Privacy Policy

Payments are handled by Stripe or another disclosed payment provider. When you pay through Stripe Checkout or a Stripe-hosted flow, Stripe collects and processes payment information under its own terms and privacy practices. Tomako receives limited payment metadata needed to confirm checkout, manage access, provide support, prevent fraud, process refunds, and keep financial records.

Tomako uses AI-assisted workflows to help users turn product context into names, positioning, launch materials, research summaries, visual prompts, checklists, and other GTM outputs. To provide these features, user inputs and outputs may be sent to AI model providers, automation providers, storage providers, or infrastructure vendors.

Unless we separately state otherwise or you intentionally provide feedback for improvement, Tomako does not use private workspace content to train Tomako-owned foundation models. We may use aggregated, de-identified, or operational data to improve reliability, safety, abuse prevention, and product experience.

Third-party AI providers may process submitted content to provide the requested service, maintain security, and comply with their own legal obligations. Their processing may be governed by their own terms, privacy practices, and data-processing settings.

Tomako Browser connects your local Chrome browser to your Tomako cloud agent for tasks you request. Pairing is optional. Before connecting, the extension displays a data disclosure and asks for your agreement. By default the agent operates in task-created tabs; you may separately authorize an existing tab. Connecting does not automatically authorize all your open tabs.

During a task, authorized-page URLs, titles, text, page structure, screenshots, action instructions and results are transmitted over an encrypted connection to Tomako. Depending on the pages you authorize, this may include names and contact details, messages, financial or health information, location, browsing activity, form entries and authentication information present on those pages. Task scripts can read page-accessible cookies and web storage, and those values may be included in task results. The extension does not request Chrome's cookies or browsing-history API permissions and does not provide a Chrome password-vault reader; these limits do not prevent an authorized webpage's readable identity or login information from being processed.

The debugger permission supports reading, clicking, typing, scrolling and capturing authorized pages. Tabs and tabGroups support task-tab management and identification. Storage keeps the connection credential on your device. Alarms maintain the connection and clean up expired tasks. The extension uses your existing website sessions to perform requested actions; it does not require you to enter website passwords into the extension.

The sidePanel permission displays your Tomako conversation and connection controls. Access to the official tomako.ai and test.tomako.ai domains allows the side panel to reuse your Tomako web sign-in; it does not authorize background reading of unrelated websites. Opening the side panel or switching tabs does not automatically read page text or capture a screenshot. When you send a side-panel message, the current tab's URL, title, tab and window identifiers and capture time are sent to Tomako with the message to identify the page you mean. URLs may contain query parameters or other page information. This page context does not authorize control of all open tabs. Messages you send, attachments you upload and task results are processed by Tomako and the providers needed to deliver the task.

The extension and embedded conversation store the selected conversation path and recoverable unsent drafts on your device. Sent messages, uploaded attachments and generated results are stored by Tomako under the retention terms below. Each Chrome profile has one active environment connection; explicitly pairing to another environment replaces that connection, while extension updates retain the saved environment.

Browser-task data is used only to execute the browser tasks you request and to operate, secure and measure the reliability of that feature. Task content is processed by the AI model and infrastructure providers needed to deliver your task. These browser-specific restrictions also apply to derived, aggregated or de-identified browser-task data, and take precedence over broader statements elsewhere in this policy.

We do not sell browser-task data, use it for advertising or creditworthiness or lending decisions, transfer it to data brokers, or use it to train generalized AI models. We limit transfers to providers necessary for this feature, legal compliance, protection against fraud or abuse, or a merger, acquisition or asset sale after your explicit prior consent. Human access is limited to your explicit consent to read specific data, security investigations, legal requirements, or aggregated and anonymized data for permitted internal operations.

Tomako Browser's use and transfer of user data, including information received from Google APIs, adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Pairing information is single-use and expires after five minutes. The extension stores a connection credential locally; the server validates and rotates it. Clicking Disconnect removes that local credential and, when connected, asks the server to revoke it. If the device is offline, server-side revocation cannot be immediate. Takeover pauses subsequent agent actions; an action already in progress may finish. Disconnecting or uninstalling stops local extension access but does not erase existing cloud task records or changes already made on websites.

Task inputs, outputs and relevant browser results may remain in conversation records, agent session records, generated deliverables and operational logs. Removing a conversation from the visible interface does not by itself erase every stored copy. We retain records for the service and security purposes described above and any applicable legal obligations; this version does not promise automatic deletion after a fixed number of days.

To request access to or deletion of browser-task data, contact info@tomako.ai with the Tomako account and relevant task information. We verify the request and handle applicable task, account and provider-held records, subject to legal and security retention requirements. Please do not email pairing credentials or website passwords. Removing data from Tomako does not remove data held independently by websites you visited.

Gmail access is optional and begins only when you explicitly connect your Google account. Tomako requests Gmail send and read permissions to send emails you review and approve or explicitly instruct the Agent to send, continue those conversations in the same thread, and synchronize replies into the outreach workspace they belong to (creator outreach or investor contacts).

Tomako requests only Gmail threads that Tomako created for the applicable outreach. We store the connected account email, OAuth tokens encrypted at rest, provider thread and message identifiers, outbound text you reviewed or explicitly instructed the Agent to send, and, for external replies, the sender, subject, timestamp, and plain text limited to 20,000 characters per message. We do not display raw HTML or attachments and do not scan arbitrary mailbox threads.

Google user data is not sold; used for advertising, data-broker, credit, or lending purposes; or used to train generalized or personalized AI models. To provide features you use, such as showing a reply in your language, tracking where a conversation stands, or having the Agent summarize a reply or draft a response to it, the relevant message content is sent to our AI model providers only to produce that result for you. Otherwise it is transferred only to infrastructure providers needed to operate and secure the integration, when you consent, or when required by law.

You can remove a product or employee's access to a connected mailbox without disconnecting other uses of that account. Disconnecting the account connection disables its use across Tomako; you can also revoke Tomako's Google authorization in your Google Account's third-party connections settings. Disconnecting access does not delete existing correspondence. Deleting a creator-outreach project removes that project's mailbox bindings, outreach messages, inbound replies, and creator candidates, but does not revoke a shared account authorization used elsewhere. You may request account or personal-information deletion at support@tomako.ai. We retain data only as long as needed to provide and secure the service or meet legal obligations.

Tomako's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Tomako uses YouTube API Services to help users discover creators and review public channel and video information. We retrieve public channel identifiers, names, descriptions, thumbnails, channel links, subscriber counts, and public video identifiers, titles, publication dates, links, view counts, likes and comment counts. Creator discovery accesses public data using our server-side API credentials; it does not require access to a user's private YouTube account or YouTube password.

We use this information to respond to discovery requests, present supporting channel and video references, and maintain creator records. Relevant public metadata and the user's brief may be processed by our AI and infrastructure providers to produce recommendations. These providers process information to deliver the requested service as described in the Service providers and sharing section. Tomako recommendations are produced by Tomako and are not recommendations or endorsements by YouTube.

You may contact support@tomako.ai to request deletion of your Tomako account, personal information, or creator information stored by Tomako. Please identify the relevant account or channel URL so that we can locate the records and verify the request. Deleting data held by Tomako does not delete content from YouTube. Google handles information under the Google Privacy Policy linked below. If you connect a Google account for a separate optional integration, you can also revoke its access through Google's permissions page.

We may share information with vendors that provide hosting, storage, analytics, email delivery, payment processing, customer support, security, fraud prevention, logging, and AI processing. These providers are permitted to use information only to provide services to Tomako or as required by law.

We may also disclose information if required by law, to protect rights and safety, to investigate fraud, security, or abuse issues, to respond to payment disputes, or as part of a merger, acquisition, financing, or sale of assets.

We may use cookies, local storage, and analytics tools to keep the site working, remember preferences, measure usage, improve performance, attribute product flows, and protect against abuse. You can control cookies through your browser settings, but some features may not work without necessary storage.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. No online service can guarantee absolute security, so you should protect your account credentials, avoid sharing login links, and avoid submitting sensitive information that is not needed for the service.

We keep information for as long as needed to provide the service, operate accounts, deliver paid access, comply with legal and tax obligations, resolve disputes, enforce agreements, prevent abuse, and protect the service. You may request deletion of your account or personal information by emailing support@tomako.ai. Some records may need to be retained where required by law or for legitimate security, billing, fraud-prevention, or dispute reasons.

Tomako uses service providers that may process information in different jurisdictions from where you live. By using Tomako, you understand that information may be transferred to and processed in countries where we or our service providers operate, subject to applicable law.

Tomako is not directed to children under 13 and is intended for builders, founders, creators, and business users. If you believe a child has provided personal information to Tomako, contact us so we can take appropriate action.

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to certain processing of personal information. Email support@tomako.ai and we will respond according to applicable law.

We may update this policy as Tomako changes. The latest version will be posted on this page with the last updated date.