Data Processing Agreement
Your clients' work holds other people's names, words, and decisions. This says who decides what happens to them, and what we promise while we hold them. It is part of the Terms of Service, so there is nothing to sign. Last updated 3 November 2026.
You decide
What goes in, and why.
We carry it out
Only as you ask, and only to run GoMimic.
Who Is Who
This agreement is between the business holding the GoMimic account (you) and Akhil Gautam, trading as GoMimic, a sole proprietor (we).
For personal data in your clients' work, you are the controller and we are your processor. Where you are acting for your client, your client is the controller, you are its processor, and we are your sub-processor. For your own account and billing details, we are the controller, and the Privacy Policy applies instead.
- Legal Name
- Akhil Gautam, trading as GoMimic
- Grievance Officer
- Akhil Gautam, Founder, support@gomimic.ai
We reply to a complaint within 48 hours and resolve it within one month.
To reach us about anything formal, write to support@gomimic.ai.
What We Handle
- What we do with it: store it, read it to create and check drafts and learn a voice, turn recordings into text, send review links and emails, and deliver work to the tools you connect.
- Whose data: your team, your clients and their staff, people reviewing through a link, people named in the writing you bring in, and people speaking on a recording.
- What data: names, email addresses, job titles, decisions, and notes, and anything personal in the writing or recordings you add. You choose what goes in. Please don't add special categories of data, such as health details, unless the work truly needs it.
- How long: for as long as your account lasts, then as the last section here says.
The Details
- To run GoMimic for you
- Your team, clients, reviewers
- While your account lasts
Your Instructions
We handle this data only on your documented instructions, which are these terms and what you do in GoMimic, unless a law we are under requires otherwise. If it does, we tell you first, unless that law forbids it. If we think an instruction breaks data protection law, we tell you.
You are responsible for having a lawful basis for what you add, and for telling your clients, reviewers, and anyone on a recording that you use GoMimic and the services listed here.
only what you ask
Keeping It Confidential and Safe
Anyone working for us who can reach this data is bound to keep it confidential. These measures are in place today:
- Row rules keep each account's rows to that account, and server routes check the account themselves where those rules do not reach.
- Encryption in transit with TLS 1.3, and 1.2 at the oldest. Encryption at rest with AES-256, which is our database host's own documented claim. Keys for connected tools are sealed with AES-256-GCM.
- Two-step sign-in, and a limit on how many devices a login stays signed in on.
- A security record the Owner can read: sign-ins, exports, deletions, review links, and team changes.
- A guard that refuses internal networks when we fetch an address you give us.
More on the security page.
Who Else Handles It
You allow us to use these sub-processors:
- SupabaseDatabase, sign-in, and file storage. Holds everything in your account.Based in: United States
- HostingerRuns the GoMimic servers, so your data passes through them.Based in: Lithuania
- AnthropicReads what you bring in, to create and check drafts and to learn a voice.Based in: United States
- DeepgramTurns recordings into text, when you bring one in.Based in: United States
- ResendSends every email, including review links and the names in them.Based in: United States
- SentryError reports: technical details and account IDs.Based in: United States
Your data is stored in the United States. We email the account Owner at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can't work around it, you can cancel and we stop. We hold each sub-processor to data protection terms like these, and we stay responsible to you for its work.
Tools you connect yourself are your instruction, not our sub-processors:
- GoogleYour sign-in, if you use Google. Figures from Search Console, if you connect it.
- SlackThe messages you set up, through a link you paste.
- Zapier and webhooksThe approved work you send them.
- LoomThe address you give us, to read the recording at it.
- DropboxThe share link you give us, to read the file at it.
- Podcast hostsThe feed address you give us, to read an episode from it.
- Your client's blogThe blog address you save, to read older posts from it.
- Your browser's notification serviceThe text of a desktop notification, if you turn them on.
- Google DriveThe files you pick to bring in, and the work you save there.
A tool marked Coming Soon gets nothing until it is switched on and you connect it, and we add it here when it is.
Helping You
- Requests from people: if someone asks us about their data in your work, we pass it to you. You can find, correct, export, and delete it yourself in GoMimic, and we help where you can't.
- Breaches: if we learn of a breach of this data, we tell you without undue delay, with what we know and what we are doing about it.
- Your own duties: we give reasonable help with security, breach notices, impact assessments, and talking to a regulator.
- Showing we comply: we give you the information you reasonably need to show this agreement is being kept, and allow for and contribute to audits, including by your auditor, on reasonable notice and with confidentiality agreed.
If something goes wrong
We tell you without undue delay.
Moving Data Out of the EU and UK
GoMimic is run from India. Where the law treats your data reaching us as a restricted transfer, these are part of this agreement, by reference, with you as exporter and us as importer:
- EU: the standard contractual clauses in Commission Implementing Decision (EU) 2021/914. Module 2 where you are a controller, Module 3 where you are a processor for your client.
- UK: the UK Addendum to those clauses, issued by the Information Commissioner.
What the clauses leave for us to fill in:
- Clause 7: does not apply.
- Clause 9: general authorisation, with the 30 days' notice above.
- Clause 11: the optional wording does not apply.
- Clause 13: your supervisory authority.
- Annex I: the parties and details in the first two sections here.
- Annex II: the measures under Keeping It Confidential and Safe.
- Annex III: the sub-processors listed here.
For clauses 17 and 18, the law and courts of Ireland apply. If these clauses conflict with this agreement or the Terms, the clauses win.
built in, nothing to sign
When It Ends
Before you leave, the Owner can take a copy from Settings. Deleting a client or the account deletes this data from GoMimic straight away. Our database backups keep a copy for up to 7 days, and Anthropic may keep what it received for up to 30 days, or longer if its safety systems flag it or the law requires it. If a trial ends and you never paid, the account is deleted after 60 days.
Each party's liability under this agreement is as the Terms of Service set out, and those limits do not reduce what people can claim under the clauses above.
take a copy first