Cymon Privacy Policy
1. Who we are
Cymon ("Cymon," "we," "us") is an AI assistant for sales professionals. It is operated by TOP Sales Partners, Inc. (DBA Cymon AI), 850 New Burton Road, Suite 201, Dover, Delaware 19904, United States. This policy explains what personal data we collect when you use cymon.ai, app.cymon.ai and our related apps (the "Service"), how we use it, who we share it with, and the choices you have.
Questions or requests: privacy@cymon.ai. General support: support@cymon.ai.
2. The short version
- We use your data to run the features you turn on: live call coaching, transcripts, meeting prep, role-play, and email and calendar help.
- We never sell Google user data. We never use it for advertising. We never use it to train AI models.
- Connecting Google Calendar or Gmail is optional. You can disconnect at any time. When you disconnect, we revoke our access token with Google and delete the related data right away.
- When you delete your account, we purge your personal data (see Section 9 for the narrow exceptions).
- Our raw AI input/output debug log is off by default. If we turn it on to fix a problem, those logs are deleted automatically after 48 hours.
3. Information we collect
3.1 Information you give us
- Account details: name, email address, password or sign-in details, company, role, and preferences.
- Content you create or upload: playbooks, notes, knowledge-base documents, role-play scenarios, and voice or text commands you give Cymon.
- Billing details: plan, billing contact and billing address. Card details are collected and stored by our payment processor, Stripe. We do not see or store full card numbers.
- Communications: support requests, enterprise inquiries, feedback and survey answers.
3.2 Information from calls you ask Cymon to join or assist
- When you send Cymon to a meeting (Google Meet, Zoom or Microsoft Teams) through our meeting bot, or let Cymon listen through your device, we process the meeting's audio, live transcript, participant names and display information, and meeting details.
- We create and store transcripts, coaching suggestions, summaries and AI answers so you can review them.
- Other people on your calls may be recorded or transcribed. You are responsible for telling them and getting any consent the law requires (see our Terms of Service).
3.3 Information from Google accounts you connect (Google user data)
You can choose to connect Google Calendar and Gmail. Each is a separate connection, and you see Google's consent screen before we get any access. Section 4 covers this in full.
3.4 Information from other services you connect
You can also connect Microsoft Outlook/Microsoft 365 calendar and mail (through our provider Nylas), and other tools such as [ ]. We use that data only to provide the features you turned it on for, in the same way described for Google data below.
3.5 Information collected automatically
- Usage and device data: IP address, browser and device type, pages and features used, timestamps, and error reports.
- Service logs: security, sign-in and application logs that keep the Service running and secure.
- Cookies: we use cookies and similar technology that are strictly necessary for sign-in, security and preferences.
4. Google user data
This section explains how Cymon accesses, uses, stores, shares and deletes data we receive from Google APIs.
4.1 What we access, and why
| Connection | Google permission (scope) | What we access | What we use it for |
|---|---|---|---|
| Sign-in (both connections) | openid, email | Your Google account email address and a basic account ID | To know which Google account you connected and show it in your settings |
| Google Calendar | calendar.events; [calendar.calendarlist.readonly] | The list of your calendars, and events on the calendars you pick: title, time, attendees, location, description, and video-meeting links | Show your upcoming meetings; answer "what's my next meeting?"; prepare you for a meeting; send the Cymon meeting bot to a meeting when you ask; create a calendar event when you ask |
| Gmail | gmail.readonly | Email messages you or Cymon search for, including sender, recipients, subject, date, body and attachments | When you ask (for example "what did Jordan say about pricing?" or "prep me for Acme"), Cymon searches your mailbox and reads the relevant messages so it can answer, prepare you for the call, or draft a reply |
| Gmail | gmail.compose | Drafts that Cymon creates | Save follow-up emails you ask for as drafts in your Gmail Drafts folder. Cymon does not send email for you. You review and send each draft yourself in Gmail. |
4.2 How we use Google user data
- We use Google user data only to provide and improve the user-facing features described above, which you can see in the Cymon app.
- To answer a request, the relevant calendar or email content is sent to the AI model that powers Cymon (see Section 6). The model processes it to produce the answer or draft and returns it to you. Our AI providers may not use this data to train their models, and we do not use it to train ours.
- We do not use Google user data for advertising, for marketing to you, to build profiles for third parties, or to decide creditworthiness or lending.
4.3 How we store Google user data
- Google access and refresh tokens are kept only on our servers. They are encrypted at rest (AES-256-GCM) and never sent to your browser.
- We do not keep a copy of your mailbox or calendar. We fetch what is needed when a feature needs it.
- Content Cymon produces for you from Google data (for example a meeting brief or a draft reply) is kept in your account so you can see it, and is deleted as described in Section 4.6 and Section 9.
- All data is encrypted in transit (HTTPS/TLS) and at rest in Microsoft Azure data centers in the United States.
4.4 How we share Google user data
We share Google user data only with service providers that help us deliver the features you asked for, under contracts that require them to protect it and use it only for us: our hosting provider (Microsoft Azure) and our AI model provider(s) listed in Section 6. We may also disclose it if needed for security (for example investigating abuse), to comply with the law, or as part of a merger, acquisition or sale of assets, and only after getting your explicit consent first. We never sell Google user data or transfer it to advertising platforms, data brokers or information resellers.
4.5 Who can see your Google user data
Cymon staff do not read your emails or calendar content. We allow a person to view specific Google user data only (a) when you give us explicit permission, for example to troubleshoot a problem you report; (b) when it is needed for security, such as investigating a bug or abuse; (c) to comply with the law; or (d) when the data is aggregated and anonymized for internal operations.
4.6 Disconnecting and deleting
- You can disconnect Google Calendar or Gmail at any time in Cymon [Settings → Connections], or from your Google Account at https://myaccount.google.com/permissions.
- When you disconnect in Cymon, we immediately revoke our token with Google and delete the stored connection and the Google user data related to it.
- If you revoke access from your Google Account instead, Cymon detects that the token no longer works and deletes the stored connection.
4.7 Limited Use statement
Cymon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will also adhere to the Google Workspace API User Data and Developer Policy.
5. How we use your information (all data)
- To provide the Service: live coaching, transcripts, meeting prep, role-play, voice commands, and email and calendar help.
- To manage your account, subscriptions and billing.
- To provide support and respond to inquiries.
- To keep the Service secure, prevent fraud and abuse, and fix problems.
- To improve the Service using usage metrics and aggregated, de-identified information. Google user data is never used for this.
- To send service messages. With your permission, or where the law allows, we also send product updates, which you can unsubscribe from at any time.
- To comply with law and enforce our Terms.
6. Service providers (subprocessors)
We use these providers to run Cymon. Each gets only the data it needs for its job.
| Provider | Purpose | Data involved |
|---|---|---|
| Microsoft Azure (US) | Hosting, database, storage, logging; AI models through Azure AI Foundry / Azure OpenAI; speech services; document text extraction | All Service data, including Google user data |
| Recall.ai | Meeting bot that joins Google Meet, Zoom and Teams calls when you ask | Meeting audio/video stream, live transcript, participant names, meeting link |
| Deepgram | Speech-to-text and text-to-speech | Call and voice-command audio |
| Anthropic | AI model provider | Text sent to the AI model, which may include Google user data |
| TypeSafe AI | Fast AI decisions during calls | |
| Nylas | Connecting Microsoft Outlook/365 calendar and mail | Microsoft calendar and mail data (not Google data) |
| Stripe | Payments and subscription billing | Billing contact, payment details, plan |
| Slack | Internal alerts to our team (for example new enterprise inquiries) | Inquiry contact details you submit |
| Better Stack | Application logs and monitoring | Operational logs (never raw AI input/output) |
| Firecrawl, Jina AI, Brave Search | Public web research for meeting prep (for example a prospect's company website) | Company names, website URLs, search terms. |
| [Supabase] | [Database] | [ ] |
| [HubSpot, Google Workspace] | Our own CRM and email for waitlist, sales and support messages | Contact details of people who contact us |
We may update this list.
7. Other ways we share information
- Your organization: if you use Cymon through a company workspace, administrators of that workspace may see call records, transcripts and coaching results for the workspace. They cannot see your connected Gmail or Google Calendar content.
- Legal and safety: when required by law or to protect rights, safety and security.
- Business transfers: in a merger, acquisition or asset sale. Google user data is transferred only with your explicit prior consent.
- We do not sell personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are used in California law).
8. AI and your data
- Cymon uses large language models to understand your requests and generate coaching, answers and drafts.
- Our AI providers process data only to give us the response. They may not use it to train their models. Prompts may be held briefly in the provider's prompt cache (typically 30 minutes to 24 hours) and then expire.
- Google user data is never used to train AI models, ours or anyone else's.
- Our raw AI input/output debug log is off by default. When we turn it on to diagnose a problem, it is deleted automatically after 48 hours and is never sent to outside logging tools.
- AI output can be wrong. Check important information before you rely on it.
9. How long we keep data
| Data | How long |
|---|---|
| Google connection (tokens) and Google user data | While connected. Deleted immediately when you disconnect. |
| Transcripts, coaching output, AI answers, drafts | While your account is active. Deleted when you delete them or your account. |
| Call audio | [Not stored] |
| Raw AI input/output debug log | Off by default; 48 hours when on |
| Application, security and sign-in logs | [90 to 180 days, per our logging policy] |
| Billing records and usage minute counts | [7 years, for tax and accounting. Counts only, no call content.] |
| Encrypted backups | Expire within [90] days |
What happens to your data when your account is deleted
- Call records are kept for the company workspace. They are not deleted.
- The user's account, including their name and email, is removed, and their identity on those records is replaced by "deleted-user".
- Meeting titles on the deleted user's calls become "Call (account deleted)", and attendee labels become "Participant N".
- Every connected account is deleted: Google Calendar and Gmail, Microsoft (through Nylas) and Granola. That deletes the tokens, the connected account email and other data derived from those connections, including all Google-derived data.
- The Microsoft connection is also cancelled at Nylas when the account is deleted. The Granola key is removed from Cymon, but Cymon cannot cancel it at Granola: revoke it in your Granola settings.
- Spoken content in retained call transcripts may remain after account deletion, and what was said may still identify the person.
10. Security
We protect data with encryption in transit and at rest, encrypted OAuth tokens, access controls with multi-factor authentication for administrative access, logging and monitoring, and vendor security reviews. We follow internal security policies aligned with SOC 2. No system is perfectly secure. If a breach affects your data, we will notify you as required by law.
11. Your choices and rights
- Access, export, correct and delete your data in the app or by emailing privacy@cymon.ai. We respond within 30 days and verify your identity through your signed-in account.
- Disconnect Google, Microsoft or other connections at any time.
- Opt out of marketing emails using the unsubscribe link.
- Depending on where you live (for example California, other US states, the EEA or the UK), you may have additional rights, such as objecting to or restricting processing, and complaining to a data protection authority. We will not discriminate against you for using them.
12. Children
Cymon is a business tool for adults. It is not directed to children, and we do not knowingly collect data from anyone under [18]. If you think a child has given us data, contact us and we will delete it.
13. International users
We process and store data in the United States. If you use Cymon from outside the US, your data will be transferred to the US.
14. Changes to this policy
We will post updates here and change the "Last updated" date. If we make a material change, especially to how we use Google user data, we will notify you and, where required, ask for your consent before the new use begins.
15. Contact
TOP Sales Partners, Inc. (DBA Cymon AI)
850 New Burton Road, Suite 201, Dover, Delaware 19904, United States