1. Scope and our role
GoLuly, LLC ("GoLuly," "we," "our," or "us") is a Florida limited liability company that provides cloud-based project and task management, customer relationship management (CRM), proposals, contracts, invoicing, payments, files, analytics, artificial intelligence (AI) assistance, calendars, and integrations (collectively, the "Services"). This Privacy Policy explains our practices regarding personal information collected through goluly.com, its subdomains, the Services, and associated support and communications.
When we manage information about our visitors, subscribers, prospective customers, and account holders for our own business purposes, GoLuly generally acts as the business or controller, as those terms are used under applicable privacy laws. When an organization uses a GoLuly workspace to store or process information about its employees, customers, prospects, or other individuals ("Customer Content"), the organization generally determines the purposes and means of that processing, and GoLuly generally processes that information on its behalf, subject to applicable agreements and law. A business customer's instructions and applicable data processing agreement, if any, govern our processing of Customer Content in that capacity.
The Services are intended for people aged 18 or older. They are not directed to children.
2. Categories of information we collect
Depending on how you use the Services, we collect the following categories:
- Identifiers and account details: name, email address, telephone number, account credentials and authentication identifiers, business name, job title, workspace membership, and account preferences.
- Professional, commercial, and customer records: CRM contacts, sales information, client relationships, projects, tasks, proposals, contracts, invoices, order information, and other records entered by users or their organizations.
- Billing and payment information: subscription plan, billing address, invoices, payment status, transaction identifiers, payment history, and Stripe-related account or transaction metadata. Stripe handles payment processing and may collect additional identity, banking, and payment information under its own terms and notices. We do not need to store full payment-card numbers to provide standard billing features.
- Files, communications, and AI interactions: documents and files you upload; messages and support requests; calendar information you authorize us to access; prompts and other information submitted to AI features; and resulting AI outputs and activity records.
- Technical and usage information: IP addresses, device and browser characteristics, session activity, feature usage, log-in history, diagnostic information, cookies, security events, and audit logs.
- Location information: approximate location inferred from IP addresses and location details that you or your organization choose to provide. We do not require precise GPS location as a standard account function; any future precise-location feature will require appropriate notice and permissions.
- Information from connected services: information made available when you authorize Google, Microsoft/Outlook, Stripe, or another supported integration.
Customers may include personal or sensitive information in their uploaded records. GoLuly does not ask users to provide regulated health information, government identifiers, or other highly sensitive information unless a feature specifically supports it and appropriate contractual and legal safeguards are in place. Business customers are responsible for deciding what they upload and whether they have the necessary authority to do so.
3. Sources of information
We receive information directly from you; from the administrator or other authorized users of your organization; automatically through our websites and Services; from Stripe and connected third-party services at your direction; and from people who communicate with us or submit legitimate business inquiries.
4. How and why we use information
We process information as appropriate to:
- Create and administer accounts and workspaces, authenticate users, manage permissions, and provide requested features.
- Maintain projects, CRM records, documents, invoicing, subscriptions, payments, and authorized integrations.
- Process AI prompts and relevant authorized Customer Content through Google Gemini/Vertex AI to provide requested AI assistance, suggestions, and user-approved task execution.
- Provide support, service notices, security alerts, account communications, and responses to privacy requests.
- Detect and prevent fraud, unauthorized access, abuse, service disruption, and violations of our Terms.
- Evaluate service performance, troubleshoot, conduct internal analytics, and improve functionality using usage information and appropriately de-identified or aggregated data.
- Send our own product news and promotional communications where permitted, subject to unsubscribe or other applicable preferences.
- Comply with legal obligations, enforce our agreements, and establish, exercise, or defend legal claims.
Customer Content, marketing, and AI training. We do not use identifiable Customer Content—such as uploaded documents, CRM contacts, private messages, or identifiable AI prompts—to train generalized AI models or conduct unrelated targeted advertising without a separate, legally appropriate authorization and any required notices or choices. GoLuly may use de-identified or aggregated information for service analytics and product improvement, subject to applicable law and contractual restrictions. The use of Google Gemini/Vertex AI for a requested inference does not itself mean Customer Content is authorized for model training. Google's applicable cloud terms and the particular service configuration govern Google's own processing.
Where applicable laws require a legal basis, we rely, as appropriate, on contractual necessity, legitimate interests, consent, legal obligations, or other lawful grounds. We do not rely on consent where another lawful basis properly applies, and you may withdraw consent where consent is the basis, subject to applicable limitations.
5. How information is disclosed
We disclose information only as reasonably necessary for the purposes described above, including to:
- Google Cloud and Google Gemini/Vertex AI: infrastructure, storage, security, application hosting, backups, and authorized AI processing.
- Stripe, including Stripe Connect: subscription payments, connected-account onboarding, payment processing, verification, fraud prevention, payouts, refunds, and disputes. Stripe may act as an independent controller or processor for certain activities.
- Cloudflare: network delivery, performance, and protective security services.
- Resend: service communications, transactional messages, and permitted email delivery.
- Connected service providers: for example, Google Calendar and Microsoft/Outlook, when you enable an integration and authorize the transfer.
- Our professional advisers and lawful recipients: auditors, legal advisers, regulators, courts, or law enforcement where disclosure is legally justified.
- Successors in a corporate transaction: subject to appropriate safeguards and legally required notice.
Your organization's workspace administrators and authorized team members may access Customer Content according to their permissions. GoLuly does not provide external customers with direct workspace access as a standard feature, although a business user may store information relating to external customers in the CRM.
No sale or cross-context advertising sharing. Under our present policy, GoLuly does not sell personal information or share it with third parties for cross-context behavioral advertising as those terms are defined under applicable US privacy laws. We will update our disclosures and implement any required choices before introducing such practices.
6. Cookies, analytics, and marketing choices
We use cookies and comparable technologies as necessary for authentication, session management, preferences, reliability, and security. If optional analytics or other nonessential tracking technologies are enabled, we will provide additional disclosures and consent or opt-out controls when required by law. You can also control certain cookies through your browser settings, although blocking essential cookies may prevent features from working.
You may unsubscribe from promotional emails using the method in those messages. Operational, billing, security, and legally required communications are not necessarily optional. Where applicable, we honor legally recognized browser-based opt-out preference signals for covered processing activities.
7. Artificial intelligence and automated activity
GoLuly's AI features are powered by Google Gemini/Vertex AI. Information supplied in a prompt, and any records that an authorized user chooses to provide as context, may be transmitted for regional AI processing to generate a response or carry out an approved action. AI-generated information may be inaccurate. Currently, execution of AI-assisted tasks is subject to human approval; autonomous AI agents are a planned feature, not a current promise under this Policy. New agent capabilities may require additional notices and terms before activation.
We do not use our AI features to make our own solely automated decisions producing legal or similarly significant effects about individuals. Business customers must independently assess and comply with laws governing any consequential decisions they make using outputs from the Services.
8. Hosting, security, and international processing
GoLuly's core infrastructure operates on Google Cloud in the United States, and our configured backups are stored in the United States. We use encryption in transit (HTTPS/TLS) and at rest, multifactor authentication capabilities, audit logging, role-based access controls, and regional endpoints for Gemini/Vertex AI processing. Our services and subprocessors may nevertheless involve limited processing, support access, network routing, or authorized integration activity in other countries. Regional endpoint configuration is not a promise that all service-related information always remains within a single country.
Where legally required for international transfers, GoLuly will use an applicable transfer mechanism and contractual safeguards. No method of electronic storage or transmission is completely secure, and our safeguards do not amount to a guarantee against every incident.
9. Retention and deletion
We keep personal information for the time reasonably necessary for the purpose collected, taking into account the subscription relationship, customer instructions, tax and accounting requirements, security investigations, dispute resolution, and legal obligations. Retention varies by record type. Account closure does not automatically erase every record. Our retention approach is:
| Category | Standard retention approach |
|---|---|
| Account profiles and Customer Content | During an active account and thereafter as reasonably necessary for service purposes, verified customer instructions, security, disputes, and applicable legal obligations. Closing an account does not automatically erase all information. |
| Export and deletion requests | An Account Owner may contact Support through their GoLuly account to request available exports or deletion, subject to verification of identity and authority, applicable law, and legitimate retention requirements. We respond within applicable legal deadlines. Suspension or termination does not limit applicable privacy rights. |
| Incomplete registration forms | Expire 30 days after creation. Expired records are removed through scheduled cleanup. |
| Submitted registrations awaiting activation | Expire 90 days after submission and become eligible for scheduled cleanup. These periods apply to registration records, not to an entire account or its authentication identity. |
| Authentication audit metadata | Eligible for scheduled deletion after 90 days. This period does not apply to all security records or active authentication factors. |
| Expired recovery authorizations | Eligible for scheduled cleanup 90 days after expiry when no active recovery references them. Active recovery and account-security records are retained as needed to secure the account. |
| Operational and platform audit logs | Ordinary operational logs are retained for 30 days. Required platform audit logs are retained for 400 days. Other security records may be retained for periods proportionate to security, reliability, incident investigation, and applicable legal requirements. |
| Backups and file versions | Restricted recovery copies and earlier file versions may remain after removal from active systems. They are subject to separate backup rotation, reviewed removal, provider recovery periods, and lawful holds or exceptional recovery needs; there is no single deletion period covering every copy. |
| Billing, tax, and payment compliance records | As long as required for accounting, financial, fraud-prevention, or legal obligations, which may extend for several years after termination. |
| Marketing preferences and inquiries | Until a request is resolved, consent is withdrawn where applicable, or the information is no longer needed, subject to suppression records needed to respect your preferences. |
| De-identified or aggregated information | While it remains useful for legitimate analytics, provided it no longer identifies individuals under applicable law. |
If an account is overdue, we may suspend access and, following termination, apply the retention approach above. We may delete data sooner where required by law or where justified by an urgent security threat, and we may retain relevant records longer where lawful.
10. Your rights and choices
Depending on your residence and the laws that apply to GoLuly, you may have rights to know or access personal information, obtain a portable copy, request correction or deletion, withdraw consent, object to or restrict certain processing, limit certain sensitive-data uses, opt out of sale or targeted-advertising sharing, and appeal an adverse privacy-rights decision. We will not unlawfully discriminate against you for exercising applicable rights.
For GoLuly-managed account or marketing information, contact Support via your account for privacy requests. We may verify your identity or authority before acting and will respond within applicable legal deadlines. If the information belongs to a workspace controlled by an organization, you should ordinarily contact that organization's administrator or privacy contact first; GoLuly will assist that organization as applicable. Authorized agents may submit requests where permitted by law and subject to appropriate verification.
California and other US states. Where state consumer privacy laws apply to us, individuals may exercise the rights made available by those laws. Our categories of collection and disclosures, uses, sources, and retention criteria appear in Sections 2–9. We do not presently sell personal information or share it for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics outside legally permitted purposes. If our practices change, we will provide the required notices and options.
International users. If you are covered by a data protection law outside the United States, you may have additional rights, including complaints to a competent supervisory authority. A jurisdiction-specific notice or data processing agreement may apply where required. GoLuly offers the Services only in the locations it elects to support and does not represent that every feature is available in every country.
11. Children
Individuals under 18 may not create or use GoLuly accounts. We do not knowingly market the Services directly to minors. If we learn that a minor created an account contrary to this requirement, we may disable it and take appropriate deletion steps. Organizations must have an appropriate legal basis before uploading personal information about minors as Customer Content.
12. Changes to this Policy
We may revise this Policy as our Services or legal obligations change. We will update its effective date and provide additional advance notice or obtain consent where required for material changes. An archived copy may be retained for compliance purposes.
13. Contacting GoLuly
Contact Support via your account for privacy requests. Legal requests may also be submitted through Support in your GoLuly account.
Supplement: Account verification
GoLuly uses your name, email, verified phone, account details, and billing address to create and secure your account. Billing addresses are required for Personal and Business accounts.
Firebase handles sign-in and email/SMS verification. Google processes phone numbers for spam and abuse prevention across its services. Google Maps processes address searches and validation. Address validation does not verify your identity or business ownership.
Registration and authentication-record retention is described in Section 9. Passwords and SMS codes are never stored by the GoLuly application. Optional engagement analytics is separate from account verification. Your phone, address, email, password, and verification codes are excluded from analytics.
Your recovery PIN is stored as a protected verifier. PINs and recovery authorizations are excluded from logs and analytics.
Contact Support via your account for privacy requests.