Privacy Policy

This Privacy Policy explains how Paulo Gonzalez ("Comet," "we," "us," or "our") handles personal information through getcometapi.com, app.getcometapi.com, and the Comet services and Companion software that link to this policy.

1. Who is responsible for your information

Comet is a workspace for teams using connected AI models, agents, knowledge, and communication tools. We handle account, website, billing, and service administration information to operate Comet. When a customer uses Comet to process work content on its behalf, that customer determines the purposes of that processing, subject to its agreement with us and applicable law.

Your Team's policies and permissions can affect how work content is used and retained. A Team name is a display label; it does not establish a verified business identity or give access to another Team's information. A personal email address can be used for a Team account; it does not create a separate personal workspace.

Questions and requests: paulo@getcometapi.com. Our mailing address is 390 NE 191st St STE 56713, Miami, FL 33179. If a request concerns information controlled by your organization, we may direct it to the appropriate Team administrator or assist the organization in responding.

2. Information we handle

• Account and Team information: your name, email address, profile image if provided, account identifiers, memberships, roles, invitations, and preferences.
• Work content: prompts, agent conversations, outputs, documents, files, knowledge items, instructions, skills, and related metadata that you or an authorized integration submit to Comet. Processing depends on the features and access you enable.
• Connection information: provider and connected-account identifiers, granted permissions, access and refresh tokens, connection status, and the tool or plugin inventory exposed by a connected agent. Companion can process authorized host, project, or tool information needed for the connection and tasks you direct.
• Communication information: sender and recipient addresses, content you prepare or send, delivery identifiers, Secure Mail access records, and email activity information described below.
• Service information: requests, timestamps, device and browser details, IP addresses, errors, security events, and usage records generated when the service operates.
• Commercial and support information: plan, billing contact and transaction records, and information you send to support. If a payment service is used, it processes payment details under its own applicable terms and privacy notice.

Connecting one service does not automatically authorize every other integration. We also receive information when another authorized person invites you, shares content with you, or sends you a message.

3. Google sign-in and optional Gmail access

Sign in with Google. We use Google account identity information, such as your account identifier, email address and verification status, name, and profile image when provided, to authenticate you and maintain your Comet account. Google sign-in alone does not authorize access to the contents of your Gmail inbox.

Connect Gmail. If you enable Comet's direct Gmail sending connection, we request permission to send email on your behalf. We process the sender identity, recipients, content you direct us to send, and the sending response needed to provide that feature. This sending connection does not request permission to read your inbox. A refresh token can allow the authorized connection to work without asking you to sign in for each send.

Google Contacts. If you separately enable recipient suggestions, we request read-only access to saved Google Contacts on the same connected account. We search contact names and email addresses when you use recipient suggestions and display matches for you to choose. This feature does not modify contacts, read inbox messages, copy your address book into Team Knowledge, or send contact search results to an AI model. We do not retain a separate contact address book; addresses you choose become part of the email draft and its normal delivery records.

Gmail inbox access (optional). If you separately grant inbox access, we request Google's read-only Gmail permission on the same connected account. Commander's API models then use read-only tools to search your threads, list recent inbox messages, and read the messages you ask about, only while answering your request and only on AI models your administrator has covered for sensitive data. We do not send, modify, label, or delete mail with this permission, we do not store copies of your messages beyond the conversation response you receive, and we do not add them to Team Knowledge or use them to train models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. You can remove this access by disconnecting Gmail in Comet or in your Google Account.

Agent-hosted tools are separate. A Gmail plugin or other integration enabled inside a third-party agent has its own permissions and data path. If you direct that agent to bring a message, file, or result into Comet, Comet processes what the agent supplies. Our direct Gmail connection's send permission and optional read-only Contacts permission are not a statement that connected agents can never supply email content.

Before enabling access or a new use, we explain the relevant data and purpose in the product and obtain the required authorization. You can decline an optional connection; features that depend on that permission will be unavailable.

4. How we use information

We use information to authenticate users; maintain Team membership and permissions; route authorized requests to models, agents, and tools; store and retrieve permitted Knowledge; send communications you direct; operate billing and support; diagnose service failures; prevent abuse; and meet legal obligations.

When you use an AI feature, the content required for that request can be processed by the model, agent host, or integration selected for the task. This can include prompts, relevant Knowledge excerpts, files, and tool results. Sharing is limited to the authorized feature and permissions; enabling Knowledge does not make every source available to every Team member or agent.

We use operational information to understand reliability and improve the service. Customer content is not an unrestricted source for training AI models or building a shared customer knowledge pool. The additional Google data limits in the next section take precedence over general descriptions of service improvement.

5. Google data and Limited Use

Comet follows the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring Google API data.

We use Google user data only for the disclosed, authorized features. We do not sell it, use it for advertising or credit decisions, or transfer it to data brokers. We do not use Google Workspace APIs or their data to develop, improve, or train generalized or other non-personalized AI or machine-learning models. We do not add Google-sourced content to a cross-customer knowledge or skills pool. These limits also apply to information aggregated, anonymized, or derived from that data.

Transfers are limited to permitted feature delivery with the user's consent, security purposes, legal requirements, or a business transfer with the explicit prior consent Google requires. Access by our personnel or service providers is restricted to the narrow situations Google permits, such as documented permission to inspect specific data, necessary security work, legal obligations, or use of aggregated and anonymized data for internal operations consistent with applicable law. General acceptance of these terms does not give staff blanket permission to read your messages.

Any AI provider receiving Google data for a permitted feature must be able to honor these restrictions. Routing through an agent, intermediary, or another provider does not remove them.

6. Teams, sharing, and service providers

People and agents you authorize. We make content available to the recipients, Team members, connected accounts, and agents permitted to access it. Team administrators can manage membership, roles, and features within their permissions. An Owner or Admin role does not, by itself, grant access to every member's private Secure Mail or all connected-account content.

Service providers. Hosting, storage, security, support, and other providers process information needed to operate Comet under appropriate contractual restrictions. Selected model providers and agent hosts may also process the data required for tasks you authorize. The provider you connect may have its own relationship with you and its own terms. Contact us for information about the providers used for your service.

Legal and business circumstances. We may disclose information when required by law, to protect rights and security, or in a business transaction, subject to applicable restrictions and notices. The stricter limits for Google data above continue to apply.

We do not sell personal information or share it for targeted advertising.

7. Email, Secure Mail, and activity tracking

Standard email sends the message through the selected email service. Recipients and their email providers can retain and forward delivered copies.

Secure Mail stores the private message in Comet and sends a generic notification with a link. Access is controlled in Comet. The notification still exposes routing addresses, timing, and a generic link to mail providers. Comet decrypts stored content for authorized access; this service is not end-to-end encryption.

An expiration or revocation stops future access through Comet according to the applicable access rules. It cannot erase content that a recipient has already downloaded, copied, captured, or received by standard email. The same limit applies to files when file sharing is available. Access expiration is different from deletion from storage or backups.

Email activity. Where a sender enables email open tracking, a small remote image can record a request time and a message or recipient identifier when the email client loads it. The request also exposes technical network information to the receiving service. Depending on the email delivery method, an event may relate to a recipient-specific copy or only to the message. Image proxies, privacy features, automatic fetching, and forwarding can produce or suppress events. A pixel request does not establish who personally read an email or prove that a human read it.

Authenticated Secure Mail access events are separate from email pixel events. Senders may receive the activity information available for their messages. An email recipient can limit remote-image loading in their mail client; this does not prevent Comet from recording authenticated access to Secure Mail.

8. Security

We use technical and organizational measures designed to protect information, including encrypted transport, encryption for stored sensitive information and connection credentials, access controls, and controls for service operation. No system guarantees absolute security. Protect your account and connected services, and report suspected unauthorized access to paulo@getcometapi.com.

Use of Comet does not, by itself, establish HIPAA compliance, a business associate agreement, SOC 2 attestation, or another certification. Any special contractual safeguards must be expressly agreed and apply only to the covered services and configuration.

9. Retention, disconnection, and deletion

We retain information for the purposes described here, based on the account relationship, feature settings, customer instructions, security needs, contractual requirements, and applicable law.

• Account and membership information is retained while needed to provide and administer the service, with limited records retained for legal, security, or dispute purposes afterward.
• Work content and stored messages follow the applicable customer instructions, deletion requests, and retention settings. A message's access expiry does not necessarily delete the stored record.
• Connection tokens are retained only while needed for the authorized connection. When Google authorization is withdrawn or no longer needed, we stop using it, revoke the relevant Google tokens, and permanently delete our stored copies. If multiple features share a Google authorization, withdrawing it can affect those features too.
• Operational, security, and financial records are kept for the relevant troubleshooting, abuse prevention, accounting, or legal purpose, rather than to retain work content indefinitely.
• Deleted information may remain in restricted backups until those backups are replaced through the backup cycle. It is not used for ordinary service processing, and deletion requirements are reapplied if backups are restored. Information subject to a lawful retention requirement is restricted to that purpose.

You can disconnect an available integration in Comet or remove Google's authorization through your Google Account connections. Removing Google access stops future authorized API access; it does not itself delete your Comet account, previously stored content, or copies already sent to recipients or other authorized services.

To request deletion or an export, contact paulo@getcometapi.com from the address associated with your account and identify the account, Team, connection, or content involved. We may verify your identity and authority, coordinate with your organization, and explain any applicable retention exception. You may ask for the retention arrangements applicable to your account. Requests do not require you to disclose passwords or connection tokens.

10. Cookies, processing locations, and your rights

Comet uses cookies or similar storage necessary for sign-in, session security, and preferences. Other measurement or tracking technologies, where used, are subject to the applicable notices and choices. Email pixel tracking is described separately above.

Information can be processed where we and our authorized providers operate. Where a cross-border transfer requires additional safeguards, we use the applicable lawful mechanism and make information about it available on request. Contact us for the processing locations and transfer arrangements relevant to your service.

Depending on your location and our role, you may have rights to access, correct, delete, or receive a copy of your information; object to or restrict processing; or withdraw consent. You may also have a right to complain to a data protection authority. Where a legal basis is required, we rely on the applicable basis, such as providing the contracted service, necessary legitimate operational or security interests, legal obligations, or consent. Withdrawing consent does not affect processing lawfully completed before withdrawal.

Contact paulo@getcometapi.com to exercise applicable rights. We assess requests under the law that applies and do not require you to waive your rights to use the request process.

11. Children and changes

Comet is a business service intended for users aged 18 or older, not a service directed to children. Do not create an account if you do not meet that requirement. If you believe a child has provided personal information directly to us, contact us so we can investigate and respond.

We update this policy when our practices change. We publish the updated version and effective date here and provide additional notice or seek consent where required. A policy update is not permission to start a materially different use of Google data without the required disclosure and authorization.

12. Contact

Comet is operated by Paulo Gonzalez (individual operator).

Privacy and data requests: paulo@getcometapi.com

Mailing address: 390 NE 191st St STE 56713, Miami, FL 33179

For the rules governing use of the service, see our Terms of Service.