Privacy policy

1. Who we are and what this policy covers

Cold Systems provides B2B go-to-market services. Our website is coldsystems.io. Our client email workspace, powered by EmailBison, is intended to operate at send.coldsystems.io and supports connected business mailboxes, campaign sending, and reply management.

This policy covers information we handle for those activities. When we process information on behalf of a client, we act under the client's authorized instructions and applicable service arrangements. The client remains responsible for its own collection of prospect information, communication purposes, and notices to its contacts.

2. Information we handle

• Information you provide: your name, business email, company, website, inquiries, meeting details, account information, and communications with our team.
• Client and campaign information: business contact details, lists supplied or authorized by a client, campaign messages, replies, delivery events, preferences, and do-not-contact records.
• Connected mailbox information: the account identity, sender and recipient addresses, message headers, subjects, message bodies, conversation history, and related message content accessible through the permissions and features you authorize. Connection records can include OAuth access and refresh tokens.
• Technical information: information needed to deliver and protect the website and workspace, such as IP addresses, browser/device details, request timestamps, and service or error logs processed by the relevant hosting and software providers.

Mailbox synchronization may include incoming messages outside an individual campaign. The permissions shown by Google determine the access requested; creating an account or Cloud project does not itself connect a mailbox.

3. Why we use information

We use information to respond to inquiries, arrange meetings, deliver agreed services, administer client workspaces, connect authorized mailboxes, send configured messages, synchronize and manage replies, report campaign activity, honor opt-outs, provide support, and protect the service against errors, abuse, or unauthorized access.

We request Google access for the features being provided. If a new use requires additional permissions or a change to the disclosed purpose, we will provide an updated disclosure and obtain the required authorization before that use.

4. Google user data and Limited Use

We follow the Google API Services User Data Policy, including its Limited Use requirements, for information obtained through Google APIs and information derived from it.

• Google mailbox data is used only to provide or improve the authorized, visible email features of the service.
• We do not sell Google user data, disclose it to data brokers, or use or transfer it for advertising, retargeting, or credit and lending decisions.
• We do not use Google mailbox data to train general-purpose AI or machine-learning models. If an optional AI feature processes message data, that feature must be separately disclosed and authorized; this policy does not authorize undisclosed AI processing.
• Transfers are limited to providing the authorized service with the user's consent, necessary security purposes, legal obligations, or other transfers permitted by Google's policy. Any transfer involving Google user data during a business acquisition requires the prior consent required by that policy.
• Human access to Google message data requires the user's affirmative agreement for the relevant data, except for the security, legal, and other narrow exceptions permitted by Google's policy. A client engagement does not authorize unrestricted access to every message in a connected mailbox.

5. Service providers and sharing

We use EmailBison to operate the email workspace and Google to provide authorized Google mailbox connections. Client-authorized users can access information according to their workspace permissions. Authorized staff and contractors may handle information needed for the agreed service, subject to the restrictions above.

Our website is hosted on Vercel. Website pages can load resources from Google Fonts, and booking pages use Cal.com. These providers process information relevant to delivering their features. Provider cookies and similar storage can be used when their embedded features load; browser controls and the providers' privacy notices explain available choices.

Where you authorize a CRM, notification, or other integration, selected information may be transferred to that provider to perform the disclosed feature. Connecting a mailbox does not grant blanket permission to send its contents to unrelated applications.

We may disclose information where required by law or where necessary to investigate security incidents and protect legitimate rights, subject to the additional Google user data restrictions above.

EmailBison's own processing is described in its privacy policy. Additional provider information is available from Google, Vercel, and Cal.com.

6. Storage, security, and international processing

Information is stored in the systems used to deliver the website, workspace, and agreed client services. Processing may occur outside your country. EmailBison's published policy identifies the United States, Germany, Finland, and Sweden as processing locations for recipient data; the location of a specific instance is determined by the provider's configuration and arrangements.

We restrict access according to authorized responsibilities, use access controls available in the services we operate, and handle connection credentials confidentially. Security measures and hosting arrangements vary by provider. No method of transmission or storage is risk-free, and this policy does not claim that Cold Systems holds a security certification.

7. Retention and deletion

We keep information only for as long as it is needed for the authorized service, legitimate recordkeeping, security, or applicable legal obligations. Retention depends on the record, the client engagement, and the systems involved; this policy does not promise a single retention period for every record.

You can request deletion of stored mailbox and account information by emailing aldo@ruga.to. We will verify the request where necessary and coordinate removal from active systems we control and relevant service providers. We will explain material limitations or required retention. Backups and provider logs may remain until their retention cycles expire. Minimal suppression information may be retained to honor a request not to be contacted again.

Disconnecting a mailbox or revoking access stops future authorized access, but does not automatically erase information already stored. Request deletion separately if you want those records removed.

8. Your choices and requests

You can disconnect a mailbox in the workspace and revoke the application's access through your Google Account connections settings. Revocation may prevent the associated sending and reply features from working.

Depending on applicable law, you may have rights to access, correct, delete, obtain a copy of, or restrict or object to certain processing of your information. Contact us to make a request. Where the information is controlled by a client, we may direct the request to that client or assist it in responding. To stop outreach, use an available unsubscribe mechanism or reply requesting no further contact.

9. Children and policy changes

Our business services and client workspace are intended for professional use and are not directed to children. Contact us if you believe a child has provided personal information that should be removed.

We will update this page when our practices change and revise the effective date. If a change materially expands the use of connected Google data, we will provide the required notice and obtain any required renewed authorization before applying that change.