This policy explains what Ando collects, why, where it goes, how long it stays, and what we will never do with it. It is written to be checked against the product rather than admired: every claim below describes how Ando actually works today.
Ando is operated by Cheolgyun Park trading as CG Integrals (ABN 38 922 364 260), Melbourne, Australia. For anything on this page, including a request to see or delete your data, write to [email protected]. We are the data controller for the personal information described here.
Ando asks Google only for what its jobs need. Each permission below is shown on Google's consent screen before you grant it, and the optional ones are requested only when you connect that service.
| Permission | What Ando does with it | Why it is needed |
|---|---|---|
Sign inopenid email profile |
Creates your account from your Google email, name, and profile picture address, and shows who is signed in. | So your agents, connections, and plan belong to you and no one else can reach them. |
Read Gmailgmail.readonly |
Runs the search the job you set up defines (for example, unread inbox mail from the last two days, or threads that mention an invoice) and reads only the messages that match. Ando requests metadata only — subject, From, To, Reply-To, Message-ID, References — together with the short preview snippet Gmail itself returns. It does not download full message bodies. | A reply written without the thread would be a guess. Ando never reads your mailbox for any purpose other than the job you gave it, and never to build a profile of you. |
Write drafts and sendgmail.compose |
Saves each draft in your Gmail Drafts folder, where it waits for your approval, and sends it when you approve it. A follow-up sequence you have switched to automatic sends on the schedule you set; that switch is yours to turn on and off. | Approval happens inside your own Gmail, where you can read and edit the draft before it goes. Ando never sends from any address but yours. Google offers no scope that permits drafting but forbids sending, so the rule that nothing goes out unapproved is enforced in Ando's own code: exactly one function in the service can send, and every path into it requires an approval you gave. |
Google SheetsspreadsheetsOptional |
Adds rows to the spreadsheet you chose, so the records an agent keeps (customers, follow-ups, results) live in a sheet you own. | Only if you connect Sheets. Ando writes to that one spreadsheet and does not read others. |
Google Drive filesdrive.fileOptional |
Opens the spreadsheet you connected for records. | Only if you connect Sheets. This permission reaches only files Ando created or you picked; it cannot see the rest of your Drive. |
Google Calendarcalendar.readonlyOptional |
Reads upcoming events on your primary calendar so reminder and scheduling agents know what is booked. | Only if you connect Calendar. Read-only: Ando never creates, changes, or deletes events on your calendar. |
Ando's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: we do not use Google user data to develop, improve, or train generalised AI or machine learning models. We do not transfer, sell, or use it for advertising of any kind. Gmail subjects, addresses, and snippets are sent to the AI providers in section 5 only to produce the draft or the sorting decision you asked for, and only for that one piece of work. No human at CG Integrals reads your Google user data except in the three cases in section 6.
To disconnect Gmail, Calendar, or Sheets: open your Google Account's third-party access page and remove Ando. That revokes our access immediately and is the fastest route. You can also email us and we will remove the stored token from our side. Please note: the current version of Ando does not have a working in-app Disconnect button for Gmail, and removing a stored token does not by itself revoke the grant at Google — so the Google Account page above is the step that actually ends our access. We are fixing both.
To delete your data: email [email protected] from your account email. We delete it within 30 days and confirm when it is done.
This is the complete list. If it is not here, we do not hold it.
| What | Detail |
|---|---|
| Account | Your email address, name, and the address of your Google profile picture, from Google sign-in. Your plan, and Paddle's customer and subscription identifiers. We store no password, because sign-in is Google's. |
| Sessions | A random sign-in token, held only as a one-way hash, in a HttpOnly cookie that expires after 30 days. The cookie contains nothing else. |
| Connections | Access and refresh tokens for services you connect — Gmail, Outlook, Slack, Google Sheets and Calendar, Notion, Airtable, HubSpot — and any API key you paste for a custom connection. Encrypted at rest. See section 6. |
| Your business profile | Up to 33 fields read from your website or typed in: name, what you do, location, contact details, opening hours, pricing notes, social links, your own notes on how you want to sound, and your colours, fonts and logo image. |
| Agent records | People and companies your agents work with: name, email, company, facts, the angle for an approach, and any fields you defined yourself. Extracted from documents you upload, or found on the live web by the Finder agent (see section 3). |
| Drafts and follow-ups | Every email body your agents write, the recipient address, the schedule, and the thread and draft identifiers. Drafts waiting for approval, and sent ones, are kept. |
| Uploaded documents | The file name, size, type and a checksum. The file's contents are not stored — a document is read into memory, the records are extracted, and the bytes are discarded. |
| Generated files | Lead-list spreadsheets, draft bundles, documents and images your agents produce, kept so you can download them again. |
| Activity trail | A short line for each thing an agent did. These lines can include a recipient's email address and a subject line. |
| Usage and spend | How much AI work your account used and what it cost, so plan caps are fair and the bill is one you can read. |
| Bookings | If you book a call: your name, email, timezone, any note you write, and the meeting link. |
| Technical | Your IP address, briefly, in memory, to enforce rate limits. Our web server's access log records the request line and caller IP on the machine's system journal. |
| Payments | Handled by Paddle. We never see or store card numbers. We receive confirmation of what was purchased and the identifiers above. |
Your browser also keeps a copy of your builder work in its own local storage, on your device. That never leaves your computer unless you save it to your account.
This section is for people who have never used Ando and may be reading it because an email mentioned us. It matters, so it is not buried.
Ando's Finder agent searches the live web for businesses that match a customer's description of who they sell to, and reads those businesses' own public websites. For each one it records the company, website, city, a line on what they do, a line on why they might be a fit, and a general contact address published on that company's own site — an address of the kind info@, hello@, contact@. It is written to accept only a generic mailbox on the company's own domain. Ando's Outreach agent then drafts a first email to that address, which the customer reads and sends from their own mail account.
Ando's Sorter and Reply agents also hold details of people who write to a customer, and the Reminder agent holds details of people a customer invoices. Those details come from the customer's own mailbox and records.
If you received a first email from an Ando customer, that customer sent it and is responsible for it. Their name and reply address are in the message. Our terms require every customer to have their own lawful basis to contact you, to identify themselves honestly, and to honour an opt-out.
If the GDPR or UK GDPR applies to you, these are our lawful bases.
| What we do | Basis |
|---|---|
| Run your account and do the work your agents are set up to do | Performance of a contract — Article 6(1)(b) |
| Take payment, keep tax and transaction records | Contract, and legal obligation — Article 6(1)(b) and (c) |
| Keep the service secure: rate limits, abuse prevention, access logs | Legitimate interests — Article 6(1)(f) |
| Hold business contact details for outreach (section 3) | Legitimate interests — Article 6(1)(f) |
| Answer your support messages | Legitimate interests, or contract |
| Analytics on our public pages | Consent, where the law requires it — see section 10 |
Where we rely on legitimate interests you have the right to object, and we will stop unless we have compelling grounds that override your rights. Ando makes no decision about you that produces a legal or similarly significant effect without a person in the loop.
Ando does not own a model. It routes each piece of work to whichever model is genuinely best at that step, through OpenRouter, an American routing service, using one key. This is the full table.
| Step | Model family | Where the company is |
|---|---|---|
| Writing your agent, the interview, planning a team, judging a rehearsal, and writing the emails customers receive (Outreach's first emails always; other drafts while Internet is switched off in your account) | Anthropic — Claude | United States |
| Reading the live web, writing your agents' drafts while Internet is switched on in your account (it may search Google as it writes), reading an uploaded document for records, checking a generated image | Google — Gemini | United States |
| Deciding whether a mail thread needs a reply, sorting a request into a pattern, rehearsal days, and answering your questions about an agent's own records | DeepSeek | China |
| Reading your website into a brand profile, and creative briefs | Moonshot AI — Kimi | China |
| Making images | OpenAI | United States |
| Live web search behind the Finder and research work | Exa | United States |
What that means in practice: the subject line, sender address and Gmail preview snippet of a thread being triaged, and the records an agent holds about your customers and prospects, are processed by a model from a Chinese company. Your uploaded documents, brand profile, and drafted emails go to the providers shown against their step. We are telling you this plainly because we would want to know.
Because OpenRouter chooses an endpoint at the moment of the request, the physical location of the server that serves a given model can vary and is not something we can promise in advance. We send no account identifier with the request; the provider receives the content of the job and nothing that names you.
If your business cannot send its data to a particular country, do not connect Ando to it, and tell us — we can discuss restricting your account to a narrower set of providers.
Encryption is a word that gets stretched, so here is exactly what is true.
Your connection secrets — the Gmail, Outlook, Slack, Sheets, Calendar, Notion, Airtable and HubSpot tokens, and any API key you paste — are encrypted at rest with AES-128 in an authenticated construction (Fernet). They are decrypted only at the moment a job you set up needs them, and they are never sent to your browser.
The rest of the database is not encrypted field by field. Your agent records, drafted emails, brand profile, generated files and activity trail are stored as ordinary rows on our server. Access to that server is restricted to the operator's own key.
The AI models in section 5 read what each job needs, only to do that job. Two of those companies are in China. We send no account identifier with a request, and we do not authorise any provider to train on your content.
No one at CG Integrals reads your content unless you ask us to. The only exceptions are investigating a specific security incident and when the law compels us; we will tell you afterwards where we are permitted to. We can technically reach your content, because the AI has to read a message to draft its reply; our promise is that we do not look.
The connection between your browser and Ando is encrypted with HTTPS, terminated by Cloudflare. The leg between Cloudflare and our own server is not separately encrypted at the time of writing. It is the first item on our security list, and we will update this page when it changes.
We are a very small operation. We do not hold ISO 27001 or SOC 2, we have not had an independent penetration test, and we do not have 24-hour staffed monitoring. No service can promise it will never be breached, and we will not pretend otherwise. If a claim on any of our pages ever seems stronger than this section, this section is the one that is true.
We share data only with the services needed to run Ando, and each receives only what its job needs. This is all of them.
| Who | What they get | Where |
|---|---|---|
| Amazon Web Services | Hosts the server and the database | Australia (Sydney) |
| Cloudflare | All web traffic, as DNS proxy and HTTPS terminator | United States, and edge locations worldwide |
| Sign-in; Gmail, Sheets, Drive and Calendar if you connect them | United States, and worldwide | |
| Microsoft | Outlook mail, if you connect it | United States, and worldwide |
| Slack (Salesforce) | The message body you approved, if you connect it | United States |
| Notion, Airtable, HubSpot | Agent records you choose to export, including contact name and email | United States |
| OpenRouter | Every AI request: prompts, documents, thread metadata, records, drafts | United States |
| Anthropic, Google, OpenAI, Exa | The content of the step they serve — see section 5 | United States |
| DeepSeek, Moonshot AI | The content of the step they serve — see section 5 | China |
| Paddle | Your email and account identifier at checkout; they handle the card, the invoice and the tax | United Kingdom, United States |
| Google Analytics | Page views on our public pages — see section 10 | United States |
| Google Fonts | Your IP address and browser, when a page loads a font | United States |
Paddle acts as merchant of record. For the payment itself Paddle is an independent controller, not our processor, and its own privacy policy and buyer terms apply to that transaction.
We may also disclose personal information where the law requires it, to establish or defend a legal claim, or to a buyer if the business is ever sold — in which case this policy travels with the data and we will tell you before anything moves.
We are in Australia and our server is in Australia, but the services above are not, so personal information is disclosed to recipients in the United States, the United Kingdom, China, and wherever Cloudflare's edge and Google's and Microsoft's networks operate. We take reasonable steps to ensure those recipients handle it consistently with the Australian Privacy Principles, and for transfers out of the EEA or UK we rely on the providers' Standard Contractual Clauses and equivalent terms. There is no adequacy decision for China; if that is a problem for your business, tell us before you connect anything.
| What | How long |
|---|---|
| Activity trail | The most recent 500 lines per agent; older ones are deleted automatically |
| Generated files | The most recent 40 per account, and within a total size cap; older ones are deleted automatically |
| Sign-in sessions | 30 days |
| Uploaded document contents | Not kept at all — read in memory, then discarded |
| Account, agent records, drafts, follow-ups, brand profile, bookings | For as long as your account is open, and then until you ask us to delete it. We delete within 30 days of the request. |
| Business contact details found by Finder (section 3) | Deleted on request; otherwise for as long as the customer's account holds them |
| Tax and transaction records | As long as Australian law requires — generally five years. These sit with Paddle. |
| Web server access logs | On the server's system journal, size-capped by the operating system |
We are being straight with you: apart from the automatic trims above, Ando does not currently expire old data on a timer, and deletion is done by hand when you ask. Putting both on a schedule is on our list, and until it is done a request to us is the way it happens.
ando_session, holds a random token so the service knows you are signed in. It is HttpOnly, same-site, and expires after 30 days. The service does not work without it.G-JVKJ4MT431) runs on our public pages and inside the signed-in app, and sets its own cookies. It tells us how many people read a page and which links work. We do not use it for advertising and we have not linked it to any ad product.Please note: Ando does not yet show a cookie consent banner, so analytics currently load as soon as a page opens. If you are in the EU or the UK, where consent is required before non-essential cookies are set, we have not yet met that standard and we are not going to claim we have. We intend to add a consent control and will update this page when we do. In the meantime you can block analytics with a browser extension, your browser's tracking protection, or Google's opt-out add-on, and none of that affects how Ando works.
Wherever you live, you can ask us to:
Email [email protected]. If you have an account, write from your account address; if you do not, tell us enough to find you. We reply within 30 days, we do not charge, and we will not make you explain yourself. If we cannot do what you ask — because a tax record has to be kept, for instance — we will tell you which part and why.
Under the GDPR you may also withdraw consent at any time where we relied on it, without affecting what was done beforehand. Under the Australian Privacy Act you may deal with us anonymously or under a pseudonym where it is lawful and practicable, though an account that connects to your own Gmail is, by its nature, not one of those cases.
If you think we have mishandled your personal information, tell us first: [email protected], with "privacy complaint" in the subject. A person, not an agent, reads it. We acknowledge within 7 days and give you a written answer within 30 days, saying what we found and what we are doing.
If our answer does not satisfy you, you can take it further, free of charge:
We have not appointed a representative in the EU or UK under Article 27 of the GDPR. If you are an EU or UK resident, write to us directly at the address above and we will handle your request ourselves, to the same deadlines.
If personal information we hold is lost or accessed without authorisation, and it is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner as quickly as we can, as the Notifiable Data Breaches scheme requires. Where the GDPR applies we will notify the relevant supervisory authority within 72 hours of becoming aware, and tell you directly where the risk to you is high. We will say what happened, what was involved, and what you should do.
Ando is a tool for businesses and is not for anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, write to us and we will delete it.
We will change this page when the product changes, and the date at the top will change with it. If a change materially affects your rights, we will tell account holders by email before it takes effect. Previous versions are available on request.