1. Who operates aimtoro
aimtoro is responsible for this service. Questions or privacy requests can be sent to sales@aimtoro.com.
2. Information we handle
Depending on how you use aimtoro, we may handle:
- Account information you provide during aimtoro sign-up, including your email address, display name, saved workspace email signature, and an optional WhatsApp number. Password verification, secure password hashing, email verification, and authenticated sessions are handled by Clerk; aimtoro does not store your password.
- Free onboarding request information, including your name, verified work email, WhatsApp number, company, country, website when supplied, services, ideal-customer description, and campaign attribution such as UTM source or campaign.
- Your prospect-search criteria, including country, city, industry, requested company count, and the service you sell.
- Saved prospects, website reports, scores, public business evidence, contacts, email and WhatsApp drafts, approvals, follow-ups, and status history.
- Public website and business information retrieved from official sites, search results, social profiles, or reputable public directories.
- Basic service activity such as scan, search, account, outreach, newsletter delivery, estimated email opens, link clicks, email reply evidence, and WhatsApp delivery or read timestamps used to operate the workspace and administrative analytics. The private administrator inbox retains approved outbound email text and up to 20,000 characters of the plain-text portion of an observed reply, together with its sender, subject, message identifier, observation method, and time.
- A random browser identifier used to limit the free public website preview.
- Irreversible, keyed identity markers derived from a verified account email and, where already available, a verified mobile number to prevent repeated claims of a one-time free-credit offer. The anti-abuse ledger does not store the mobile number or canonical email used to create those markers.
- If you allow optional analytics, information about visits, viewed pages, traffic sources, device and browser categories, approximate geography, scrolls, outbound clicks, and similar interactions collected through Google Analytics.
3. How we use information
We use this information to review and arrange requested onboarding sessions, verify applicant email ownership, provide website scans, discover and verify prospects, prepare evidence-based reports and outreach drafts, enforce free-plan limits, keep customer workspaces separate, and send approved outreach. A free-onboarding verification message is transactional and is sent because the visitor requested the session. Optional prospecting tips are sent only when the applicant separately selects the marketing checkbox. Only when an account holder opts into customer email updates, aimtoro may send a first-scan activation reminder, a limited 14- or 45-day inactivity reminder, or a published Insight. These messages may include first-party open and Aimtoro-link tracking so administrators can understand engagement. Tracking records do not store the recipient's IP address or user agent. Email opens are estimates because images may be blocked or loaded by privacy services; provider acceptance is not proof of inbox delivery; and replies are reported only when aimtoro can observe them. We also use operational information to maintain security, troubleshoot failures, and understand aggregate service usage.
4. AI and service providers
aimtoro relies on service providers to operate. These may include Sites for hosting, Clerk for account authentication, Supabase for database storage, OpenAI for structured website analysis and outreach generation, Google Analytics and Google Tag Manager for consent-based usage measurement, search and crawler providers for public business research, an email provider when you approve an email, and WhatsApp when you choose an approved WhatsApp action. The protected worker may inspect bounded messages in the configured outreach mailbox to match genuine replies, display their plain-text content in the private administrator inbox, and stop pending follow-ups. If native WhatsApp delivery is enabled, aimtoro stores signed delivery metadata and message content in the protected workspace inbox so the workspace owner can read and reply. WhatsApp inbox messages are scheduled for deletion after 180 days. Relevant information is shared only as needed to perform those functions.
5. Public business information
aimtoro is designed to work with publicly available business information. It does not instruct AI to invent companies, people, email addresses, phone numbers, or website findings. Public information may still be incomplete or outdated, so users should review it before outreach.
6. Sharing and sale
We do not sell personal information. Information may be disclosed to the service providers described above, when required by law, to protect the service or its users, or as part of a business transfer subject to appropriate safeguards.
7. Retention and security
Information is retained for as long as reasonably needed to provide aimtoro, maintain records, resolve disputes, and meet legal or security obligations. We use server-side secrets, access controls, isolated customer records, and database security policies. No online service can guarantee absolute security.
A free-credit entitlement marker may be retained after account deletion so deleting and recreating an account does not reset a one-time promotion. It is used only for eligibility and fraud prevention, and privacy requests remain subject to applicable legal obligations and permitted fraud-prevention retention.
8. Your choices
You can ignore an onboarding verification message to leave the request unverified, and you can ask us to correct or remove an onboarding request. The optional onboarding marketing checkbox is separate from contact about the requested session. You can separately opt into or out of customer email and WhatsApp updates in Settings, and every tracked customer email includes an unsubscribe link. Removing consent prevents future customer reminders and updates through that channel. You can also edit or reject pitch drafts, mark prospects as do-not-contact, delete individual prospects, and sign out of your workspace. Customer accounts, including pending or blocked accounts, can be permanently deleted from Settings after confirming the account email. This removes the sign-in identity and the workspace profile with its claimed scans, searches, prospects, reports, contacts, drafts, follow-ups, inbox messages, reminders, and linked engagement records. Operational records that must be retained for security, legal, fraud-prevention, or incident-resolution purposes may be kept only for the period reasonably required. To ask about access, correction, export, or another privacy request, contact us using the address above. Requests are handled subject to applicable law and necessary security verification.
9. Changes
We may update this policy as aimtoro changes. The effective date at the top of this page identifies the current version.