Privacy policy

Coldvenue (“we”, “us”) is a cold email and outbound sales platform based in India.

For account data, we decide how and why personal data is processed (we are the data fiduciary, or controller). For customer content, such as the prospect lists you import and the emails sent through your mailboxes, we process data on your behalf and on your instructions (we are your data processor).

Questions about this policy or your data: privacy@coldvenue.in.

In line with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, you can contact the Coldvenue Grievance Officer by email at privacy@coldvenue.in. We acknowledge complaints within 7 days and resolve them within 30 days.

Account data: your name, email address and password (stored only as a salted hash), your organization and workspace, team members, and billing details. Card details are handled by our payment processor; we never see or store full card numbers.

Customer content: the prospect lists you import, the campaigns and templates you write, and the emails sent and received through mailboxes you connect. We process customer content on your behalf and on your instructions.

Connected mailboxes: for each mailbox you connect, its address and display name, and the access credentials needed to send and receive email for it (see “Google user data” for Gmail and Google Workspace accounts).

Usage and technical data: actions in the product (for example, campaigns launched or settings changed), sign-in records, device and browser information, IP addresses, and logs needed to operate and secure the service.

Website data: what you send us through forms on this website, such as demo requests.

When you sign in with Google or connect a Gmail or Google Workspace mailbox, Coldvenue asks Google for permission to access some of your Google account data. This section explains exactly what we access and why.

Sign in with Google: we receive your name, email address and profile picture (the “openid”, “email” and “profile” permissions) and use them only to create and sign in to your account.

Connecting a mailbox: we request permission to send email (“gmail.send”) and to read, label and manage email (“gmail.modify”). We use this access only for features you turn on for that mailbox: sending the campaign and follow-up emails you schedule; detecting replies, bounces and out-of-office messages so campaigns stop for people who answered; showing replies in the unified inbox so you can read and answer them in one place; and, if you enable warmup, sending and replying to warmup emails and moving them out of spam.

To find replies, we check the headers of new messages (sender, recipients, subject and reply references). We download and store the full content only of messages that belong to conversations sent through Coldvenue, come from a lead in one of your campaigns, or are delivery reports (bounces). Other messages in your mailbox are not stored. We do not use your Gmail data for advertising, we do not sell it, and we do not use it to determine credit-worthiness or for lending.

AI and machine learning: we do not use Google user data to develop, improve or train generalized or non-personalized AI or machine-learning models. If your workspace turns on AI features, the text of a reply may be sent to the AI provider your administrator chose, only to produce the result you asked for (for example, classifying a reply or drafting an answer). AI providers process it under terms that do not allow them to train their models on it.

People: our staff do not read your email. The exceptions are when you ask us to (for example, in a support request and with your permission), when it is necessary for security purposes such as investigating abuse, or when the law requires it.

Sharing: we share Google user data only with the service providers we need to run these features (listed under “Sharing and service providers”), who may use it only to provide their service to us; as required by law; or as part of a merger or acquisition, with notice to you.

Storage and security: Google access and refresh tokens are encrypted at rest and never shown to anyone, including you. Data travels encrypted (TLS) between Google, our servers and your browser.

Retention: when you disconnect a mailbox, we revoke our access with Google and delete its tokens immediately. Emails already synced from it stay in your workspace (for example, in the unified inbox) until you delete them or your workspace is deleted; on a deletion request we erase them within 30 days. You can also remove Coldvenue’s access at any time from your Google account permissions.

Coldvenue’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. See the Google API Services User Data Policy, its Limited Use requirements and the Google Workspace API User Data and Developer Policy.

To provide the service you signed up for: running campaigns, syncing replies, warmup, analytics, and the features you enable; to keep it secure and prevent abuse; to provide support; to process payments; and to tell you about changes to the service.

We use usage and technical data to fix problems and improve the product. We do not sell personal data, and we do not use customer content or Google user data for advertising.

We use these service providers (sub-processors) to run the service. Each may process data only to provide its service to us:

Hosting and infrastructure: [hosting provider and region]. Database: MongoDB Atlas. System email (sign-in and notification emails): [system email provider]. Payments: Stripe. Error monitoring: Sentry.

Only when a workspace turns the feature on: AI features use Anthropic, OpenAI or Google (Gemini), as chosen by your administrator; lead enrichment uses Apollo, People Data Labs or Hunter, which receive the prospect details needed to look up a match (never your Gmail data).

We may also disclose data when required by law, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy continues to apply.

We are based in India. Some of our service providers store or process data in other countries, including the United States. When data leaves India or your country, we use providers that protect it with contractual and security safeguards, and we only transfer it to countries the law allows.

Mailbox credentials and access tokens are encrypted at rest. Data is encrypted in transit. Workspaces are isolated from one another, access is role-based, API keys are stored only as hashes, passwords only as salted hashes, and sensitive actions are recorded in an audit log.

We keep account data and customer content for as long as your account is active. AI results are kept for up to 180 days. Security and audit logs are kept as long as needed to protect the service and meet legal obligations.

You can delete leads and lists, delete or archive campaigns, and disconnect mailboxes at any time in the app; to delete specific synced conversations, email us. To delete your organization and all of its data, email privacy@coldvenue.in from an account owner’s address; we confirm the request and erase the data within 30 days. Step-by-step instructions: Manage and delete your data.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict its processing. Email privacy@coldvenue.in; we answer within 30 days. If you are a prospect contacted by one of our customers, contact that customer; we will help them handle your request.

In India, under the Digital Personal Data Protection Act, 2023, you can ask for a summary of the personal data we hold about you and how we use it, have it corrected, completed, updated or erased, withdraw consent where we rely on it, and nominate another person to exercise these rights if you die or become unable to. If we do not resolve your complaint, you can take it to the Data Protection Board of India.

In the European Economic Area and the United Kingdom, you can also complain to your local data protection authority.

Coldvenue is a business service and is not meant for anyone under 16. We do not knowingly collect their data.

We will post any change here and update the date above. If a change affects how we use Google user data or other personal data in a material way, we will tell you in the app or by email first and, where required, ask for your consent before the new use.