Back to home

Privacy Policy

Last updated August 5, 2026

This Privacy Policy explains how SMB AI Hub (“SMB AI Hub”, “we”, “us”, or “our”), operated by Agent Scaler Inc. and C Marketing Inc., collects, uses, and shares information when you use our website at smbaihub.com and our related products and services (the “Service”).

1. Information we collect

Information you provide

  • Account & business details — name, email address, business name, and profile information you add during sign-up and onboarding.
  • Content — information you create or upload to power the Service, such as knowledge-base entries, contacts, brand assets, agent and campaign configurations, and the messages you exchange with the AI.
  • Payment information — handled by our payment processor (Stripe). We receive limited billing details (such as plan, status, and the last four digits of a card) but do not store full card numbers.
  • Support & communications — information you provide when you contact us or request access to the beta.

Information collected automatically

  • Usage & log data — actions taken in the Service, device and browser information, IP address, and timestamps.
  • Cookies & similar technologies — used to keep you signed in, remember preferences, and understand how the Service is used.

2. How we use information

  • Provide, operate, maintain, and secure the Service.
  • Power AI features you request, including generating responses, content, and automations.
  • Process payments and manage subscriptions.
  • Communicate with you about your account, updates, and support.
  • Monitor, troubleshoot, and improve the Service.
  • Detect, prevent, and address fraud, abuse, and security issues.
  • Comply with legal obligations.

3. AI processing

Some features rely on third-party AI providers (OpenAI, Anthropic, Google, and xAI). Content you submit to those features may be transmitted to and processed by these providers to generate outputs. We use their business offerings and configurations intended to keep your content confidential and, where offered, to exclude it from training their general models. AI-generated outputs can be inaccurate or incomplete — you are responsible for reviewing them before use.

4. How we share information

We do not sell your personal information. We share information only as described below:

  • Service providers (subprocessors) — vendors who process data on our behalf to run the Service: hosting and infrastructure, payments, email delivery and verification, AI providers, text-to-speech voice, telephony, connected-account integrations (such as Google, Microsoft, and Zoom), and stock media. Each is bound by contractual confidentiality and data-protection obligations. The current, itemized list — every vendor by name, what it does, and where — is published on our Sub-processors page, and we update it before adding a new sub-processor that handles customer personal data.
  • Legal & safety — when required by law or to protect rights, safety, and the integrity of the Service.
  • Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.
  • With your direction — when you connect an integration or otherwise instruct us to share information.

5. Google user data

If you connect a Google account, SMB AI Hub accesses limited Google user data through Google APIs, only to provide features you explicitly enable:

  • Send email (Gmail) — to send messages and follow-ups from your Gmail address when you or your AI assistant compose and confirm them. We do not read or delete your email.
  • Calendar (events) — to find open times and to create or update calendar events (including Google Meet links) when you book a meeting through the Service. To find open times we read only the start and end times of existing events in the window you are booking into. Event titles, descriptions, attendees, and locations are discarded the moment we read them — they are never stored, shown to anyone, or sent to any AI provider or other third party.
  • Contacts — when you choose to import contacts, to read your Google contacts, including auto-saved “Other contacts”, and add them to your private contact list in SMB AI Hub. This access is read-only, and it runs only when you start an import. Once imported, those contacts are yours and behave like any other contact in your list: your AI assistant can look them up to help you, and you can email them — including through campaigns — according to the consent basis you declare for them at import. When you ask the assistant about a specific person, the matching contacts’ names, email addresses, phone numbers, job titles, and tags are included in the request sent to the AI provider that answers you, so that it can tell you what you asked; see “Google user data and AI features” below. You can edit, unsubscribe, or delete them at any time in Contacts.
  • Postmaster Tools (deliverability) — to read aggregate spam-rate and reputation statistics for your sending domain, so the Service can warn you before deliverability problems affect your campaigns. This access is read-only and covers domain-level statistics rather than message content. This permission is requested when you connect any Google account, so that turning deliverability monitoring on later does not require a second approval — but the statistics themselves are only ever retrieved for Google Workspace accounts sending from their own domain. We do not retrieve them for consumer @gmail.com accounts, which have no sending domain to report on.

SMB AI Hub’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described above. We do not sell Google user data, do not use it for advertising, and do not use it to train generalized or non-personalized AI/ML models. We do not allow humans to read your Google user data except with your consent, for security or abuse investigations, to comply with applicable law, or where the data has been aggregated and anonymized. You can disconnect Google at any time in your account settings, which revokes our access.

Gmail and Google Calendar are Google Workspace APIs, so the following applies to them specifically: The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Google user data and AI features

Some features send your data to AI providers so the assistant can answer a question or draft something for you — for example, looking up a contact you asked about. Where that data originated from a Google Workspace API, we apply the Limited Use restrictions to it:

  • We do not use Google user data to develop, improve, or train any generalized or foundational AI/ML model, and we do not build a model from it beyond what is needed to serve that individual user’s own request.
  • We do not transfer Google user data to any third party that would use it to train or improve its own AI/ML models. We use our AI providers under business API terms that exclude our data from their model training, and we do not enable any optional data-sharing or model-improvement programs they offer.
  • Email campaign drafting never receives your contacts at all. The AI writes with merge tokens such as {{first_name | there}}; the real values are filled in on our own servers at the moment each message is sent. No contact details are part of a drafting request.
  • AI processing happens only to produce a result you asked for and see in the product. It is never used for advertising, profiling, or resale.

Who we share Google user data with

We do not sell, rent, or trade Google user data, and we never share it with advertisers, data brokers, or any party that would use it to train their own AI/ML models. We disclose Google user data only to the service providers that operate the features you turned on, and only to the extent each one needs:

  • Hosting & infrastructure (Supabase, Vercel) — store and serve the data that powers your account.
  • AI providers (OpenAI, Anthropic, Google, xAI) — when you ask your AI assistant a question that requires looking up a contact, the matching contact details are included in that request so the assistant can answer. These providers process the request to generate a response; under our business agreements with them, they do not use it to train their models.
  • Email address validation (ZeroBounce) — before a campaign sends, we check recipient email addresses (which may include addresses you imported from Google Contacts) to catch invalid ones and protect your sending reputation. Only the email address is checked.
  • Legal & safety — where required by law or to investigate security and abuse, as described in section 4.

Google user data is never shared with the other service providers listed in section 4 — payments, telephony, or voice providers do not receive it.

How we protect Google user data

Your Google credentials receive our strongest protection. Access and refresh tokens are encrypted at rest using AES-256-GCM envelope encryption: each connection gets its own encryption key, which is itself encrypted with a master key held outside the database in our server environment — so the stored data cannot be read even by someone with a copy of the database. All data is encrypted in transit using TLS, each customer’s data is isolated at the database row level so one account can never read another’s, and access to production systems is restricted to authorized personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

How long we keep Google user data, and how it is deleted

We keep Google user data only while you have a Google account connected and the related feature enabled:

  • When you disconnect — we revoke our access with Google and immediately and permanently delete the stored tokens, along with the deliverability statistics and connection settings derived from that account. Disconnecting is available at any time in Library → Tools.
  • Contacts you imported — remain in your contact list so you can keep using them, and are deleted whenever you delete them in Contacts, or when your account is deleted.
  • When your account is closed — email info@smbaihub.com to request account closure and deletion (adding “Delete” to the subject line helps us route it faster, but any clear request works). We delete your data, including all Google user data, from our live systems within 30 days of the request.
  • Backups — encrypted backups are kept on a short rolling schedule and are overwritten in the ordinary course within 30 days, after which deleted data no longer exists in them.

6. Data retention

We retain information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When you close your account, we delete your personal information from our live systems within 30 days of your request, and our encrypted backups are overwritten within 30 days after that on their normal rolling schedule. Some records may be retained longer where the law requires it — for example, invoices and other financial records kept for tax and accounting purposes. Google user data follows the shorter, specific schedule described in section 5.

7. Security

We use technical and organizational measures designed to protect your information, including encryption in transit (TLS), encryption at rest for sensitive credentials such as connected-account tokens, row-level isolation between customer accounts, access controls, and restricted production access. Section 5 describes the specific protections applied to Google user data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights & choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can exercise these rights, or close your account, by contacting us at info@smbaihub.com. You may also manage certain information directly in your account settings.

9. International transfers

We and our service providers may process information in countries other than your own. Where required, we use appropriate safeguards for such transfers.

10. Children

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal information from children.

11. Third-party links

The Service may link to third-party websites and services that we do not control. Their privacy practices are governed by their own policies.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date and, where appropriate, provide additional notice.

13. Contact us

Questions about this Privacy Policy? Contact us at info@smbaihub.com.