One account. Three connected products. This policy explains how Aerobee handles personal information across Aerobee Accounts, Winroom, and Hydrobase, including our websites, workspaces, and connected services.
1. Scope and responsibility
Aerobee (“we”, “us”) provides the shared account and workspace panel at aerobee.ai, the sales assistant Winroom at winroom.aerobee.ai, and the business research and signals product Hydrobase at hydrobase.aerobee.ai. Our privacy contact is suhaneshivam82@gmail.com.
We determine how account, billing, security, and website information is used. For customer information uploaded or connected by a business workspace, that business generally determines the purpose of processing and we process it to provide its requested services. Contact your workspace administrator about information your employer or another business manages; you may also contact us for help.
2. Information we handle
- Accounts and workspaces: name, email, authentication identifiers, password hashes when you use a password, memberships, roles, invitations, and product access.
- Winroom: customer contacts, companies, deals, notes, call or meeting recordings and transcripts supplied through enabled features, summaries, coaching suggestions, and follow-up drafts.
- Hydrobase: submitted company domains, research requests, watchlists, imported business contacts, public business information, source references, observations, and derived sales signals. Information may come from customer imports, connected providers, and publicly available websites.
- Integrations: access and refresh tokens, connection identifiers, and information returned by services you authorize, such as calendars, CRMs, meeting platforms, or communications providers.
- Billing and communications: plan and transaction references, credit usage, support messages, and waitlist details such as name, email, CRM, and team size. Payment providers handle payment information submitted through their checkout.
- Technical information: request and error logs, timestamps, network and device information available with requests, and activity needed to operate and secure the services.
3. How and why we use information
We use information to authenticate users, manage workspace access, deliver requested features, synchronize connected systems, provide research and AI-assisted outputs, handle billing and support, prevent abuse, troubleshoot failures, and comply with applicable obligations. Waitlist information is used for requested product and early-access communications; contact us to stop these messages.
Where a legal basis is required, we rely on performing our agreement with you, legitimate interests in operating and securing a business service (balanced against your rights), legal obligations, or consent where required. Optional integrations require your authorization, which you can withdraw. Not providing required account information may prevent us from providing the relevant service.
4. Google sign-in and Calendar
Google sign-in provides your shared Aerobee identity. It does not grant Calendar access. Sign-in requests openid, email, and profile. We use your Google account identifier, email address, and basic profile to authenticate you and maintain your Aerobee account across Aerobee, Winroom, and Hydrobase. Sign-in does not authorize access to Gmail messages, Google Drive files, or Calendar events.
Connecting Google Calendar is a separate, optional authorization in Winroom. This connection requests openid, email, and https://www.googleapis.com/auth/calendar.events. The Calendar permission permits viewing and editing events on your calendars. Winroom uses it to create meetings you confirm, update or cancel meetings through the scheduling controls, create Google Meet links, and have Google send event invitations and updates to the attendees you specify. Basic identity information identifies the connected Google account.
For these actions, we process meeting titles, descriptions or agendas, start and end times, time zones, attendee addresses, and the event identifiers, Calendar links and conferencing details returned by Google. We store the connection credentials and event references needed to maintain the connection and manage those meetings. The current integration does not scan your calendars to determine availability and does not request Gmail inbox or Gmail send permissions. Google Calendar invitations are sent through Calendar, not by reading or sending from your Gmail inbox.
Limits that apply to all Google user data
Aerobee’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace API User Data and Developer Policy. The restrictions in this section apply to raw Google user data and aggregated, anonymized, or derived Google user data. They take precedence over any broader descriptions of analytics, AI processing, learning, sharing, or business transfers elsewhere in this policy.
We limit Google user data use to providing or improving the appropriate user-facing features you authorize and that are visible in the application. Google user data is not sold, used for advertising or data brokerage, used to assess creditworthiness or lending eligibility, or used to create, train, or improve foundational or generalized AI or machine-learning models. It is not used for cross-customer or cross-workspace model training, shared coaching patterns, or aggregate learning. An administrator’s learning setting or acceptance of our terms does not override these restrictions.
We do not transfer Google user data to an AI or other service for that service’s own model training or unrelated secondary purposes. Where an authorized feature requires a provider to process Google user data, that processing must be limited to the feature and use service terms and configurations that prohibit training foundational or generalized models with the data. Anonymizing or aggregating the data does not remove these restrictions.
Permitted transfers and human access
Google user data is transferred only as necessary to provide or improve an appropriate, visible user-facing feature with your consent; for security purposes such as investigating abuse; to comply with applicable law; or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent. Consent alone does not authorize a use or transfer prohibited by Google’s policies.
For example, booking sends the event details and chosen attendees to Google. Google distributes invitations to those attendees. Where enabled, our email-delivery service sends the meeting confirmation and join link to the intended recipient. Hosting and database services process information needed to operate these features. These transfers do not authorize advertising, resale, or generalized AI training.
Human access to Google user data is limited to your documented affirmative agreement to access specific data; necessary security investigation; compliance with applicable law; or aggregated and anonymized data used for internal operations as permitted by Google’s policies. General workspace-administrator access or permission to review AI diagnostics does not independently authorize access to Google user data outside these exceptions.
Before adding Google permissions or materially changing how we use Google user data, we will update the relevant disclosures and obtain the authorization required for that feature. See Section 7 for disconnection, revocation, retention, and deletion.
Winroom coaching and aggregate learning
For new Winroom workspaces under the current product terms, live coaching and aggregate learning from eligible phone calls are enabled by default. Workspace administrators can turn either off in Aerobee → Winroom settings. Separate per-rep learning opt-in is not required under this workspace policy. Existing explicit individual opt-outs remain effective. Existing workspaces retain their earlier permissions until an administrator adopts the updated policy; this update does not retroactively authorize previously excluded recordings.
Coaching uses the current transcript, evidence-linked call memory, relevant earlier customer interactions within the workspace, CRM context, company guidance, and feedback on previous advice. Relevant inputs are processed by the workspace’s configured AI provider. Authorized administrators can review eligible dynamic AI inputs and outputs for quality improvement, subject to the Google-data human-access restrictions in Section 4. Diagnostic records are retained for 14 days by default; administrators can select 1–90 days or disable retention. Disabling retention removes existing diagnostic records, and an automated process removes expired records.
Aggregate learning uses fixed sales-strategy categories, broad context categories, and confirmed business outcomes from eligible calls. Only statistics meeting minimum evidence and participation thresholds inform other workspaces’ coaching. Source calls, identities, recordings, transcripts, customer details, prompts, and generated wording are not disclosed to other workspaces. This feature does not train a general-purpose model. Google API data, including raw, aggregated, anonymized, and derived Google user data, and video-meeting transcripts are excluded from this shared-learning pipeline. These exclusions also apply to data carried into summaries, AI outputs, or diagnostic records; changing its format or source system does not make Google user data eligible for shared learning.
Turning learning off removes attributable workspace contributions and queued learning work from future aggregation. Deleting a call removes its coaching memory, cards, diagnostics, and learning contribution. These actions do not undo recommendations already delivered. Customers remain responsible for appropriate participant notices, permissions, and a lawful basis for recording and processing. These product terms do not substitute for consent where applicable law requires it. Contact our privacy address to exercise applicable individual rights.
6. Storage, security, and international processing
Information is held in the service databases, file storage, and connected infrastructure used to operate your workspace. We use measures such as HTTPS in production, password hashing, and role-based access controls. No system can guarantee absolute security; protect your credentials and report suspected misuse promptly.
Providers may process information in countries other than yours. Where applicable law requires safeguards for international transfers, those safeguards must apply to the relevant processing. Contact us for details concerning your workspace; we do not promise a particular data residency location unless separately agreed.
7. Retention, disconnection, and deletion
We retain account and workspace information for as long as needed to provide the services and fulfill the purposes described here. Retention depends on workspace activity, the type of record, customer instructions, support and security needs, and applicable accounting, legal, or dispute obligations. We do not currently promise one automatic retention period for all records. Google connection credentials are retained to operate the authorized connection, and event references and scheduling details are retained to display and manage your meetings. Google user data is not retained for advertising, generalized model training, or shared learning.
You can disconnect available integrations in the product and revoke Google authorization through your Google Account permissions. In Winroom, open Integrations, find Google Calendar, and choose Disconnect. This removes the Calendar connection and its stored tokens from our active connection records and stops future use of that connection; it does not automatically delete information already imported, meeting events in Google, CRM records, or other copies held by connected providers.
To request access, export, correction, deletion of stored Google-related data, account deletion, or workspace deletion, email our privacy contact from your registered address. Specify the connected Google email and the account, workspace, or meeting records concerned; do not send passwords or access tokens. We may verify your identity and authority and coordinate with your workspace administrator. We respond within the periods required by applicable law. Limited records may need to be retained for legal, security, or dispute purposes; backup copies may persist until replaced or expired and are not used for ordinary product activity.
8. Cookies and your choices
We use session cookies and browser storage needed to keep you signed in, secure requests, and remember relevant preferences. Blocking these may prevent sign-in or other features. This policy does not authorize advertising tracking; additional consent will be requested where required before introducing optional tracking.
Depending on applicable law, you may have rights to access, correct, delete, or obtain a copy of your information, object to or restrict processing, and withdraw consent without affecting prior lawful processing. You may complain to your local data-protection authority. Contact us to exercise these rights. If information about you was supplied by a customer or appears in Hydrobase research, include enough context to help us locate it without sending unnecessary sensitive information.
9. Business users and children
These services are intended for adults acting in a business or professional capacity, not children. If you believe a child has supplied personal information, contact us so we can investigate and address it.
10. Changes and contact
We will update the date on this page when this policy changes and provide additional notice of material changes where required. The current policy is available across all three websites. Questions or requests: suhaneshivam82@gmail.com.