1. Scope and privacy roles

Colossal acts as a controller or business for personal information it determines how and why to use, such as account administration, security, product analytics, marketing, legal compliance, and the model-development uses expressly described below. When Colossal processes Customer Content solely on documented instructions from an Organization under an applicable order, data-processing agreement, or similar written agreement, Colossal may act as that Organization’s processor or service provider.

A separate signed agreement may establish different commitments for an Organization. If it expressly conflicts with this Policy, that agreement controls for the conflict. Except where a signed agreement, connected-service restriction, or applicable law provides otherwise, Colossal may act as an independent controller for the first-party model training, evaluation, safety, analytics, and product-improvement activities described here.

2. Information we collect

Account and profile information includes name, email address, authentication and session information, profile image, contact details, preferences, Organization membership, role, teams, permissions, and settings. If paid features are introduced, transaction information may include purchase, invoice, tax, billing-status, and payment-provider details; full payment-card information ordinarily is collected directly by a payment processor.

Customer Content includes business records, contacts, messages, email content and attachments, CRM data, proposals, invoices, files, calendar information, prompts, chats, instructions, source materials, feedback, and Outputs that you or an Organization uploads, creates, connects, receives, selects, or directs the Service to process. Customer Content can contain personal information about employees, customers, prospects, recipients, and other people who do not have a Colossal account.

Connected-service and workflow information includes provider and account identifiers, OAuth grants and tokens, connection configuration, synchronization state, requested actions, delivery or payment status, source lineage, audit records, and data received from services you connect, including Gmail and other Google Workspace services.

Technical, device, and usage information includes IP address, approximate location inferred from IP, browser and device attributes, operating system, language, identifiers, timestamps, referring and destination pages, routes, clicks, feature use, queries, diagnostics, latency, errors, request metadata, security signals, cookies, local storage, pixels, SDK events, and similar information.

We receive information directly from users; from Organizations, administrators, and other users; from connected services; from public websites and data sources; and from vendors, security providers, and business partners. If Colossal introduces third-party advertising or additional analytics, we may also receive campaign, audience, attribution, and interaction information from those partners. The source depends on the feature and your interactions.

3. Sensitive and restricted information

Customer Content, including connected email, files, and business records, may incidentally reveal sensitive personal information. Unless Colossal Intelligence Inc. has expressly approved the specific workload in a signed agreement and confirmed appropriate controls in writing, do not intentionally submit those categories for processing or use the Service as a regulated-data system for protected health information, full payment-card data, financial-account credentials, authentication secrets, government identifiers, biometric or genetic identifiers, precise location, classified or export-controlled material, information about children, or other information subject to special regulatory handling. Use reasonable data-minimization and access controls for sensitive information that may appear incidentally in connected communications.

You and your Organization are responsible for data classification and minimization and for obtaining all authority, notices, consents, and lawful bases required for Colossal and its providers to process information. Account creation, feature availability, or acceptance of this Policy is not approval for a regulated workload.

4. How we use information

We use information to provide, operate, personalize, and support the Service; authenticate users; maintain Organization, tenant, team, and capability boundaries; process requested workflows; generate, research, classify, display, deliver, and synchronize content; administer accounts and future payments; communicate with users; and honor user and Organization instructions.

We also use information to secure and monitor the Service; detect, investigate, and prevent fraud, abuse, and incidents; debug and measure performance; conduct analytics and research; enforce agreements; establish or defend legal claims; comply with law; and protect Colossal, users, and others. As the relevant activities are introduced, Colossal may use eligible information to develop, train, test, evaluate, and improve products and models; market Colossal; personalize content and communications; and measure campaigns, subject to the exclusions and deployment commitments below.

We may aggregate or deidentify information and use and disclose it for lawful purposes, including analytics, benchmarking, research, safety, and product or model development. We will take reasonable measures designed to prevent reidentification where applicable law requires it. Google Workspace API data and information derived from it remain subject to the Google-specific restrictions below and will not be relabeled, aggregated, deidentified, or derived to evade those restrictions.

5. Colossal model training and product improvement

Except for excluded sources described below and any contrary signed agreement or legal restriction, Colossal may use eligible Customer Content, Inputs, Outputs, feedback, public-web material, and interaction data to develop, train, fine-tune, test, evaluate, secure, and improve Colossal’s or its affiliates’ artificial-intelligence and machine-learning models, datasets, systems, and features. Those models or improvements may be used for you, your Organization, other customers, or users generally.

Authorized Colossal personnel and service providers operating under confidentiality and security obligations may review selected eligible content for annotation, quality, evaluation, safety, support, and model or product improvement. Colossal may retain training datasets, evaluations, deidentified or aggregated information, and learned model parameters as reasonably necessary for those purposes. Deleting source content may prevent future use where required and feasible but does not require Colossal to retrain or delete information learned by a model unless applicable law or a signed agreement requires it.

Google Workspace API data and information derived from it are excluded from shared or generalized model training. Colossal also does not voluntarily opt Customer Content into a third-party model provider’s own generalized model-training program unless a later notice, consent, or signed agreement expressly permits that use.

6. OpenAI processing and public-web research

Colossal uses service providers to perform AI-assisted features. The information sent for an operation can include confidential business information or personal information if you place it in that workflow. Colossal uses the OpenAI Responses API for ordinary generation, extraction, classification, chat, analysis, and public-web research and may send prompts, user messages, business records, email or proposal excerpts, and supported file content to OpenAI as needed for the requested feature.

Colossal configures its OpenAI Responses API requests with store: false. This prevents retrievable Response application-state storage but does not provide Zero Data Retention. As of this Policy’s effective date, Colossal’s OpenAI project does not have Zero Data Retention or Modified Abuse Monitoring enabled. OpenAI states that API data is not used to train its models by default unless a customer expressly opts in, and Colossal does not voluntarily opt Customer Content in. Until Colossal is approved for and enables Zero Data Retention or Modified Abuse Monitoring, abuse-monitoring logs may contain prompts and outputs and may be retained for up to 30 days, subject to exceptions in OpenAI’s published data controls. OpenAI may also retain encrypted prompt-cache representations for up to 24 hours under those controls.

For public-web research and qualification, the search-enabled OpenAI request receives only available business lead identifiers: contact name, company name, contact email, and company domain. It does not receive the opportunity summary, raw email thread, or attachment content. Private opportunity context may be processed by a separate OpenAI Responses API request with web search disabled and is not combined into the search-enabled request. Colossal uses returned sources and research notes to assist human review and does not treat them as automatically verified facts.

7. Google Workspace data

When you connect Gmail or another Google Workspace service, Colossal may access, receive, store, and process authorized messages, attachments, files, calendar information, account metadata, and related data to provide or improve prominent user-facing features that you or your Organization request. Colossal’s use and transfer of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Colossal does not sell Google Workspace API data, transfer it to advertising platforms, data brokers, or information resellers, use it for retargeting or personalized advertising, build cross-device advertising profiles from it, or use it for credit or lending purposes. Colossal does not use raw or derived Google Workspace API data to create, train, or improve a shared, generalized, foundation, or cross-customer artificial-intelligence or machine-learning model.

Google Workspace data may be transferred to OpenAI or another service provider only as permitted to provide, secure, or improve the disclosed user-facing feature, under appropriate provider restrictions. Where Google permits it, Workspace data may be used for a model personalized solely to the specific user and appropriate use case. Human access is limited to circumstances permitted by the Google policy, such as specific affirmative user permission, security, legal compliance, or other recognized exceptions.

Disconnecting a Google account stops new access but does not necessarily delete information already imported, derived records, audit evidence, or content retained under an Organization’s instructions or legal requirements. You or your Organization may use available controls or contact Colossal to request deletion, subject to the retention limits below. Any transfer of Google Workspace data in a corporate transaction remains subject to applicable Google consent requirements.

8. Cookies, analytics, monitoring, and cross-device recognition

We and service providers may use cookies, pixels, SDKs, local storage, log files, and similar technologies for authentication, preferences, security, analytics, performance, communications, attribution, and marketing. These technologies may associate activity with an account, browser, device, or approximate location and may operate across sessions.

We may collect page views, navigation paths, clicks, scrolling, pointer movement, form interactions, text entered into non-sensitive fields, browser and device information, performance events, and error events. We may introduce session-replay or similar monitoring technology that reconstructs how a person interacted with an interface. We do not intend those tools to capture passwords, authentication secrets, or the contents of authenticated email, files, invoices, proposals, or chats, and we will configure reasonable exclusions before deployment; however, no masking technology is guaranteed to prevent every incidental collection.

We and partners may use account identifiers, hashed contact information, device or advertising identifiers, cookies, IP addresses, and deterministic or probabilistic signals to recognize browsers or devices likely associated with the same person or household. Hashing an identifier does not necessarily make it anonymous.

Some practices described in this section may not be active on the effective date. Before materially introducing nonessential monitoring, session replay, targeted advertising, or cross-device advertising recognition, Colossal will update this Policy and provide consent, opt-out, or preference controls when required by law. Google Workspace API data and Customer Content displayed in authenticated workflows are excluded from advertising and cross-device advertising profiles.

9. Advertising, marketing, and privacy choices

Colossal may use account, campaign, website, device, and interaction information to market the Service, personalize communications, measure campaign performance, create audiences, and show or help others show advertising on Colossal or third-party services. Colossal does not sell Customer Content for money and does not use Google Workspace API data or authenticated-workflow Customer Content for advertising.

Disclosing online identifiers and Internet or device activity to advertising, analytics, social-media, or measurement partners can be considered a “sale,” “sharing,” or processing for targeted advertising under certain U.S. state laws even when no money changes hands. Where applicable, eligible residents may opt out of those activities and related profiling. Before Colossal activates an activity requiring a website control or opt-out-preference-signal response, Colossal will provide an appropriate “Your Privacy Choices” or comparable mechanism and honor legally recognized signals as required.

You may unsubscribe from promotional email using the link in the message. Operational, legal, security, and transactional communications may continue. Browser controls can restrict some cookies, but blocking them may affect Service functionality and may not control activity associated with a signed-in account.

10. How we disclose information

We disclose information to an Organization and its Authorized Users; to recipients and collaborators you select; to connected services at your direction; and to vendors, subprocessors, contractors, and professional advisers that help host, authenticate, secure, support, analyze, market, communicate, process payments for, or operate the Service. A provider may process information under an agreement with Colossal or under separate terms you accept directly.

We may disclose information when required by law or legal process; to enforce agreements; to establish, exercise, or defend legal claims; to investigate fraud, abuse, or security incidents; to protect rights, safety, property, or the Service; or in an emergency. We also disclose information with consent or as otherwise directed by you or your Organization.

We may disclose information in connection with diligence, financing, reorganization, bankruptcy, merger, acquisition, sale, or transfer of assets or business. A recipient may use the information subject to this Policy unless a different notice is provided. Google Workspace API data remains subject to Google’s Limited Use and any prior-consent requirement that applies to a corporate transaction.

11. Organizations, administrators, and other users

Organization owners and administrators may manage users, permissions, teams, connected systems, configuration, and Organization content and may access, retain, export, transfer, suspend, or delete information associated with an Organization-managed account. Content shared in collaborative areas may be visible to Authorized Users, and recipients may receive information you direct Colossal to send.

If you leave an Organization, the Organization may retain and continue to control its Customer Content and business records associated with your work. Privacy requests concerning Organization-controlled records may be referred to that Organization.

12. Retention and deletion

We retain information for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, carrying out Organization instructions, maintaining security and audit evidence, complying with contracts and law, resolving disputes, enforcing agreements, and protecting legal rights. Retention depends on data type, sensitivity, feature, account status, Organization instructions, backup schedules, provider practices, and legal requirements.

Policy-acceptance, security, fraud, billing, delivery, and audit records may be retained after operational content or an account is deleted when reasonably necessary as evidence or for legal, compliance, and security purposes. Backups may persist until overwritten under ordinary schedules. Third-party providers apply their own retention schedules, including the OpenAI practices described above.

When deletion is requested or an account ends, we delete or deidentify information when required and feasible, subject to Organization control, backups, legal holds, statutory obligations, provider limitations, and legitimate security or legal needs. Deleting eligible training source data does not necessarily remove information already learned by a model or require retraining, except where applicable law or a signed agreement requires it.

13. Security and international processing

We use administrative, technical, and organizational safeguards designed to protect information, including authentication, scoped authorization, tenant and team controls, encryption in transit, credential restrictions, logging, and lifecycle checks. No method of transmission, processing, or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for securing accounts, devices, credentials, exports, links, recipient lists, permissions, and connected services and for promptly reporting suspected compromise. Colossal and its providers may process information in the United States and other countries whose laws may differ from those where you live. Where required, Colossal uses contractual or other lawful transfer mechanisms.

14. Privacy rights and choices

Depending on where you live and subject to legal exceptions, you may have rights to know or access personal information; obtain a portable copy; correct or delete information; restrict or object to processing; withdraw consent; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; appeal a decision; or complain to a regulator.

To submit a request or appeal, email contact@colossalhq.com and describe the right you wish to exercise. We may verify your identity, authority, residency, account, and request; request additional information; or direct an Organization-controlled request to the Organization. An authorized agent must provide legally sufficient authority. We will not discriminate against you for exercising an applicable privacy right.

Rights differ by jurisdiction and may be limited by law, security, another person’s rights, or an Organization’s control of its records. You may manage certain account, Organization, integration, email, and browser settings in the Service or your browser. Additional controls will be made available before Colossal begins activities for which applicable law requires them.

15. U.S. state and international privacy information

For residents of U.S. states with applicable comprehensive privacy laws, the categories described in this Policy may include identifiers; customer records; commercial information; Internet or electronic-network activity; approximate geolocation; professional or employment information; inferences; communications and Customer Content; and sensitive personal information when submitted. Sources, purposes, and recipient categories are described above. Depending on the law and Colossal’s activities, disclosure of online identifiers or activity to advertising partners may constitute sale, sharing, or targeted advertising.

If you are in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction with similar law, Colossal may rely on performance of a contract, legitimate interests, consent, and compliance with legal obligations as applicable. You may have rights to object, restrict processing, withdraw consent, or lodge a complaint with a supervisory authority. Where an Organization controls the relevant Customer Content, that Organization determines the applicable legal basis and responds to requests.

16. Children

The Service is intended for people age 18 or older and is not directed to children. Do not submit information about children unless Colossal expressly approves the specific use in a signed agreement and the processing is lawful. If you believe a child’s information was submitted improperly, contact us.

17. Changes to this Policy

We may update this Policy as the Service, providers, practices, and law change. We will identify the current version and effective date and provide reasonable notice of a material change. We will request renewed acceptance, consent, or provide additional choices when required by law or when Colossal determines a change warrants them. Acceptance records identify the exact document versions and content hashes presented and acknowledged.

A future-facing statement in this Policy does not mean a practice is currently active and does not replace consent or a choice required at the time of deployment. The current Policy applies prospectively from its effective date; Colossal will not rely on a materially broader new purpose for previously collected information when applicable law requires new notice or consent.

18. Contact

For privacy questions, requests, appeals, Google Workspace data-deletion requests, or concerns, contact Colossal Intelligence Inc. at contact@colossalhq.com.