Privacy policy

What ColdPegion processes

ColdPegion is an email campaign and inbox management service. We process account details, workspace membership, connected mailbox details, contact lists, campaign messages, replies, preferences, usage records and billing references to provide the features you use. Payment details are handled by our payment provider, Dodo Payments.

Google sign-in and connected Gmail mailboxes

Google sign-in identifies your account. Connecting a Gmail mailbox is a separate, optional authorization. We request permission to send email on your behalf and read email messages and settings. We use mailbox access to send the campaigns and replies you authorize, synchronize incoming messages, detect replies and bounces, stop follow-ups and support enabled inbox and warmup features. Gmail access does not give ColdPegion permission to delete or change your Gmail messages.

Connection tokens are encrypted before being stored. Mail content and campaign records are stored in our service database to provide your inbox and campaign history. Workspace sharing and the AI agents you authorize can make relevant records available to other authorized users or tools.

AI and integrations

AI features can process the content needed to draft messages, assist with campaigns and categorize incoming mail using Google Cloud AI or an AI provider configured for your account. If you connect your own provider, that provider processes the content sent for those features under its terms. HubSpot and verification providers receive relevant data when you enable and use those integrations. Optional HubSpot BCC sends a copy of outgoing messages to the logging address you configure.

ColdPegion does not sell mailbox data, use it to target advertising, or use it to train general-purpose AI models. Google user data is used to provide the user-facing features you authorize. Our use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements.

Hosting, access and security

We use Google Cloud for hosting, database infrastructure, file storage and operational services. Service providers process data needed to operate the product. Authorized operators may access data when necessary to address support requests, security incidents or service operations. Connections use HTTPS, and mailbox credentials are encrypted in storage. Operational logs and backups are retained to maintain and recover the service.

Your choices and deletion

You can remove connected mailboxes in Dashboard → Email Accounts and revoke Google access in your Google Account connections. Revoking access stops future API access; it does not automatically erase historical campaign or inbox records already stored. You can remove campaign and contact records using the app, or request account and associated data deletion by emailing hkjigar3@gmail.com. Operational backups may retain previous data until their retention period expires; records required for billing, security or legal obligations may be retained as necessary.

Contact and changes

For privacy questions, access requests or corrections, contact hkjigar3@gmail.com. We update this page when our practices change and request new consent before using Google data for a materially different purpose.