Privacy Policy

1. Information we handle

• Account and workspace data: name, work email, company, role, login, team membership, and support messages.
• Billing data: plan, billing email, subscription status, and transaction identifiers. Stripe processes payment details; we do not store full card numbers.
• Connected-account data: account details, provider identifiers, connection status, authorized tokens, and data returned by services you connect, including LinkedIn, Slack, Google, Meta, and PostHog.
• Outreach data: targeting instructions, uploaded lists, public professional profile information, sequences, approvals, messages, replies, activity, and meeting outcomes.
• Usage and device data: feature events, pages viewed, approximate location from IP address, browser and device details, referral and ad-attribution data, diagnostics, and session replay with form inputs masked and sensitive areas blocked.

2. Where it comes from

We receive information from you, other members of your workspace, connected services, payment and analytics providers, professional and publicly available sources, lead-data providers, and automatically from your device. A customer may also give us information about its prospects and contacts.

3. How we use it

We use personal information to:

• provide, personalize, and operate PumpGTM and customer-approved outreach;
• authenticate users, manage workspaces, and process billing;
• find and deduplicate prospects, monitor replies, and measure outcomes;
• provide support and service notices;
• secure, debug, analyze, and improve the service; and
• measure marketing, prevent abuse, and meet legal obligations.

Depending on the context, we rely on performing our contract, legitimate interests in operating and securing PumpGTM, consent, and compliance with law.

4. LinkedIn credentials

We do not save or log LinkedIn passwords or session cookies. If you use direct connection, the credential is sent in the current encrypted request to our connection provider and is then cleared. If you use the provider's hosted sign-in, you provide the credential directly to it. We store the resulting account connection identifier and the data needed to operate that connection.

The connection lets PumpGTM send the connection requests and messages you approve, and it lets our provider notify us when someone replies. We only act on replies from people PumpGTM contacted for you: a message from anyone else is discarded on arrival and never stored. We read a conversation only for those people, to stop the sequence when they answer and to show you the thread in PumpGTM. We do not import, read, or store your existing LinkedIn message history, and no person at PumpGTM browses your inbox.

Google user data

If you connect a Gmail or Google Workspace mailbox with Sign in with Google, PumpGTM receives your email address, name, and permission to use that mailbox over Gmail's mail servers. We use it only to send the emails you approve in PumpGTM from that mailbox, to check it for replies and bounces to those emails so a sequence stops when someone answers, and to show you your conversation with each person you emailed in the PumpGTM inbox. We do not read other mail in your mailbox.

We store the Google authorization token encrypted and never show it to anyone. We do not sell Google user data, use it for advertising, use it to train AI models, or let people read it except with your permission, for security, or to comply with law. Removing the mailbox in PumpGTM deletes the token, and you can also revoke access in your Google Account at any time.

PumpGTM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. When we disclose information

We disclose only what is reasonably needed to:

• run PumpGTM through hosting, database, authentication, AI, connection, sourcing, analytics, communications, and payment providers;
• send data to an integration or recipient at your direction;
• show workspace data to authorized members of the same customer;
• measure ads with limited identifiers and conversion events sent to advertising partners;
• comply with law, protect rights and safety, or investigate abuse; or
• complete a financing, merger, acquisition, or sale of the business.

Our paid service includes access to a shared professional-information database, described below. Access to that information may constitute a sale of personal information under applicable law. Ad measurement or targeted-advertising disclosures may also qualify as sale or sharing. You can request exclusion from the professional database or opt out of sale or sharing at no charge by contacting team@pumpgtm.com. You do not need a PumpGTM account to make a request.

Shared professional profiles

We maintain reusable professional profiles to help customers identify relevant business contacts. When we obtain permitted public information while serving one customer, we may retain it, link it to the same public identity, and make it available to other customers. Sources include public X profiles, posts and follower relationships, public professional pages, and licensed professional-data providers such as Crustdata. Profiles may contain names, professional roles and employment history, company and explicitly stated accelerator affiliations, public account identifiers, links between accounts, and dated activity observations.

We record sources and observation dates. Some professional affiliations are AI interpretations of public statements and may be incomplete, outdated or wrong. We label these for review. We do not infer employment or personal identity merely from following someone, and a profile match does not itself authorize outreach.

Customer uploads, private messages, replies, target lists, campaign performance, signup and billing information, and connected-account credentials are not contributed to this shared database. Signing up does not authorize us to share your private account data. A customer or user may independently appear in the database because of permitted public professional information. We act as controller for this database; for private workspace outreach records we generally act on the customer’s instructions. We rely on a lawful basis appropriate to each use and jurisdiction, including legitimate interests where permitted, and assess objections and requests for exclusion.

6. Cookies and analytics

We use cookies and local storage for login, security, preferences, attribution, analytics, and session replay. You can restrict cookies in your browser, but required parts of PumpGTM may stop working. We do not intentionally record passwords, payment fields, LinkedIn credentials, or fields marked as sensitive in session replay.

7. Retention and security

We keep information while an account is active and as reasonably needed to provide PumpGTM, preserve outreach and billing records, prevent duplicates and abuse, resolve disputes, and comply with law. Retention varies by data type. We may keep de-identified statistics and limited backup or audit records after deletion. In the shared professional database, X-derived evidence expires within 90 days unless observed again; other professional observations expire within one year unless refreshed. We remove expired evidence through scheduled cleanup and honor earlier source restrictions and verified deletion requests. We retain a non-reversible identity hash to prevent excluded profiles from being added again.

We use administrative, technical, and organizational safeguards designed to protect information, including encryption in transit and access controls. No system is perfectly secure, so we cannot promise absolute security.

8. Your choices and rights

Depending on where you live, you may ask to access, correct, delete, or receive a copy of your personal information; object to or restrict certain uses; withdraw consent; or opt out of sale, sharing, or targeted advertising. We will not discriminate against you for making a privacy request. We may need to verify your identity and may retain information where an exception applies.

Email us to make a request. If PumpGTM processed your information for one of our customers, please name that customer so we can route the request. You may also complain to your local privacy regulator.

9. International use and children

We and our providers may process information in the United States and other countries, which may have different privacy laws from your country. PumpGTM is a business service and is not intended for anyone under 18. We do not knowingly collect personal information from children.

10. Changes and contact

We may update this Policy as PumpGTM changes. We will update the date above and give additional notice when a change is material.

To ask a question or exercise a privacy right, email team@pumpgtm.com. Giga Next Inc. is the controller of account information and the shared professional database, and generally processes private prospect and outreach records for the customer that provided them. See our Terms of Service.