Privacy Policy

Information we collect

• Account details: your name and email address (we sign you in with one-time email links — no passwords).
• Business information you provide: business name, contact details, service area, offers, photos, logos and other content you upload or confirm, and campaign drafts.
• Website import (only when you ask): public text and images from the website address you enter.
• Leads from your pages: when a visitor fills in your landing page or quiz, we store their answers and contact details and pass them to your business's CRM. Visitors receive an anonymous cookie on landing pages to measure visits and prevent duplicate submissions.
• Connected accounts (only if you connect them): see “Google” and “Facebook / Meta” below.

Google user data

If you choose “Connect Google Calendar”, you sign in on Google's own page and choose what to allow. Goliath requests:

• Your email address — to show which Google account is connected.
• Free/busy information (calendar.freebusy) — only the times you are busy, never event titles, descriptions or guests. We use it to hide busy times from your booking page.
• Only if you turn on “Add new bookings to my Google Calendar” (calendar.events.owned) — to create, update and remove the calendar entries for bookings made on your Goliath page. We don't read or change your other events, and we never invite anyone.

Who we share Google user data with. Goliath does not sell, rent or trade Google user data, and does not share, transfer or disclose it to anyone except:

• Render Services, Inc. (our hosting provider), which stores Goliath's database on our behalf — including the encrypted Google access tokens, the connected Google account's email address and the IDs of the booking events Goliath created. Render processes this data only to host Goliath and may not use it for anything else.
• The person who booked, only when you turn on adding bookings to your Google Calendar: Goliath adds them as a guest on the booking event it created, so Google sends them the invitation for that appointment (date, time and the business's name). Your other events and your free/busy times are never shown to them.
• When required by law, or to protect the security of Goliath and its users.

Google user data is not shared with our AI providers (OpenAI, Anthropic), advertising platforms (including Meta), GoHighLevel, analytics tools or any other third party, and is never used for advertising or to train AI models.

Google access tokens are stored encrypted and used only for the purposes above. We do not sell Google user data, use it for advertising, or let people read it except where you ask us to help you, for security, or as required by law. Goliath's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect at any time in Goliath (Calendar → Disconnect), which revokes our access at Google, or in your Google Account under Security → Third-party access.

Facebook / Meta data

If you choose “Connect Facebook”, you sign in on Facebook's own page and choose which ad account, Page, pixel and Instagram account Goliath may use. We store an encrypted access token and the names and IDs of those assets and the permissions granted. We use them only to prepare and manage the ads you approve (new ads are created paused for your review) and to show their results. We don't read personal messages, friends or profile details.

You can disconnect in Goliath (Connections → Disconnect) or remove Goliath in Facebook settings. To have this data deleted, see our Facebook data deletion page.

How we use information

• To provide the service you asked for: drafting ads and pages, delivering leads and bookings to you, sending the follow-ups you set up, and showing results.
• To review campaigns before they go live and to keep the service secure (for example, preventing abuse and fixing errors).
• We never invent facts about your business; AI-drafted content is checked against what you confirmed.
• To support you and improve Goliath, we measure how our own app is used by signed-in customers and demo visitors: which sections are opened, how long they are actively used, and how far a campaign setup has progressed. This is not shared with advertisers, never includes what you type, and is deleted with your account (demo usage is deleted when the demo expires).

Service providers we use

We share information only with providers that help us run Goliath, and only what they need:

• Hosting: Render (servers and storage).
• AI drafting: OpenAI and Anthropic (your business details and campaign content, to draft ads, pages and follow-ups).
• Website import: Firecrawl (the public website you ask us to read).
• Sign-in emails: Resend.
• CRM, calendars and messages: GoHighLevel (your leads, bookings and follow-up messages, in your business's own account).
• Google and Meta, when you connect them, as described above. Google user data is shared only as described in “Google user data”.

We do not sell personal information.

How we protect sensitive data

We treat the following as sensitive: Google and Facebook access tokens, the Google account email address and calendar free/busy information, sign-in links and sessions, and the contact details and answers of people who submit your landing pages. We protect them with these measures:

• Encryption in transit: Goliath is served only over HTTPS (TLS), and every connection from Goliath to Google, Meta and our other providers uses HTTPS.
• Encryption at rest: Google and Facebook access and refresh tokens are encrypted with AES-256-GCM before they are stored, using a secret key kept separately from the database (in our hosting environment's protected settings, never in the app's code or in your browser). Our hosting provider, Render, also encrypts the stored disk.
• Secrets never stored in readable form: sign-in links and session cookies contain random secrets of which we store only a one-way (SHA-256) hash. Sign-in links work once and expire after 15 minutes; session cookies are HTTP-only and sent only over HTTPS.
• Access control: every request is checked on our server so each business can only access its own information. Within Goliath, only a small number of authorized staff can access business data, and only to review campaigns, provide support, or keep the service secure.
• Data minimization: we request only the Google permissions described above (free/busy times, plus creating the booking events you turn on). We never request access to your event details, email, contacts or files.
• No tokens in logs or browsers: access tokens are never shown in the app, sent to your browser, or written to logs, and they are used only from our servers for the purposes described in this policy.
• Revocation and deletion: when you disconnect Google or Facebook, we revoke Goliath's access with that provider where it supports this, and delete the stored tokens immediately.
• Abuse protection: sign-in, form submissions and other public endpoints are rate-limited, and incoming webhooks are accepted only with a valid signature.

Retention and deletion

We keep account and campaign information while your account is active. Free demo workspaces are deleted automatically after a period of inactivity. Google and Facebook tokens are deleted as soon as you disconnect. The other Google data we hold (the connected account's email address and the IDs of booking events Goliath created) is deleted when you delete your account, or sooner if you ask us. You can ask us to delete your account and data at any time by emailing us; we complete deletion within 30 days.

Your choices

• Disconnect Google, Facebook or other connections at any time.
• Ask for a copy of your information, a correction, or deletion by emailing us.
• Leads who want their information removed can contact the business they submitted it to, or us.

Contact

Goliath Marketing LLC · david@goliath-marketing.com

We'll post any changes to this policy on this page with a new “last updated” date.