not used for credit decisions, and not used to train generalized AI models. It is shared only with the service providers required to run this feature, including Nylas (our email integration provider). You can disconnect your Gmail account at any time, after which we stop accessing that mailbox.

SoGood's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Connected social accounts. You can also connect social accounts (Instagram, Facebook, X (Twitter), and TikTok) under the same user-authorized OAuth model you use for Gmail. When you connect an account, we receive the access tokens and the profile, post, and engagement data needed to publish and read posts on your behalf. You can disconnect a social account at any time, after which we stop accessing it.

Sending email on your behalf. If you have not connected your own mailbox, the Service can send project email from a SoGood-operated address on the @sogoodmail.co domain instead of from your own account. Email sent this way is handled by the service providers listed in Section 9.

7. Legal Bases (EEA/UK visitors)

Where the GDPR or UK GDPR applies, we process personal data on these bases: performance of a contract (to provide the Service you signed up for), legitimate interests (to secure, analyze, and improve the Service, balanced against your rights), consent (for non-essential cookies and marketing, which you can withdraw), and legal obligation (to comply with law).

9. How We Share Information — Service Providers

We do not sell your personal information for money, and we do not rent it. We share personal information only with the categories below. Note that when you allow advertising cookies, that use may be treated as "sharing" or a "sale" of personal information under certain US state privacy laws; you can opt out at any time through Cookie settings in the footer, which stops those cookies.

• Service providers who help us run the Service, under confidentiality and data-protection obligations (see the list below).
• Model Providers, as described in Section 5, to generate AI Output.
• Legal and safety recipients, when required by law, legal process, or to protect rights, safety, and the integrity of the Service.
• Business transfers, if we're involved in a merger, acquisition, or sale of assets (you'll be notified).

Sub-processors and key service providers:

Some parts of the Service run on infrastructure SoGood operates itself rather than on a third-party vendor, including our AI inference gateway (which routes requests to the Model Providers named above), our code and git hosting for the software your agents build, and the service that connects your social accounts. Because we operate these ourselves, they do not add new third-party recipients of your data beyond the providers listed above.

10. International Data Transfers

We are based in the United States and use service providers in the US and elsewhere. Where we transfer personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent UK/Swiss mechanisms.

11. Your Privacy Rights

United States (including California — CCPA/CPRA). In the past 12 months we have collected these categories: identifiers (name, email, IP), commercial information (plan and payment records), internet/network activity (usage and device data), geolocation (general), audio and visual information (session recordings), the contents of any mailbox you connect, and the project information you provide. Depending on your state, you may have the right to:

• Know / access the personal information we hold and obtain a copy.
• Delete your personal information.
• Correct inaccurate information.
• Opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell your personal information for money; however, if you enable advertising cookies, that may be treated as "sharing" or a "sale" under these laws. You can opt out at any time using Cookie settings in the footer, which stops those cookies.
• Non-discrimination for exercising your rights.

To exercise a right, contact us here or use Cookie settings in the footer for advertising opt-outs. We will verify your request and respond within the time the law requires (generally 45 days). You may use an authorized agent, and you may appeal a decision by replying to our response.

Sensitive personal information. If you connect a mailbox, the message contents we process for you can include the contents of email where SoGood is not the intended recipient, which California treats as sensitive personal information. We use this information only to provide the connected-mailbox functionality you asked for, which is a business purpose these laws permit, so the right to limit its use is not triggered, and we do not use it to infer characteristics about you. You can stop this processing at any time by disconnecting the mailbox.

EEA / UK / Switzerland. You may have the rights to access, correct, delete, restrict or object to processing, portability, and to withdraw consent. You can also lodge a complaint with your local supervisory authority (for example, your national data protection authority, or the UK ICO).

12. Data Retention

We keep personal data only as long as needed for the purposes in this policy, or as required by law. Where we have set a fixed period, we apply it: consent decision records are kept for 24 months (see Section 8). For categories without a fixed period, we retain data for as long as the purpose above requires and then delete or de-identify it. When you delete a project or your account, we delete or de-identify the associated personal data within a reasonable period, except data we must keep for legal, tax, fraud-prevention, or dispute purposes, and routine backups that expire on a rolling basis.

13. Security

We use reasonable technical and organizational measures — including encryption in transit, access controls, and authentication — to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee the security of third-party providers. If a breach of personal data affects you, we will notify the affected users and, where the law requires, the relevant regulators without undue delay, and within 72 hours of becoming aware where the GDPR applies.

14. Children's Privacy

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us here and we will delete it.

15. Links and Integrations

The Service may link to or integrate with third-party sites and services that have their own privacy policies. We are not responsible for their practices.

16. Changes to This Policy

We may update this policy. For material changes, we'll post the update here with a new date and, where appropriate, give notice by email or in-product. When we add or change a sub-processor listed in Section 9, we will update that list here on a dated, versioned basis. Please review it periodically.

17. Contact

SoGood AI Inc. · 570 Broome Street, 23B, New York, NY 10013 · Contact