Privacy Policy

1. Who we are

The service known as ExtrovertAI is operated by Stallwart, with a registered address at Coimbatore, Tamil Nadu, India. In this policy “we”, “us” and “our” refer to that entity. For personal data covered by the EU or UK GDPR, we act as the data controller for the information you provide about yourself and as a data processor for the information you place in your workspace about your prospects.

Questions or requests about privacy go to contact@stallwart.in. We aim to respond within seven business days and always within the statutory response window.

2. Scope of this policy

This policy covers the ExtrovertAI marketing site, the ExtrovertAI application, and the background services that make the product work (email sending, research, billing, and support). It does not cover third-party sites we link to or the internal email systems of the recipients of your outreach.

3. What we collect

We collect the least amount of personal data we need to run the service. Concretely:

Account information

Your name, email address, and password hash (via our authentication provider). We never see or store your password in plain text. If you choose “Continue with Google”, we receive your basic Google profile instead: your name, email address, and profile picture. No password is involved.

Company profile

The information you enter or that we extract from your public website during onboarding: what you sell, your voice, your logo and accent color, and the physical address you place at the bottom of outbound email (required by CAN-SPAM and by most equivalent laws).

Mailbox connection

ExtrovertAI only sends email from your mailbox. It never reads, scans, polls, or monitors your inbox. You can connect a mailbox in one of two ways:

• Gmail or Google Workspace (Google sign-in). Google gives us OAuth access and refresh tokens for one Gmail permission, gmail.send, plus your email address so we know which mailbox it is. We use them only to send the emails you have approved. That permission does not let us read, search, delete, or change your messages, and we do not. See Google user data below.
• Any other mailbox (SMTP). For providers such as Zoho, GoDaddy, Fastmail, or a custom domain, you give us your SMTP server details and password. We use them only to send the emails you have approved. If you also add an optional IMAP connection, we use it for one thing: placing a copy of each sent email in your own Sent folder. We never use it to read your mail.

Tokens and passwords are encrypted with AES-256-GCM before they are stored. You can disconnect a mailbox at any time from the app, which deletes them.

Prospect and lead data

Business listings (names, categories, ratings, addresses, phone numbers) come from Google Maps through the Google Maps Platform Places API, and are shown in the app with Google Maps attribution. Short themes summarised from public Google reviews, and publicly-listed contact emails, come from those listings and the businesses’ own public websites. Google’s handling of that data is covered by the Google Privacy Policy. This is business information anyone can look up. Where those records include a natural person’s contact detail (for example the owner’s public email), we treat it as personal data under the GDPR and honor the rights below.

Message content

The subject and body of every email you draft and send through the service, so you can review, edit, and approve it and see what was sent. Replies go to your own inbox, not to us. We only hold reply information you give us yourself: the outcome you log for a lead (for example interested, not interested, or bounced) and any reply text you choose to paste in to get a drafted answer. If you connect a booking link, meetings booked through it are recorded via the booking provider’s webhook.

Link clicks

We never track whether an email was opened. Click tracking is off by default, so your emails show the real link. If you turn it on in settings, links in your emails go through a short redirect that records that the link was clicked.

Billing information

When you buy credits we receive the amount, the pack, the currency, and a Stripe customer identifier. Card numbers are never sent to us. Stripe processes and stores that information directly under its own privacy terms.

Usage and technical data

Pages viewed, actions taken, error reports, IP address, browser user agent, device type, and timestamps. We use this to diagnose problems, prevent abuse, and improve the product.

What we do not collect

• We do not sell personal data.
• We do not use your prospects, drafts, replies, or mailbox data to train generalized AI or machine-learning models.
• We do not read, scan, or monitor your mailbox. We only send.
• We do not run advertising trackers on the marketing site.

4. How we use it

We use personal data only for the following purposes:

• Deliver the service. Sign you in, run discovery, research prospects, draft messages, send the messages you approve from your mailbox, record the reply outcomes you log and the meetings booked through your link, and keep an accurate account of the work performed.
• Meter and bill fairly. Track credit consumption per action so you only pay when work runs. Refund credits automatically on transient failures.
• Keep sending trusted. Enforce daily send caps, warm-up ramps, and suppression of bounced and unsubscribed addresses across your account.
• Support and communicate. Reply to your emails, send account notices, deliver receipts, and warn you when your balance is low.
• Protect the service. Detect abuse, secure the platform, and respond to legal requests where legally required.

5. Google user data

This section explains exactly how ExtrovertAI handles information it receives from Google APIs, when you sign in with Google or connect a Gmail or Google Workspace mailbox.

What we access

• Sign in with Google: your basic profile only, meaning your name, email address, and profile picture. Nothing from Gmail, Drive, Contacts, or any other Google service.
• Connect Gmail: only the gmail.send permission (https://www.googleapis.com/auth/gmail.send), so we can send the emails you approve from your own Gmail, plus your email address to identify the mailbox. We cannot and do not read, search, delete, or modify your messages, labels, or settings.

How we use it

• Your basic profile is used only to create your account, sign you in, and show your name and picture in the app.
• The Gmail permission is used only to send emails you have read and approved, from your own Gmail address.
• We never use Google user data for advertising, including retargeting or personalized ads.
• We never sell Google user data.
• We never use Google user data to train generalized AI or machine-learning models.
• We do not transfer it to anyone else, except as needed to run the service (for example our hosting and database providers, under data-protection terms), to comply with the law, or as part of a merger, acquisition, or sale of assets after notice to you.
• No person at ExtrovertAI reads your Google user data, unless you give explicit consent (for example when you ask us for support), or it is necessary for security purposes such as investigating abuse, or to comply with the law.

Storage and security

Google OAuth tokens (and, for other mailboxes, SMTP and IMAP passwords) are encrypted at rest with AES-256-GCM and are only ever sent over encrypted (TLS) connections. Access is limited to the parts of the service that send your approved emails.

Retention and deletion

• Gmail tokens are deleted as soon as you disconnect the mailbox in the app, or when your account is deleted.
• You can revoke ExtrovertAI’s access at any time from your Google Account at myaccount.google.com/permissions. Once revoked, we can no longer send from that mailbox.
• To delete your account and the data attached to it, including your Google profile information, email contact@stallwart.in from the address on your account. We confirm when it is done, within the timelines in How long we keep it.

Limited Use

ExtrovertAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Legal bases (EU and UK GDPR)

Where GDPR applies, we rely on the following bases:

• Contract. To provide the account, run the service, and bill you for it.
• Legitimate interests. To secure the platform, prevent fraud, maintain deliverability, and improve the product. Where we rely on legitimate interests we balance them against your rights and give you a way to object.
• Consent. Where the law requires it, for example non-essential cookies. You may withdraw consent at any time.
• Legal obligation. To comply with tax, accounting, anti-fraud, and lawful requests from authorities.

7. Sharing and subprocessors

We only share personal data with vendors who help us run the service, under written data protection terms. Each is limited to what it needs. The current list:

• Supabase. Managed Postgres, authentication, row-level access controls. EU or US region (per project configuration). See their privacy notice.
• Google (Sign-in and Gmail API). Signing you in with Google (basic profile only) and sending the emails you approve from your connected Gmail, using send-only permission. Global. See their privacy notice.
• Google Maps Platform (Places API). Finding local businesses for prospect discovery (name, address, category, rating, reviews). Shown in the app with Google Maps attribution; not included in exports. Global. See their privacy notice.
• Web content extraction service. Reading public business websites and your own site during onboarding to extract signals and enrich context. US. See their privacy notice.
• OpenRouter. Routing large-language-model calls for research summaries and email drafts. US. See their privacy notice.
• Stripe. Processing credit-pack purchases. Card data is handled by Stripe, not by us. Global (see Stripe DPA). See their privacy notice.
• Upstash. Managed Redis for background job queues and short-lived caching. EU or US region. See their privacy notice.
• Resend. System email (account emails, password resets, receipts). US and EU. See their privacy notice.
• Cal.com. Optional booking integration. Booking events reach us as a signed webhook when you enable it. Global. See their privacy notice.
• Vercel. Hosting the marketing site and the application front end. Global CDN. See their privacy notice.

We do not share personal data with anyone else, except as required by law, to protect the safety of a person, or as part of a business transfer where the buyer assumes this policy or a comparable one.

8. Where your data lives

Application data (accounts, workspaces, drafts, sent messages, logged reply outcomes, suppression lists) is stored in a managed Postgres database in an EU or US region depending on the project’s configured location. Background jobs run through a managed Redis instance in the same region. Static assets and the marketing site are served from a global CDN. The specific region your account uses is documented in the account settings and can be shared on request.

Third-party subprocessors process data in the regions listed in the previous section. Where a subprocessor operates globally (for example the AI model gateway or the payment processor), we rely on the contractual safeguards described under International transfers.

9. How long we keep it

• Account data lives while your account is active and for up to 90 days after you delete it, unless a longer period is required by law.
• Workspace data (leads, drafts, sent messages, logged reply outcomes, and any reply text you pasted in) is kept for as long as your account is active. On deletion we remove or anonymize it within 90 days.
• Mailbox credentials (OAuth tokens and SMTP or IMAP passwords) are deleted immediately when you disconnect a mailbox or delete your account.
• Suppression lists (unsubscribes and bounces) are kept indefinitely at the account level so a deleted contact cannot be re-emailed if they later reappear in a search.
• Billing records are retained for the period required by applicable tax law, typically six to ten years.
• Backups may retain data for up to 35 days after deletion, after which they are overwritten.

10. How we secure it

Security is not a checkbox. The core controls we run today:

• All traffic to the marketing site and the application is served over TLS.
• Mailbox OAuth tokens and SMTP or IMAP passwords are encrypted with AES-256-GCM at rest before they are written to the database.
• Postgres row-level security limits every read and write to the account that owns the row.
• Webhooks from payment and booking providers are verified with cryptographic signatures and idempotency keys before we accept them.
• Sensitive credentials live in a secrets manager. Access is limited to the services that need them, logged, and rotated on a schedule.
• We patch dependencies regularly and monitor errors so incidents surface fast.

See our Security overview for a fuller picture. If you believe you have found a vulnerability, email contact@stallwart.in with details and we will respond promptly.

11. Your rights

Depending on where you live, you have some or all of the following rights:

• Access the personal data we hold about you.
• Correct data that is wrong.
• Delete your account and the personal data attached to it.
• Restrict or object to specific processing.
• Receive a portable copy of your data.
• Withdraw consent where consent is our legal basis.
• Lodge a complaint with your local data-protection authority (for example the ICO in the UK or your national DPA in the EU).

To exercise any of these rights, email contact@stallwart.in. We may need to verify your identity before we act on the request.

California residents (CCPA / CPRA). You have the right to know what we collect, to delete it, and to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioural advertising. You may still exercise the rights above by emailing us.

12. International transfers

Some of our subprocessors are based outside the EU or the UK. Where personal data is transferred out of the EEA or the UK we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with additional safeguards where appropriate. We are willing to provide a copy of the relevant clauses on request.

13. Data processing agreement

If you are a business customer subject to GDPR, UK GDPR, or an equivalent framework, you are entitled to a Data Processing Agreement (DPA) with us that incorporates the current Standard Contractual Clauses and the UK International Data Transfer Addendum where relevant. Our DPA is available on request: email contact@stallwart.in with your legal entity name and the account email, and we will send it for signature. Any material change to the DPA is notified in-app and by email in advance.

14. Cookies

The marketing site uses a minimal set of first-party cookies for session state and for measuring aggregate site usage. We do not run advertising trackers. The application uses cookies required to keep you signed in and to preserve your preferences.

15. Children

The service is a business tool. It is not directed at children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us and we will remove it.

16. Changes to this policy

We may update this policy from time to time. When we make a material change we will update the effective date at the top and, where the change materially affects you, notify you by email or in-app before it takes effect.

17. Contact

Privacy questions or requests: contact@stallwart.in. Postal address: Stallwart, Coimbatore, Tamil Nadu, India.

This policy is governed by the laws of the courts of Coimbatore, Tamil Nadu, India. See our Terms of Service for the rules that apply to your use of the service.