Privacy Policy

1. Who we are

Geod is operated by FriendMachine Labs, LLC, a Michigan limited liability company. This policy describes how we collect, use, and protect personal data across our marketing site, the Geod product, the email agent, and related services. For data our customers upload to the product, we act as a processor on the customer’s instructions under our Data Processing Addendum; the customer decides what is uploaded and why.

2. Data we collect

• Contact information you give us: name, work email, company, role, and what you tell us in a form, an email, or a call.
• Account data: login email, organization membership, plan, and billing status. Payment card details go directly to our payment processor; we do not store them.
• Customer content uploaded to the product: locations, brands, addresses, store numbers, competitor lists, and, where a customer provides it, store-level sales. This is processed under the customer’s direction.
• Email sent to a Geod agent address, including attachments, when a customer uses the email agent.
• Usage data: page views, feature usage, device and browser data, and diagnostic logs. Logs redact secrets, email addresses, and sales figures.
• Support conversations, feedback, and survey responses.

3. How we use data

• Provide, secure, and support the product, including computing briefs, scenarios, and reconciliation reports for the customer that uploaded the data.
• Calibrate model parameters scoped to that customer’s organization. We do not use one customer’s sales data to calibrate models for another customer.
• Generate content with AI features: column mapping during import, narrative text in briefs, the in-product assistant, and email agent replies.
• Respond to walkthrough requests, validation-run inquiries, and support tickets, and keep a record of those relationships.
• Send product updates, onboarding material, and, if you opted in or asked, marketing email. You can opt out at any time.
• Maintain platform security, prevent abuse, and comply with legal obligations.

4. Sharing and subprocessors

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We share data only with providers that help us run the service, each under a contract limiting their use of it. As of the date above they are: Google Cloud Platform for hosting, databases, and file storage; Stripe for billing; Geocodio for address and coordinate lookup; Mapbox for maps, routing, and geocoding where configured; both location providers process location data; OpenAI and Anthropic for the AI features named above, under terms that do not permit training on customer content; Mailgun for sending and receiving email for the email agent and digests; Attio for our customer relationship records; Google Analytics for marketing-site analytics; Calendly for scheduling; and a form relay for the contact form. The current list, with roles and regions, is provided with the DPA and we notify customers of material changes.

5. Data retention

We keep customer content for the duration of the customer’s agreement and delete it within 60 days after termination, or sooner on written request, except for copies in routine backups that are overwritten on schedule and records the law requires us to keep. Frozen artifacts a customer exported remain the customer’s. Marketing inquiries are kept for up to 24 months. Account and billing records are kept as long as required for tax and accounting purposes.

6. Your rights

• Request access to, correction of, or deletion of your personal data.
• Restrict or object to certain processing, and withdraw consent where processing is based on consent.
• Export the data you have provided to us.
• File a complaint with your local supervisory authority if you believe your rights have been infringed.
• If you are a California resident, you have the rights described above under the CCPA, and we do not sell or share your personal information.

7. Cookies and analytics

The marketing site uses Google Analytics to understand which pages and links are used. The product uses cookies for authentication and session management, and records product usage events to improve the service; you can disable product telemetry from your browser by enabling Do Not Track. We do not use advertising cookies.

8. Security

We use safeguards including encryption in transit and at rest, access controls, least-privilege workflows, and audit logging. Store-level sales figures are never written to application logs and never appear in shared or public briefs. A current security controls summary is available on request.

9. International users

We process data in the United States and in other countries where our subprocessors operate. When transferring personal data from the EU, EEA, or UK, we rely on Standard Contractual Clauses under our Data Processing Addendum and apply additional safeguards.

10. Contact and updates

Privacy questions and rights requests go to legal@geod.app. We will update this policy as our practices change and will announce significant changes by email or in-product notice. The date above reflects the most recent revision.