What we collect. What we don't. Why.

2026-05-28 — the email thread is the record; per-action cryptographic receipts retired for individual tiers.

We store the data you save: documents you upload, Ctrls you sign, and the invocations they produce. The emails you forward and the replies we send are kept as your working record — your inbox and sent folder are the audit trail. All of it lives in your org's dedicated database; we never co-mingle org data.

We do not sell data. We do not train foundation models on your documents, your Ctrls, or your invocations. We do not enable third-party advertising or analytics that touch invocation content.

At every tier you can bring your own LLM API keys. Your model spend bills directly from your provider; tokens never pass through any account we hold. Anthropic, OpenAI, Google, OpenRouter all supported.

Every action your agent takes is an email you can read, search, forward, and reply to — your inbox and sent folder are the audit trail, in the place you already look. Internally we keep an invocation log for cost, limits, and debugging. Per-action Ed25519-signed receipts and a hash-chained transparency log are available as an Enterprise audit feature.

US-East by default. EU-West and APAC available on Enterprise with a DPA. Per-org encryption at rest; per-tenant keys on Enterprise.

Vercel (hosting), Neon (Postgres), Anthropic / OpenAI / Google (when your BYOK uses them), Resend (transactional email), Upstash (rate limiting). Full current list available on request.

Email privacy@goalinbox.com for the full DPA, subprocessor list, or any specific question. For data deletion requests, write to the same address; we respond within five business days.