Guffles AI legal
Privacy Policy
Last updated October 4, 2026
This policy is written in plain language and describes the current service. If we make a material change, we will update this page and its effective date and provide additional notice when required.
Guffles AI is operated by Spectrum AI Labs ("Guffles", "we", "us", or "our"). This policy explains how we handle personal data when you visit, create a business workspace, purchase credits, research leads, use AI features, or connect Google or HubSpot.
Scope and business use
Guffles is intended for business users who are at least 18 years old and have authority to act for their organization. This policy covers the Guffles website, dashboard, APIs, support, and connected-service workflows. It does not replace the privacy terms of third-party services you choose to connect.
Account and workspace data
We process your email address, authentication records, profile and onboarding answers, company and workspace settings, searches, saved leads, lists, exports, generated sequences, usage and credit records, integration status, support communications, and billing records. We use this information to authenticate you, deliver and secure the service, meter credits, prevent abuse, troubleshoot failures, enforce our terms, and improve product reliability.
Business lead and enrichment data
Guffles receives business and professional contact data from configured data providers and public web sources. Records may include names, work contact details, job titles, employers, professional profiles, business details, locations, ratings, reviews, and website information. We charge for research and licensed access to professional lead records as part of the service. Where applicable law treats that activity as a sale or sharing of personal information, affected individuals may exercise the applicable opt-out, access, correction, or deletion rights by contacting us. A lead record or verification result is never proof of consent to outreach.
Why we process data
Depending on the context and applicable law, we process data to perform our contract with you, provide features you request, protect our legitimate interests in operating and securing the service, comply with legal obligations, and act on consent where consent is required. We may also create aggregated or de-identified statistics that do not reasonably identify a person and use them to understand costs, performance, fraud, and product quality.
AI processing
When you ask Guffles to build AI Context from a company website, Guffles sends the public website address to our private website-crawling service and sends the extracted public page text to OpenRouter and the selected model provider. Lead qualification also sends the approved workspace context and relevant lead or company facts needed to make the requested decision. We do not store raw crawled page bodies in the ordinary product database. We store structured company facts, products, source URLs, retrieval timestamps, content hashes, qualification evidence, model-usage metadata, cost, and latency so you can review the result and we can control quality and spending. Do not submit confidential, regulated, or sensitive personal data that is unnecessary for the requested feature. Provider handling is subject to the applicable provider configuration and terms. Guffles does not use Google Workspace data to train generalized or non-personalized AI models and does not currently send Gmail message or Calendar event content to an AI model provider.
Google Workspace data
If you connect one or more Google mailboxes, Guffles requests only the configured permissions needed to send Gmail messages you explicitly approve, read Gmail threads for reply context, and create events on each connected account's owned primary calendar. For every mailbox, we store its connected account identifier, granted scopes, expiry metadata, and encrypted OAuth access and refresh tokens. Connecting Google never starts automatic outreach. Gmail content, thread content, attendee addresses, and Calendar event content are processed only for a user-requested feature and are not currently stored as ordinary workspace records.
Google Limited Use
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide or improve the user-facing connected feature. We do not sell Google user data, use it for advertising or credit decisions, transfer it to data brokers, or use it to train or improve generalized or non-personalized AI or machine-learning models.
HubSpot data
If you choose Connect HubSpot, Guffles stores the connected portal identifier, granted scopes, expiry metadata, and encrypted OAuth access and refresh tokens. When you explicitly push leads, Guffles transfers the selected contact fields to your HubSpot account and uses email as the contact identity for deduplication and updates. Connecting HubSpot does not create an automatic continuous sync. Disconnecting removes the local encrypted connection record and attempts the provider-side revocation supported by HubSpot. If you explicitly enable a list binding, Guffles can push new list members automatically through the selected target and mapping; you can pause or disconnect it.
Sheets, Airtable and Salesforce data
When you connect Google Sheets, Airtable or Salesforce and configure a destination, Guffles stores the encrypted grant, account identity, scopes and selected mapping needed for that feature. A Sheets connection uses per-file access to the selected spreadsheet. Explicit pushes and enabled list bindings transfer the selected owned lead fields to your destination. Disconnecting removes credentials from Guffles; account deletion follows the provider revocation rules described below. Airtable grant revocation also requires the owner to remove Guffles in Airtable connected apps.
Processors, providers, and transfers
We disclose data only as needed to operate a selected feature, comply with law, protect the service, complete a corporate transaction, or follow your instructions. Providers may include hosting and database infrastructure, Apify data actors, OpenRouter and selected model providers, Dodo Payments, Inngest, Resend, Sentry, Google, Google Sheets, HubSpot, Airtable, and Salesforce. Payment card details are collected by the payment provider and do not pass through Guffles servers. Providers may process data in countries other than yours, subject to their safeguards and any transfer protections required by applicable law.
No sale of customer or connected-account data
We do not sell customer account content, workspace content, Google Workspace data, HubSpot account data, or OAuth tokens. This restriction is separate from the core lead-research service described above, which provides business and professional contact records obtained from configured providers and public sources.
Cookies, local storage, and logs
We use authentication cookies required to keep you signed in and browser storage for account-scoped interface preferences and cached display state. We do not use this storage for third-party behavioral advertising. Infrastructure, security, billing, and diagnostic logs may record timestamps, request metadata, device or browser information, IP addresses, route and error details, and pseudonymous identifiers. We take steps to keep credentials, OAuth tokens, and lead content out of ordinary logs. A private cookie can display the saved deletion outcome after account removal; it does not authorize account changes. Authentication rate counters use private subject hashes. We record the Terms and Privacy versions, content hashes and server acceptance times without inventing historical consent.
Security
We use HTTPS in transit, workspace-scoped access controls, server-only credentials, deny-by-default database policies where applicable, and AES-256-GCM encryption for stored OAuth access and refresh tokens. Access is limited according to operational need. No service can guarantee absolute security, and you are responsible for protecting access to your email account and connected services. Report suspected unauthorized access immediately.
Retention
OAuth tokens are retained until you disconnect, the grant becomes unusable, or the related account is deleted. Active workspace, lead, search, list, generated-content, entitlement, and usage records are retained while needed to provide the service. After account closure or verified deletion, primary product data is normally removed or de-identified within 30 days, while encrypted backups may cycle out over up to 90 additional days. Security and operational logs are normally retained for up to 12 months, support records for up to 24 months, and billing, tax, anti-fraud, dispute, or legal records for the longer period required or permitted by applicable law. We may retain specific records longer when reasonably necessary to establish, exercise, or defend legal claims, enforce our terms, investigate abuse, or comply with a lawful hold.
Deletion and integration controls
Owners can delete a workspace or account in Settings after a fresh email code and a typed scope confirmation. A committed request closes product access immediately, revokes API keys and webhooks, and removes credentials from the active workspace. Encrypted grants needed for provider revocation remain in a restricted temporary vault until acknowledged. Guffles schedules Dodo subscription renewal cancellation immediately and requires terminal cancellation at primary purge. Owners have seven days to undo; undo does not restart renewal, resume missions or reconnect integrations. Google, Google Sheets, HubSpot and Salesforce revocations use their supported provider APIs. Airtable credentials are removed from Guffles; the owner must revoke Guffles in Airtable connected apps. You may also remove Guffles directly in each provider account. Support and the formal legal contact remain available for statutory requests, lead-record suppression and people without an account. Deletion does not reverse completed exports, provider pushes, lawful disclosures, provider operational logs or independent third-party records.
Your choices and rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about disclosures, and to complain to a competent authority. We may verify identity, authority, and workspace ownership before acting. Rights can be limited by law, the rights of others, security, fraud prevention, recordkeeping duties, or legal claims. Professional contacts may also request removal or suppression of a lead record.
Children
Guffles is a business service and is not directed to anyone under 18. We do not knowingly permit minors to create workspaces. Contact us if you believe a minor provided personal data so that we can investigate and take appropriate action.
Changes, business transfers, and contact
We may update this policy as the service, providers, ownership, or law changes. Material changes will be posted with a new effective date and additional notice where required. Data may be transferred as part of a financing, reorganization, merger, acquisition, or asset sale, subject to this policy or notice of materially different handling. Privacy and grievance requests may be sent to support@guffles.com; formal legal notices may be sent to paras@spectrumailabs.com.
Guffles AI is operated by Spectrum AI Labs. Product, billing, privacy, and deletion requests may be sent to support@guffles.com. We reply within 2 business days.
Formal legal notices may be sent to paras@spectrumailabs.com.