Privacy Policy

AI SDR (“AI SDR”, “we”, “us”) is operated by Get On A Pod. AI SDR answers the replies your EmailBison campaigns receive, follows up with leads and books meetings on your calendar. This policy explains what data we collect, how we use it, who we share it with and the choices you have. It applies to this website and the AI SDR application.

Who this policy covers

Customers and their team members who sign in to AI SDR, and leads: the people who reply to our customers’ email campaigns. For lead data, our customer decides what is processed and why, and we process it on their behalf and under their instructions.

Information we collect

Account information

• Your name, email address and password (stored only as a one-way hash).
• If you sign in with Google: your Google account email address. Google also shares your name and profile picture, which we do not store.
• Workspace membership, role and settings.

Data from services you connect

• EmailBison: your API key, and the campaigns, email threads, replies, lead names, email addresses and related details we need to read and answer replies.
• Google Calendar: described in full in the next section.
• Other integrations you enable, such as Cal.com, GoHighLevel or webhook and automation destinations: the credentials you give us and the data needed to send or receive the events you configure.

Billing information

Payments are handled by Stripe. We receive your subscription status and billing contact details. We never see or store your full card number.

Usage and technical information

Server logs that record requests, errors and the IP address they came from, which we use to operate, secure and debug the service. We use only strictly necessary cookies: one keeps you signed in, and short-lived ones carry an invitation or a Google sign-in through to completion. We do not use analytics, advertising or tracking cookies. Training videos embedded in the app are hosted by Loom or YouTube, which may set their own cookies when you play them.

Google user data

AI SDR asks for access to your Google account only when you choose to connect a calendar or sign in with Google. We request these permissions:

• Basic profile (openid, email, profile): to sign you in and to label which Google account a connected calendar belongs to. Signing in with Google asks for these only; the Calendar permissions below are requested only when you connect a calendar.
• View your calendars (calendar.readonly): to list your calendars so you can pick which ones to check, to read when you are busy so AI SDR only offers leads times you are actually free, and to show your upcoming meetings inside the AI SDR calendar view.
• Manage events (calendar.events): to create the meeting on the calendar you choose when a lead books, and to reschedule or cancel meetings that AI SDR booked.

What we store. We store encrypted OAuth tokens, the connected account’s email address, each calendar’s name and ID, your settings for which calendars to check and write to, and the ID and meeting link of each event AI SDR created. Busy times and event details are read from Google when they are needed and are not kept as a copy of your calendar.

AI processing. To draft a reply that proposes meeting times, AI SDR may send the start and end times of your busy periods, and the open slots calculated from them, to the AI model provider your workspace uses. The titles, descriptions and attendees of your events are not sent. Google user data is never used to develop, improve or train generalized AI or machine-learning models, ours or anyone else’s.

Sharing. We do not sell Google user data, use it for advertising, or transfer it to anyone except as needed to provide the features described above, to comply with the law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent. We do not use it to determine creditworthiness or for lending. Our staff, including platform administrators, do not read your Google data unless you ask us to for support, it is needed for security or abuse investigations, or the law requires it.

Limited Use. AI SDR’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect a Google account at any time from Settings in AI SDR, which deletes its stored tokens and calendar records. Records of meetings AI SDR already booked, including their event IDs and meeting links, stay in your meeting history until you delete your account. You can also revoke access from your Google Account permissions page.

How we use information

• To provide AI SDR: reading and classifying replies, drafting and sending responses and follow-ups when you allow it, checking availability and booking meetings.
• To run your account, process payments and send service emails such as password resets and invitations.
• To keep the service secure, prevent abuse and fix problems.
• To comply with legal obligations.

We do not sell personal information and we do not use it for advertising.

Service providers we share data with

We share data only with providers that help us run AI SDR, and only what each needs:

• Hosting and infrastructure: Railway (application and database hosting) and Cloudflare (network and security).
• AI model providers: Anthropic, OpenAI, OpenRouter, TypeSafe, or another provider your workspace configures, to classify replies and draft responses. Anthropic, OpenAI and OpenRouter (which we configure to deny data collection) do not train their models on data sent through their APIs. For a provider your workspace configures itself, that provider’s terms apply.
• Lead research: Serper, a search API, receives a lead’s name and company to find their public LinkedIn profile, and AuthorityBuilt (hosted on Supabase) receives a prospect’s name and bio when you create a prospect sheet.
• Email delivery: n8n (our automation service) and Google Workspace (Gmail), for account emails such as welcomes, password resets and invitations.
• Payments: Stripe.
• Integrations you connect, such as EmailBison, Google Calendar, Cal.com, GoHighLevel or your own webhook and automation endpoints.

We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger, acquisition or sale of assets. Google user data is the exception and is handled only as described in the Google section above.

Security

Data is encrypted in transit with TLS. Third-party credentials and OAuth tokens are encrypted at rest. Each workspace’s data is isolated from every other workspace, and access is limited to the people who need it to run the service.

Retention and deletion

We keep your data while your account is active. If you close your account or ask us to delete your data, we delete it within 30 days, except where we must keep certain records, such as billing records, to meet legal obligations. Disconnecting an integration deletes its stored credentials right away.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to how we process it. Email [email protected] and we will respond within 30 days. If you are a lead contacted by one of our customers, we will pass your request to that customer, or you can contact them directly.

Children

AI SDR is a business tool and is not directed to anyone under 16. We do not knowingly collect data from children.

International transfers

We and our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards for those transfers.

Changes to this policy

If we change this policy, we will update the effective date above, and for material changes we will notify account owners by email or in the app before the change takes effect.

Contact

Questions about this policy or your data: [email protected].