Privacy policy

What we store

Your account email, the expert profile you give us (bio, topics, sample quotes, links), the drafts and pitches generated from it, and the backlinks Quotarly finds for your site. That's what powers the product — there isn't a separate marketing database of the same data.

What we don't do

We don't sell your data, and we don't use your bio or quotes to train models. Your profile is only ever used to draft your own pitches.

Who else touches it

We use Supabase to store your data, Anthropic's Claude to draft and score pitches, DataForSEO to check whether a link landed, and a payment processor to handle billing. Pitches send either through Resend or, if you've connected it, through your own Gmail account — see below. Each only sees what it needs to do its part.

Connecting your Gmail account

If you connect Gmail from your dashboard settings, Quotarly asks Google for a single, narrow permission: send email on your behalf (the gmail.send scope), plus your Google account email address so we can show you which account is connected.

What Google user data we access

Only two things: (1) the ability to send an email through your Gmail account via the gmail.send scope, and (2) your Google account's email address (via the openid and userinfo.email scopes), used only to label the connection in your Settings page (e.g. "Connected as you@gmail.com"). We never request, and Google never grants us, any ability to read, search, list, or modify messages already in your mailbox — that data is physically outside what gmail.send can access.

How we use this data

We use it for exactly one purpose: sending the specific pitch email you've reviewed and approved (via the "Approve & send" button in your dashboard), from your own Gmail address instead of a shared one, so journalists see a real, recognizable sender. We never use this access for any other purpose — not analytics, not advertising, not AI model training, not sending anything you haven't approved.

Who we share it with

We don't share, transfer, sell, or disclose your Google account data, your Gmail connection, or any email sent through it with any third party. It is used solely within Quotarly's own systems to send your approved pitches. Our infrastructure providers (Supabase for the database, Vercel for hosting) store or process the encrypted token described below as part of running the service, under their own confidentiality and security obligations — they do not use it for any purpose of their own.

How we protect this data

The OAuth refresh token that lets us send on your behalf is encrypted at rest (AES-256-GCM) in our database before it's ever stored, and is only decrypted in memory at the moment a pitch is sent. Access to decrypt it is restricted to the server-side send process — it's never exposed to the browser, to other users, or to any Quotarly staff member's regular tooling. We never see or store your Google account password.

Retention and deletion

We keep the encrypted token only for as long as your Gmail connection stays active. You can disconnect at any time from your dashboard's Settings page, or by removing Quotarly's access directly at myaccount.google.com/permissions. Either way, we delete the stored token immediately and permanently, and future pitches fall back to sending from quotarly.com. Deleting your Quotarly account (see below) also deletes any connected Gmail token immediately.

AI use and Google Workspace data (Limited Use compliance)

The use of information received from Google Workspace APIs by Quotarly will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Quotarly's AI drafts pitches only from the expert profile, bio, and sample quotes you enter directly into your Quotarly dashboard — it never reads, processes, or has access to anything in your connected Gmail account, since the gmail.send scope only allows sending a message, not reading one. We do not use any data received from Google Workspace APIs — raw, derived, or aggregated — to train, improve, or develop any AI/ML models, foundational or otherwise.

Deleting your account

Ask from your account settings or by emailing us, and we'll remove your profile, drafts, and pitch history. Records we're required to keep for billing are kept only as long as the law requires.

Questions

Reach us at hello@quotarly.com.