Security & Data Privacy Pledge
Agencies hold embargoed articles, unpublished strategy, and other people's reputations. If you are about to paste a client's work into a new tool, you should know exactly what happens to it.
Your Agency's Work Stays Your Agency's
Row rules in the database keep each account's rows to that account, and we test them with two people on a real database. How it works, and where the rules stop.
Writing Is Not Used to Train AI
Your clients' writing goes through Anthropic's commercial API, whose terms say it may not train on what we send. Recordings go to Deepgram, with its improvement program switched off on every request. The whole road, drawn.
What Staff Read
Staff don't read your clients' work as part of running GoMimic. That is how we work, not something the software stops: the server has to reach the data to do the job. People here read two things: a free-tool submission someone sends us, such as a Taste Test, to check it before it goes back, and anything you write to us, such as a support message.
Delete a Client and We Delete It
Delete a client and every voice rule, habit, and asset is deleted from GoMimic at once. Our database backups keep a copy for up to 7 days. Anthropic may keep what it received for up to 30 days, or longer if its safety systems flag it or the law requires it. What you put in stays yours, and nothing is sold to anyone.
Encrypted on the Way and at Rest
In transit with TLS 1.3, and 1.2 at the oldest. At rest with AES-256, which is our database host Supabase's own documented claim.
Switches You Hold
Per client: ask for an emailed code before a review shows anything. Mark a client Confidential, and nothing from them goes to Drive, Slack, or a webhook. Delete posts older than 6, 12, or 24 months every night. Stop every review link for a client at once.
A Record of Who Did What
The Owner sees sign-ins, two-step changes, exports and deletions, review links, and team changes as they happen. It never holds client writing. A login stays signed in on 2 devices at most, and two-step sign-in is there for anyone who wants it.
Security Record
- Signed in, new device
- Review link sent
- Client exported
What We Do Not Claim
We can't promise zero-knowledge encryption. To create a piece, our server has to pass the text and the client's rules on over a secure connection. Addresses you paste are fetched through a guard that refuses internal networks.
they have to, to do the job