Privacy Policy

TrackWon is a signal-driven sales intelligence platform operated by Cloudhubibi FZE, a company registered in the Dubai World Trade Centre (DWTC) free zone, Dubai, United Arab Emirates.

TrackWon helps sales teams understand what is happening in their commercial relationships by reading email and calendar activity, converting that activity into commercial signals, and using those signals to surface a single recommended next action per deal.

In this policy, "TrackWon", "we", "us", and "our" refer to Cloudhubibi FZE. "You" refers to the individual using TrackWon, and "your organisation" refers to the company whose workspace is connected to TrackWon.

We collect the minimum data required to deliver the TrackWon service. This falls into three categories.

Account data. When you create a TrackWon account, we collect your name, work email address, and your organisation's workspace details. This is used to authenticate you and configure your account.

Google Workspace data. If you connect your Google account, we access Gmail and Google Calendar via Google OAuth with your explicit permission. This is described in detail in sections 3 and 4 below.

Usage data. We collect standard product usage data such as which features you use, how often you log in, and how you interact with the product. This helps us improve TrackWon and diagnose technical issues.

Contact and form data. If you submit a form on our website we collect the information you provide in that form, such as your name, email, company name, and any message you include.

TrackWon accesses Gmail only after you explicitly authorise it via Google OAuth. You will see a Google consent screen listing exactly what TrackWon is requesting permission to do before any access is granted. You can decline or revoke this at any time.

Once connected, TrackWon reads emails in your Gmail INBOX and SENT folders to detect commercial activity on your Journeys (deals). Specifically, we use:

• Sender and recipient fields to identify which contacts are involved in a conversation and match emails to the correct Journey.
• Subject line to categorise the type of email activity and filter out non-commercial messages such as newsletters, automated notifications, and marketing emails.
• Message body excerpt a short portion of the email body used to generate AI-driven summaries and next action recommendations. We use only what is necessary for this purpose.
• Timestamp to determine when the activity occurred and calculate signal recency.
• Gmail labels INBOX and SENT labels to determine direction (inbound or outbound). We discard TRASH, SPAM, and DRAFT messages entirely and never ingest them.

What we do not read from Gmail: We do not access personal emails unrelated to your commercial work. We do not access emails from non-business domains where they are clearly personal. We do not download or store email attachments. We do not access emails in any folder other than INBOX and SENT.

Email body retention. We retain the email body excerpt for signal calculation purposes. If an email body excerpt has not been used in a signal calculation within 30 days, it is deleted from our systems. We do not store full email bodies permanently.

TrackWon's use of Gmail data is limited to providing the TrackWon service to you. We do not use Gmail data for any other purpose.

TrackWon accesses Google Calendar only after you explicitly authorise it via Google OAuth. The same consent and revocation rules apply as for Gmail (see section 3).

Once connected, TrackWon reads calendar events to detect meetings with contacts on your commercial Journeys. Specifically, we use:

• Event title to identify the type of meeting and filter out personal or internal-only events such as lunch appointments, out-of-office blocks, and holds.
• Start and end time to determine when the meeting occurred and calculate meeting duration.
• Attendees to identify which contacts were involved and match the meeting to the correct Journey. We check whether attendees are external (contacts on a Journey) or internal (your own team). Meetings with only internal attendees are not ingested as commercial signals.
• RSVP status to understand acceptance and flag likely no-shows.
• Organiser to determine whether the meeting was inbound (prospect-initiated) or outbound (rep-initiated).

What we do not read from Calendar: We do not access the body or description of calendar events. We do not access personal events with no external attendees. We do not access calendar events unrelated to your commercial work.

TrackWon's use of Calendar data is limited to providing the TrackWon service to you. We do not use Calendar data for any other purpose.

TrackWon is hosted on DigitalOcean infrastructure. All data is encrypted in transit using TLS 1.2 or higher. All data is encrypted at rest.

Access to customer data internally is restricted to personnel who need it to operate and support the TrackWon service. We maintain access controls, audit logs, and access revocation procedures.

OAuth tokens (the keys that allow TrackWon to access your Google account) are stored using encrypted vault storage. They are never stored in plain text and are never exposed in logs, error messages, or API responses. Token refresh happens automatically in the background. If a token expires or is revoked, your connection status changes to "Needs reauthorisation" and TrackWon stops syncing data for your account until you reconnect.

Customer data is logically separated by workspace. No customer can access another customer's data.

TrackWon uses Google OAuth 2.0 to access your Gmail and Google Calendar. This means:

• You are redirected to Google's own consent screen before any access is granted.
• Google shows you exactly what TrackWon is requesting permission to access.
• You can approve or decline. If you decline, TrackWon cannot access your data.
• You can revoke TrackWon's access at any time from your Google Account permissions page or from within TrackWon's Integrations settings.
• Revoking access immediately stops TrackWon from syncing any new data from your account.

Each user connects their own Google account individually. No one in your organisation can connect another person's Google account on their behalf without that person completing the OAuth flow themselves.

We want to be unambiguous about this. TrackWon does not:

• Sell your data to any third party, ever, under any circumstances.
• Use your data for advertising your Gmail or Calendar data is never used to serve you or anyone else advertisements.
• Use your data to train AI models that are shared across customers or sold to third parties.
• Share your Gmail or Calendar data with any third party except where strictly necessary to operate the TrackWon service (see section 8).
• Transfer your data to any other application or service beyond what is required to deliver TrackWon to you.
• Access your Google account for any purpose other than detecting commercial signals and delivering the TrackWon service.

TrackWon's use of data obtained from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

We share data only where strictly necessary to operate the TrackWon service. Our current sub-processors include:

• DigitalOcean cloud infrastructure and hosting.
• Anthropic AI language model processing. Email and calendar signal data is passed to Anthropic's Claude API to generate Priority Move recommendations and Journey intelligence. Anthropic does not use this data to train their models under their enterprise data terms.
• Stripe payment processing. Stripe handles billing and subscription management. We do not store payment card details.

We do not share data with any other third parties except where required by law. If we are required by law to disclose data, we will notify you unless legally prohibited from doing so.

If we are involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

Account data is retained for the duration of your subscription and deleted within 30 days of account closure upon request.

Email signal data metadata (sender, recipient, subject, timestamp, direction) is retained for as long as your account is active. Email body excerpts are deleted after 30 days if they have not been used in a signal calculation.

Calendar signal data meeting metadata (title, time, attendees) is retained for as long as your account is active.

Journey and Moment records commercial intelligence derived from signals (Priority Moves, Pulse scores, Moments, Timeline entries) is retained for as long as your account is active and for up to 24 months of Pulse history.

When you close your account or request data deletion, we delete all personal data and Google-sourced data within 30 days. This includes all signal data, Journey records, OAuth tokens, and any AI-generated outputs derived from your data.

You have the following rights regarding your personal data:

• Access. You can request a copy of the personal data we hold about you.
• Correction. You can request that we correct inaccurate personal data.
• Deletion. You can request that we delete your personal data. We will action deletion requests within 30 days.
• Portability. You can request your data in a portable format.
• Disconnection. You can disconnect your Google account from TrackWon at any time from within the product or from your Google Account settings. Disconnecting stops all future data syncing immediately.
• Objection. You can object to how we process your data.

To exercise any of these rights, contact us at support@trackwon.com. We will respond within 30 days.

If you are based in the UK or EU, you also have the right to lodge a complaint with your local data protection authority.

TrackWon uses essential cookies required for authentication and session management. We do not use advertising cookies, tracking cookies, or third-party analytics cookies that share your data with other organisations.

Our website uses standard web analytics to understand visitor behaviour. This does not involve sharing your personal data with advertising platforms.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. Your continued use of TrackWon after a policy update constitutes your acceptance of the new terms.

For changes that significantly affect how we handle Gmail or Calendar data, we will provide at least 30 days notice before the change takes effect.

If you have any questions about this Privacy Policy or how we handle your data, please contact us.