Privacy policy

Your account record holds:

• Email address, first and last name, time zone, language preference, and a profile photo if you upload one.
• We also record which user made which change inside an organization: an audit trail the business itself can read.
• If you send us a report, a question or an idea from inside the app, we keep what you wrote, any pictures you added, the page you were on, your browser and screen size, your time zone, your role, the app version and the last error codes the app showed you, so we can answer you. It is kept until the organization you sent it from is deleted.

That is the whole account record, plus the dates it was created and last changed. We are responsible for this data, and you can have it deleted (section 9). We do not process payments, so Gonia holds no payment details of any kind.

The business chose what to collect and why. The platform stores what it is given, and here is everything it can hold about you:

• Contact details the business entered: name, email address, phone number, birthday, notes, and any custom fields it decided to add.
• What you typed into its booking or sign-up page: first name, last name, phone number, an optional email address, and an optional note.
• A consent record, if you agreed to receive marketing: the exact wording you were shown, the language it was in, the channel, the time and, as evidence, your browser’s user-agent string and a one-way hash of your IP address.
• Messages the business sent you through the platform: the address, subject, body, and whether it was delivered.
• Files it uploaded against your record.

The platform has no field for payment card details or government identifiers. Free-text notes and custom fields accept whatever the business types, so what ends up in them is its decision, not ours.

We do not store raw IP addresses. Where we need one (to limit how often an anonymous form can be submitted, and as consent evidence), it is hashed with a secret key held on the server, so it can show that two submissions came from the same visitor without revealing the address.

Cookies keep you signed in, remember your language, and remember whether the sidebar is collapsed. We do not use advertising cookies, and no Gonia page loads advertising or social tracking scripts. The one exception is one you choose: if you connect WhatsApp through Facebook, Org settings → WhatsApp loads Facebook's login script at that moment, for that sign-in only and not for advertising. What Facebook receives is covered by Facebook's own privacy policy.

A business can connect its own WhatsApp Business account to message people who agreed to hear from it.

• The connection uses that business’s own Meta credentials. Gonia does not message anyone on its own behalf, and one business’s credentials are never used for another.
• Messages a person sends to the business’s WhatsApp number are stored, so the business can read the conversation in Gonia: the text, when it was sent, and the sender’s number and WhatsApp profile name. A message from a number the business does not have yet adds that person as a contact. Photos, voice messages and files are not copied to Gonia.
• A business that keeps its number in the WhatsApp Business app on its phone can bring that app into Gonia. Meta then sends Gonia the business’s chats from the app (up to the last six months), the messages it sends from the phone, and the names it saved for its contacts there. The chats are stored like any other conversation and add their people as contacts; a saved name is kept only to name that person in Gonia. None of it counts as an opt-out or as consent. The business can choose on the phone not to share its chat history.
• A message that asks to stop is also recorded as an opt-out from that business’s marketing.
• Messages the business sends through Gonia are stored in the same conversation, with whether each one was delivered, read, or failed.
• Promotions a business sends on WhatsApp go through Meta’s service for marketing messages. Unless the business turns it off in its WhatsApp account, Meta may use whether each one was read, and whether its links were opened, to improve how it delivers marketing messages.
• Access tokens and app secrets a business gives us are encrypted (AES-256-GCM) before they are stored.

A business can connect its Google account so that Gonia sends its email through Gmail, from the business’s own address.

• For email, Gonia asks Google for one permission: to send email on the business’s behalf. It cannot read, search, change or delete anything in the mailbox, and it never sees the business’s Google password. The only thing it adds is a copy of each email in the account’s Sent folder, as if it had been sent from Gmail itself.
• Gonia keeps the address the business signed in with and the access Google grants, which is encrypted (AES-256-GCM) before it is stored. The emails sent this way are the same ones described in section 3.
• The access is kept only while the account stays connected. The business can disconnect in Settings → Email at any time: Gonia deletes the stored access immediately and, unless the same Google account still sends email for another business on Gonia or keeps a Gonia calendar, asks Google to withdraw it. The business can also remove Gonia from its Google account directly, and Gonia will then ask it to sign in with Google again before sending anything.

Someone who works at a business can also connect their own Google account, so that Gonia keeps their appointments in Google Calendar.

• For this, Gonia asks Google for one permission, separately from email: to manage the calendars Gonia itself makes. It makes one calendar, named after the business, and adds, changes and removes that person’s own appointments in it. It cannot see or change any other calendar or event in the account.
• Each appointment in that calendar shows its service, the client’s name, the time and the place. Never the client’s phone number or email.
• Gonia keeps the address the person signed in with, the access Google grants, encrypted the same way, and a note of which appointments it has added, so it can change or remove them later.
• The person can disconnect in Your account → My schedule at any time: Gonia deletes its calendar from their Google account, deletes the stored access and, unless the same Google account is still connected to Gonia for email or another calendar, asks Google to withdraw it. Someone who leaves the business, or a business that stops using appointments, is disconnected the same way. An appointment cancelled or deleted in Gonia leaves the calendar too.

How this Google data is protected: the access Google grants is encrypted (AES-256-GCM) before it is stored, with a key kept outside the database. It is never sent to a browser, and only Gonia’s server reads it, to send the business’s email or update the calendar. Everything passes between Gonia and Google over encrypted connections (HTTPS). Section 8 lists every safeguard the platform has.

This information is not sold, shared or passed to anyone else, and it is not used for advertising or for anything other than sending the business’s own email and keeping its people’s calendars. It lives only in the database and hosting named in section 7, and no person at Gonia reads it except to fix a problem the business asks us to look at.

Gonia’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We rely on these providers to run the platform:

• Supabase: database, sign-in, and file storage.
• Vercel: hosting, plus anonymous traffic and performance measurement on our public marketing site only, not inside the app and not on booking pages.
• Sentry: error diagnostics, which can include the IP address of the browser an error happened in and a replay of the session. Replays are recorded with all text masked and images blocked, so they do not capture what is typed into a form.
• Meta (WhatsApp Business Platform): only for businesses that connect WhatsApp.
• Google (Gmail): only for businesses that connect a Google account to send their email.
• Each business’s own email provider: outgoing mail goes through the mail server that business configures.

The database and file storage are hosted in São Paulo, Brazil (Supabase, sa-east-1), and the application runs in the same region (Vercel, gru1). The providers above may process data elsewhere.

These are the safeguards the platform uses for personal data, and above all for sensitive data: contact details, messages, files, and the access a business gives us to its Google, WhatsApp and email accounts.

• In transit: every Gonia page, form and connection is served only over HTTPS (TLS encryption), and browsers are told never to use an unencrypted connection to it. Gonia reaches its database, Google and Meta over encrypted connections too.
• At rest: the database and file storage are encrypted on disk by our hosting provider, Supabase. On top of that, Gonia encrypts the most sensitive values itself before storing them, with AES-256-GCM and a key kept outside the database: Google access, WhatsApp access tokens and app secrets, and mail-server passwords. Those values are never sent to a browser, and only Gonia’s server can read them, when it needs them to act for the business.
• Sign-in passwords: Gonia never stores yours. Sign-in is handled by Supabase Auth, which keeps only a one-way hash.
• Between businesses: reaching any business’s data requires signing in, and each organization’s data is separated in the database itself by row-level security, so one business’s account cannot read another’s.
• Inside a business: each person has a role (owner, admin, member or viewer), and the database enforces what each one may see and change. Only owners and admins can connect the business’s email and WhatsApp accounts or change who works in it. A business can hide its clients’ email addresses, phone numbers and chosen fields from staff, who then see only the clients assigned to them, and it can keep files on a record for owners and admins only.
• When a business hides client details from staff, its owners and admins are emailed if one of those staff opens 40 or more clients within an hour, at most once a day for each of them.
• Files on a record are stored privately, never at a public address. Each download goes through a link Gonia makes for someone allowed to see the file, and the link stops working after an hour.
• Everyone who signs in to Gonia can turn on two-step verification for their account.
• Gonia’s own staff: the administration console requires two-step verification, and support access to a business’s data is granted from it one business at a time and recorded. While it lasts, support can do what an admin of that business can.

• Your Gonia account: email support@goniacrm.com from that address. Requests are handled by a person rather than by a button in the app.
• Your details in a business’s CRM: ask that business. It controls the record and can delete it itself. You can write to us as well, and we will act on its instruction.

A record deleted in the app stops being visible immediately; the underlying row is kept until the account is removed.

A WhatsApp conversation is kept until the business deletes that contact completely, or its account is removed.

Consent records are the exception. They are deliberately permanent for as long as the business’s account exists, because they are the evidence of what someone agreed to, and they cannot be edited or deleted.

If this policy changes, we update the date shown at the top.

Questions? Email support@goniacrm.com. Our postal address is Berkshire Valley Group LLC, 7901 4th St N Ste 300, St. Petersburg, FL 33702, USA.