Privacy Policy

Last updated: October 11, 2026

Stealth IQ ("we", "our", or "us"), operated by Eduardo Faroni doing business as Guarana Lab, provides a lead intelligence platform that integrates with third-party services to help businesses identify and prioritize sales leads. This Privacy Policy explains how we collect, use, store, and protect your information.

Information We Collect

When you use Stealth IQ, we may collect the following information:

Information You Provide Directly: Your name and email at sign-up, organization details, support correspondence, and settings you create such as follow-up sequences and message-style preferences.
Account & Authentication Data: Account, sign-in, and organization data managed on our behalf by our authentication provider, Clerk, including which integrations you have connected.
Google Account Information: When you sign in with Google, we receive your name, email address, and profile picture from your Google account.
Google Gmail Data: With your explicit consent, we access Gmail data including email subject lines, email body content, and email metadata (sender, recipient, timestamps). This data is used for the features described in "How Google Data Is Used" below: lead enrichment and scoring, generating and personalizing follow-up messages, and detecting replies from your leads. When you enable email sending, we also use the Gmail API to send follow-up emails that you compose, approve, or schedule— from your email address, on your behalf. We never send email without an action you initiated.
Microsoft Outlook Data: With your explicit consent, we access Outlook email messages and metadata (sender, recipient, timestamps)—and, when enabled, send approved follow-up emails on your behalf—for the same purposes described above.
GoHighLevel CRM Data: Contacts, opportunities, conversations, pipeline data, the content of messages—including SMS and email—exchanged through your connected GoHighLevel account, and the notes kept on your contacts in GoHighLevel. The content of messages and notes, with the name of the GoHighLevel user who wrote each note, is processed by the AI providers listed below for lead scoring and follow-up drafting. When GoHighLevel holds the recording of a call but no transcript of it, we download the recording and have those AI providers transcribe it; we store the transcript and the call notes written from it, never the audio.
HubSpot Data: If you connect HubSpot, our access is read-only: we never create, change or delete anything in your HubSpot account. We store your HubSpot contacts (name, email addresses, phone numbers, company, job title, lifecycle stage, lead status and owner); companies (name and domain); deals (name, pipeline and stage, amount, close date, and whether the deal was won or lost); the activity logged in HubSpot on those contacts—emails (subject, plain-text body, sender and recipients), calls (direction, status, duration and notes), meetings (title, time, outcome and notes), notes, and SMS, WhatsApp and LinkedIn messages logged in HubSpot; and your HubSpot users (name and email), which we use to recognize your own team so they are never treated as leads and to name who wrote a note. The content of that logged activity—emails, calls, meetings, messages and notes, including the notes on a call or meeting—is processed by the AI providers listed below for lead scoring and follow-up drafting, with the name of the HubSpot user who wrote each note. We also keep the ID and domain of the connected HubSpot account and the email address of the HubSpot user who connected it.
Salesforce Data: If you connect Salesforce, our access is read-only: we never create, change or delete anything in your Salesforce org. We store your Salesforce leads and contacts (name, email address, phone numbers, company, title, website, country, lead source, lead status, rating, owner, and whether they opted out of email); accounts (name and website domain); opportunities (name, stage, amount and currency, probability, close date, whether the opportunity was won or lost, owner, and the contacts on it with their roles); the activity logged in Salesforce on those leads and contacts—emails (subject, plain-text body, sender and recipients), calls (subject, direction, status, result, duration and notes), meetings (title, time, duration, location and description) and notes (title and body); and your Salesforce users (name and email), which we use to recognize your own team so they are never treated as leads and to name who wrote a note or handled a lead. The content of that logged activity—emails, calls and notes, including a call's subject and notes, and each meeting's title and time—is processed by the AI providers listed below for lead scoring and follow-up drafting, with the names of the Salesforce users who wrote each note or handled each email, call or meeting; a meeting's description is shown to you in Stealth IQ, and neither it nor the meeting's location is ever sent to an AI provider. We also keep the ID, name, edition, address and default currency of the connected Salesforce org, whether it is a sandbox, and the email address of the Salesforce user who connected it; if you connect through your own Salesforce app, we also keep its My Domain and Consumer Key, and its Consumer Secret encrypted.
Pipedrive Data: If you connect Pipedrive, our access is read-only: we never create, change or delete anything in your Pipedrive account. We store your Pipedrive people (name, email addresses, phone numbers, organization, job title and owner); organizations (name and website domain); deals (title, pipeline and stage, value and currency, probability, expected close date, whether the deal was won or lost, owner, and the people on it); the activity logged in Pipedrive on those people—emails (subject, plain-text body, sender and recipients), calls and meetings (subject, time, duration, outcome and notes) and notes; and your Pipedrive users (name and email), which we use to recognize your own team so they are never treated as leads and to name who wrote a note or handled a lead. The content of that logged activity—emails, calls, meetings and notes, including the notes on a call or meeting—is processed by the AI providers listed below for lead scoring and follow-up drafting, with the names of the Pipedrive users who wrote each note or handled each email, call or meeting. We also keep the ID and domain of the connected Pipedrive company and the email address of the Pipedrive user who connected it; if you connect with a Pipedrive API token, we keep the token encrypted.
Zoho CRM Data: If you connect Zoho CRM, our access is read-only: we never create, change or delete any record in your Zoho CRM organization. We store your Zoho CRM leads and contacts (name, email addresses, phone numbers, company or account, job title, lead status and rating, email opt-out and owner); accounts (name, website domain and main phone number); deals (name, stage, amount and currency, probability, closing date, whether the deal was won or lost, its loss reason, owner, and its contact); the activity logged in Zoho CRM on those people—emails (subject, plain-text body, sender and recipients), calls (subject, time, duration, direction, result and notes), meetings (title, time and participants) and notes; and your Zoho CRM users (name and email), which we use to recognize your own team so they are never treated as leads and to name who wrote a note or handled a lead. The content of that logged activity—emails, calls and notes, including the notes on a call—is processed by the AI providers listed below for lead scoring and follow-up drafting, with the names of the Zoho CRM users who wrote each note or handled each email, call or meeting. We also keep the ID, name, edition and data center of the connected Zoho CRM organization and the email address of the Zoho user who connected it; if you connect with your own Self Client, we keep its client secret encrypted.
Fireflies Data: If you connect Fireflies, we access your meeting transcripts, summaries, and participant information to enrich lead scoring.
Fathom Data: Each member of your organization may connect their own Fathom account. For each connected account we access the meeting recordings that account can see—its own meetings and those shared with it or its teams in Fathom—and we store the title, the participants, how the meeting is shared in Fathom, the AI summary, the action items and the highlights. A meeting with no one outside your organization on it is stored but never linked to a contact or used for a follow-up. We never store the full transcript: it is read in memory only while a meeting is being imported, to work out who spoke, and is never written to our database. Meetings no connected account can see never reach us. The member who connected an account decides whether the content of its meetings—the summaries, and the follow-ups drafted from them—is visible to everyone in your organization or only to them, and can change that at any time; which contacts were met, when and how often, and the lead scores worked out from those meetings, are visible to your whole organization either way. When an account is connected we also count its meetings by how they are shared in Fathom and keep a few participant email addresses as examples, shown only to the people who manage that connection, to help them choose. A recording whose only external participant joined by link is known to us by the name the recorder captured, with no email address; we store it under that name and match it automatically to one of your contacts when one exists, under the same retention as every other recording.
Read AI Data: Each member of your organization may connect their own Read AI account by signing in to Read AI; we never see their Read AI password, and we keep the access tokens Read AI issues encrypted and revoke them when the account is disconnected. For each connected account we access the meeting reports that account can see in Read AI—its own and those shared with it—and we store the title, the time, the participants and whether each of them joined, the summary, the action items, the key questions, the chapter summaries and topics, and the other report details Read AI returns, such as its meeting metrics. We never store the transcript: it is read in memory only while a meeting is being imported, to work out who spoke, and is never written to our database. If your organization sets up a Read AI webhook, its notifications only tell us that a meeting ended; we never store them, and we fetch the meeting through a connected account instead. As with Fathom, the member who connected an account decides whether the content of its meetings is visible to everyone in your organization or only to them, and which contacts were met, when and how often, and the lead scores worked out from those meetings, are visible to your whole organization either way.
Usage Data: Basic usage information such as pages visited and features used within Stealth IQ.

How We Use Your Information

To authenticate your identity and provide access to the platform
To fetch and analyze CRM, email, and transcript data for lead scoring and categorization
To enrich conversation data with email content for more accurate lead intelligence
To generate AI-powered insights, follow-up messages, and action plans for your leads
To process payments and manage your subscription
To improve and maintain the functionality of our service

What We Store vs. Process Temporarily

We store the records needed to run the platform: contacts, opportunities and deals, conversation and message records (the 25 most recent messages per conversation), meeting transcripts, synced email metadata and short snippets, AI lead scores and reasoning, your follow-up sequences and message-style settings, and your integration credentials (encrypted).

We process temporarily and do not retain the prompts and responses exchanged with AI providers during scoring (these are not logged), the raw responses from third-party APIs before they are transformed into the records above (except HubSpot's change notifications, which are kept briefly—see Data Retention), and intermediate data created while handling your request.

Data Retention

CRM contacts, pipelines, users, and tags are refreshed on roughly a 7-day cycle—older copies are purged and re-fetched from the source.
Conversations and messages are retained for about 30 days from their last sync; we keep the 25 most recent messages per conversation.
Fireflies transcripts are refreshed on roughly a 30-day cycle.
HubSpot records are kept in step with your HubSpot account—a record deleted or merged in HubSpot is removed or merged here too—and are retained until you disconnect HubSpot from within Stealth IQ (which deletes them and revokes our access) or delete your account. The change notifications HubSpot sends us, which can include a changed field's value, are kept only to process them and are deleted about 7 days afterwards—or about 7 days after they arrive, for a HubSpot account not connected to Stealth IQ.
Salesforce records are kept in step with your Salesforce org—a record deleted, merged or converted in Salesforce is removed or merged here too—and are retained until you disconnect Salesforce from within Stealth IQ (which deletes them and revokes our access) or delete your account.
Pipedrive records are kept in step with your Pipedrive account—a record deleted or merged in Pipedrive is removed or merged here too—and are retained until you disconnect Pipedrive from within Stealth IQ (which deletes them and revokes our access) or delete your account. Of the change notifications Pipedrive sends us we keep only which records changed, and only to process them; that record is deleted shortly afterwards.
Zoho CRM records are kept in step with your Zoho CRM organization—a record deleted in Zoho CRM is removed here too, and a converted lead is merged into its contact—and are retained until you disconnect Zoho CRM from within Stealth IQ (which deletes them and revokes our access) or delete your account. Of the change notifications Zoho CRM sends us we keep only which records changed, and only to process them; that record is deleted shortly afterwards.
Fathom meetings are retained until the Fathom account that imports them is disconnected (by the member who connected it or an organization admin) or you delete your account; disconnecting an account removes its meetings, except those another member's connected account also imports.
Read AI meetings are retained the same way: until the Read AI account that imports them is disconnected (by the member who connected it or an organization admin) or you delete your account; disconnecting an account removes its meetings, except those another member's connected account also imports.
AI lead scores are kept until they are recomputed—when the underlying conversation changes, or once a score is about 60 days old—or until you delete your account. Cached AI-drafted follow-ups are kept for up to about 30 days, and are recomputed sooner when the underlying conversation changes.
Synced Gmail and Outlook email records are retained until you disconnect that provider from within Stealth IQ (which deletes them—see below) or delete your account.
Files you attach to follow-up messages are retained until you request their deletion.
Encrypted integration credentials are retained until you disconnect the integration or delete your account.

When you delete your account (see Data & Security), the data associated with your organization—imported contacts, CRM data, meeting transcripts, synced emails, AI scores, and follow-up sequences—is permanently deleted from our systems within 24 hours. We retain minimal records of messages sent through Stealth IQ (recipient, subject, a snapshot of the message, and timestamp) and non-content usage metrics, for audit and billing integrity. If your organization used a free trial, we also keep a one-way, keyed fingerprint of the company email domains, connected platform accounts, and payment card it was taken with—with no link back to your organization, and solely so that a free trial is not taken twice; these fingerprints cannot be turned back into the original values.

Google API Services User Data Policy

Stealth IQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What Google Data We Access

We access Gmail data (email subject lines, body content, and metadata such as sender, recipient, and timestamps) for emails between you and your leads. When you enable email sending, we also use the Gmail API to send email from your address on your behalf—only messages you compose, approve, or schedule.

How Google Data Is Used

Google user data is used only to provide user-facing features of Stealth IQ: lead enrichment and conversation scoring; generating and personalizing follow-up messages (including learning your writing style from your own sent mail); detecting replies from your leads so automated sequences stop, with the reply shown in your sequence history; and sending follow-up emails you approve, when you enable sending.
To provide these features, limited Gmail content (subject lines and short message snippets) is processed at inference time by the AI providers listed below, under agreements that prohibit them from training on your data.
Google user data is not used for advertising, and is not shared with or sold to third parties for advertising purposes.
Google user data is never used to train or improve any AI or machine-learning models—ours or our providers'.

Revoking Access & Data Deletion

Disconnecting Google from within Stealth IQ (Dashboard → Setup → Email Connection) revokes our access with Google directly and permanently deletes the emails we synced from your account. Disconnecting Microsoft deletes your synced Outlook emails the same way. You can also revoke Stealth IQ's access at any time from your Google Account Permissions page. To request deletion of any other Google data we have stored, please contact us at the email below.

Subprocessors & Third-Party Services

We share data with the following categories of vendors (subprocessors) only as needed to operate the Service. Each has its own privacy policy, and we encourage you to review them:

GoHighLevel — source CRM data (contacts, opportunities, conversations, messages)
HubSpot — source CRM data (contacts, companies, deals, logged activity), read-only
Salesforce — source CRM data (leads, contacts, accounts, opportunities, logged activity), read-only
Pipedrive — source CRM data (people, organizations, deals, logged activity), read-only
Zoho CRM — source CRM data (leads, contacts, accounts, deals, logged activity), read-only
Google — sign-in and Gmail data access; Google Cloud for email notifications
Microsoft — Outlook email data access
Fireflies — meeting transcript data
Fathom — meeting recording and summary data
Read AI — meeting report and summary data
Clerk — user authentication, organization management, and custody of Google/Microsoft OAuth tokens
Stripe — subscription billing and payment processing
Vercel — frontend application hosting
Render — backend application hosting
Neon — database (PostgreSQL) hosting
Upstash / Redis — caching of computed results
Cloudflare R2 — storage of follow-up email attachments
Resend — fallback delivery of transactional and notification emails
AI providers — lead scoring, conversation analysis and call transcription: OpenAI, Google (Gemini), xAI (Grok), and Groq (see "AI Subprocessors & Model Training" below).

AI Subprocessors & Model Training

We do not use your data to train our own models. Stealth IQ uses third-party large language model providers (currently OpenAI, Google, xAI, and Groq) to process conversation content via their business/API services. Under our agreements with these providers:

Your data is never used to train their models.
Inputs and outputs are retained only transiently—typically up to 30 days (55 days for Google) solely for abuse monitoring and security purposes—after which they are permanently deleted.
Data is processed under each provider's data processing agreement.

We do not use consumer-tier AI services, and we periodically review each provider's data handling terms.

Cookies & Analytics

We use essential cookies required for authentication and session management, provided through our authentication vendor (Clerk). We do not use advertising cookies, and we do not currently use third-party analytics or tracking cookies.

Data Storage & Security

Your data is stored on secure cloud infrastructure. We use industry-standard encryption for data in transit (TLS/HTTPS); our databases and object storage are encrypted at rest at the infrastructure layer; and integration credentials, API keys, and OAuth tokens are additionally encrypted at rest at the application layer. Access to production data is restricted to authorized personnel on a need-to-know basis. For more detail, and for instructions on disconnecting integrations and deleting your data, see our Data & Security page.

Third-Party Services

Each third-party service listed above has its own privacy policy governing its handling of data. We encourage you to review their policies as well.

Your Rights

You have the right to:

Request access to the personal data we hold about you
Request correction or deletion of your personal data
Revoke access to connected third-party accounts at any time
Request a copy of your data in a portable format

To exercise any of these rights, or to delete imported data or your account, see the Data & Security page or email us at the address below.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at: efaroni@guaranalab.com