Privacy policy

1. What we collect

Your account

Your name, email address and profile picture from the sign-in you choose (Google, or email and password). If you subscribe, Stripe handles your card; we keep your plan, billing status and invoice history.

What you put in your workspace

Your products, brand kits, personas, campaigns, posts, articles, images, videos, email sequences, notes and settings, plus anything you upload.

Accounts you connect

When you connect a social page, ad account, blog, mailbox or other tool, we store the access it grants us (sign-in tokens, keys or app passwords). These are encrypted and are never shown again, not even to you. We use each connection only for the features you turn on:

• Social pages and ad accounts (LinkedIn, Facebook Pages, X, Meta Ads): to publish the posts and ads you approve, and to read their results.
• Blogs (WordPress, Ghost, Notion): to publish the articles you approve. With Notion, we can see only the pages and databases you choose to share on Notion’s own screen, and we add each approved article as a page there.
• Mailboxes (Gmail, Microsoft 365, or any mailbox by IMAP/SMTP): to send warm-up and outreach emails you approve, to read and sort warm-up emails between your own mailboxes (for example, moving them out of spam and replying to them), and to spot replies to your outreach so you can see and answer them.
• Google Search Console: read-only, to show how your blog performs in search.
• Other tools you connect (such as HubSpot or WhatsApp): only for the feature you connected them for.

Leads and contacts

Names, emails, job titles, companies and similar details of people you import, find through lead search, or who reply to your outreach. For this data you decide who is contacted and why, and we process it on your behalf. You are responsible for having a lawful reason to contact them.

How you use the service

Pages visited, features used, device and browser type, approximate location from your IP address, and technical logs. We use these to keep the service secure and working and to improve it.

2. How we use it

• To run the service: create content, schedule it, and publish or send what you approve.
• To bill you, prevent fraud and enforce plan limits.
• To send you service emails (sign-in, billing, alerts you turn on). We don’t send marketing email without your consent.
• To give support when you ask for it.
• To keep the service secure, fix problems, and understand which features are used.
• To meet legal obligations, such as tax records.

We don’t sell your data, don’t use it for advertising, and don’t use it to train AI models. People at Morpho LLC look at your workspace content only when you ask us to (for support), when needed for security or abuse investigations, or when the law requires it.

3. AI

To write or create something for you, we send the relevant part of your workspace (for example, your brand kit and the brief) to the AI provider doing the work, through their business API. They process it to return the result and, under their API terms, don’t use it to train their models. To draft a reply to an email, the email you received is sent too. AI output can be wrong: that’s why everything waits for your approval.

4. Google user data

GTM ToolBox’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Gmail data is used only to provide the mailbox features described above, which you can see and control in GTM ToolBox. It is not used for advertising, not sold, not used to train AI models, and not read by people except with your permission, for security, or as required by law. Microsoft mailbox data is handled the same way.

5. Who we share it with

We share data only with the services that help us run GTM ToolBox, and only what each one needs. They act on our instructions:

When you publish or send something, it goes to the platform you chose (LinkedIn, Meta, X, your blog, your mailbox provider and so on), and their own privacy policies apply to it there.

We may also disclose data if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

6. Where your data is stored

Our servers and database are in the European Union (Belgium). Some of the services above are based in the United States or elsewhere. When data leaves your country, we rely on safeguards such as the European Commission’s standard contractual clauses where they apply.

7. How long we keep it

• Your workspace and connections: for as long as your account is open.
• When you ask us to delete your account, we delete your workspace, connections and leads within 30 days. Backups are overwritten within a further 30 days.
• When you remove a connection, its stored access is deleted straight away.
• Invoices and payment records: as long as tax and accounting law requires.

8. Security

Data is encrypted in transit, and the access you grant to connected accounts is encrypted at rest. Each workspace’s data is kept separate from every other workspace’s. No system is perfectly secure; if a breach affects your data, we will tell you without undue delay.

9. Cookies

• Sign-in cookie: keeps you signed in. The service doesn’t work without it.
• Analytics: Google Analytics for Firebase measures which pages and features are used, so we can improve them.

We don’t use advertising cookies. You can block or delete cookies in your browser settings.

10. Your choices and rights

Depending on where you live, you can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it, or close your account;
• restrict or object to how we use it;
• send it to you or another service in a portable format.

Email ft@newgar.com and we will answer within 30 days. You can also disconnect any connected account at any time, in GTM ToolBox or from that platform’s settings (for Google, at myaccount.google.com/permissions). If you’re unhappy with our answer, you can complain to your local data protection authority.

If you are a lead or contact of one of our customers, please contact that customer first; we will help them respond to you.

11. Children

GTM ToolBox is for businesses and isn’t meant for anyone under 18. We don’t knowingly collect their data.

12. Changes

We may update this policy. The date at the top shows when it last changed. For important changes, we’ll tell you by email or in the app before they take effect.

13. Contact

Morpho LLC, the operator of GTM ToolBox, is responsible for your data. Questions or requests: ft@newgar.com. See also our terms of service.