What we do with your data, and what we don't.

Trust at Gohvio

Gohvio checks your revenue data against rules you set, and shows you the records behind every finding. You're trusting us with your CRM and your spreadsheets, so this page says plainly what we do with them, what we don't do, and what we haven't done yet.

Gohvio is an early-stage company. We don't hold SOC 2 or any other security certification, and we haven't had an independent security audit. Everything on this page describes how the product works today. If something here stops being true, we'll change this page.

Most of these are architectural: the product cannot do them. Where the guarantee is a commitment rather than a constraint, we say so.

Sell, rent or trade your data

We have never done this and it is not part of any business model we are considering. The vendors who process your data on our behalf (hosting, database, email, billing and the AI model) are listed below, and we give 30 days' notice before adding one.

How we handle your data

Files you upload

• Your uploaded file is deleted from our server's disk as soon as it has been read.
• The data from it is held in our server's memory while you work. It is cleared automatically after 24 hours without activity, or sooner if the server restarts.
• If a file is open and you're inactive for 30 minutes, the app signs you out and locks the file to your login. Sign in again on the same browser to pick up where you left off, unless the server has restarted. It doesn't shorten the 24 hours on our server.
• We keep a record of each upload for 13 months: its size, its row and column count, and a one-way fingerprint of the file. Never the file name, the column headers or the contents.
• We keep scan results for 13 months: rule names, severity, counts, dollar totals, and the IDs and row numbers of flagged records. Never any other cell values.
• Exports you download are deleted from our server after the download.
• Edits you make in Gohvio change Gohvio's working copy only. Your original file is never changed.
• Rules you save are stored until you delete them. Policy statements imported from a document are stored until you ask us to delete them.
• If your company is on a shared workspace plan, colleagues in your company's workspace can see its saved rules. Shared workspaces are set up by us, not self-serve.

Connected CRMs

• Read-only today. Gohvio reads your CRM and does not write to it.
• Gohvio never issues a write call. With HubSpot we request read-only scopes. Salesforce has no read-only API scope, so we request the minimum it offers and enforce read-only in our own code and through your user's object permissions. We do not request full or web.
• If you want Salesforce itself to enforce read-only, connect with a Salesforce user whose profile has read-only access.
• Each check reads your CRM, works in memory, and returns counts plus up to five example records. We don't save your CRM records.
• We store the connection keys (OAuth tokens) so the connection stays live.
• Disconnecting purges the OAuth token. If you upload a file instead, we delete it from disk as soon as we have read it, and clear the working copy from memory after 24 hours of inactivity.

Your account

• We keep your name, email, company, plan and usage so we can run your account and bill you.
• Your job title is optional. If you have not typed one, we copy it from our own HubSpot record of you when you sign in. If you type one and that record already has a title, we keep HubSpot's, in the app too; if it has none, we add yours there. We never create a HubSpot contact from a job title.
• To delete your Lumi questions or your job title, email [email protected]. We handle these requests by hand for now.

What does Gohvio record when I use the app?

Inside the signed-in app we run our own usage analytics. Nothing goes to a third-party analytics tool.

• We use it to show your company how its team uses Gohvio, and to improve the product.
• Your sessions, the pages and tabs you view, the buttons and links you click, your signed-in email, and your browser and device details with a short code worked out from them.
• Your Lumi questions, scrubbed as described under AI and Lumi, and the first 200 characters of any Lumi answer you rate.
• After 90 days, the link between these records and you is removed.
• It is part of how the app works, so it is not switched off by your browser's Do Not Track setting.

AI and Lumi

This depends on how you connect. A CRM scan sends counts and summaries only. A file you upload or attach sends rows.

• Gohvio's checks are rules, not AI guesses. Once your data is in, the same rules give the same verdict. Checks that use dates, such as a close date in the past, use today's date, so their results change as time passes.
• Lumi, our assistant, uses Anthropic's Claude models through Anthropic's commercial API. So does the feature that turns a policy document into rules.
• From a connected CRM, Anthropic receives counts and check summaries, not record contents.
• Up to 50 rows of your file, including names and contact details. Columns holding card, bank or government ID numbers, passwords, dates of birth or sensitive categories such as health are left out. We detect these by column name and pattern, so something typed inside a free-text Notes column can still reach the model. With more than one file loaded, Lumi also sees Gohvio's comparison of them: file, column and guardrail names, record counts and dollar totals, not the other files' rows. PDFs and images you attach are sent as they are.
• A policy document you import is sent in full so rules can be drafted from it.
• Your saved rules and their results: what each checks, whether it passed, and the counts and dollar totals.
• Your Lumi conversations are saved so you can return to them. Only you can see them. Delete one and it is removed for good 30 days later.
• When you tell Lumi to remember something, or save a definition, that confirmed fact is shared with your workspace.
• AI wording varies, and Lumi can be wrong. Check the records it points to. Rules drafted from a policy document can differ from one import to the next, so review them before you save.

What Lumi does not receive

• Anything from a system you have not connected or a file you have not uploaded.

What we keep

We delete your uploaded file from disk the moment we have read it, and clear the working copy from memory after 24 hours of inactivity.

We save the questions you ask Lumi on our server, up to 1,000 characters each, with who asked, the topic and your job title. Before a question is saved, email addresses, phone numbers, card numbers and street addresses that can be detected are removed. A name written into a sentence stays.

After 90 days we remove your email address. On a team workspace we also remove your job title, and the question stays linked to your company's workspace. On a personal workspace that link goes too, and the job title stays. The question text itself is kept indefinitely, and our billing records still show who used Lumi and when.

Gohvio's founder can read questions with the asker's email address and job title, to understand what people need from the product. Every such read through the app is logged. To have your questions deleted, email [email protected].

Lumi runs on Anthropic's API. Their commercial terms prohibit training on what we send. We have not agreed a zero-retention term with Anthropic, so we do not claim one.

Security practices

What we do today

• Everything is encrypted in transit. Our website and app are served over HTTPS, and plain HTTP is redirected.
• You sign in with Google or with a one-time email link, handled by Supabase Auth. Gohvio doesn't store app passwords.
• Payments are handled by Stripe. Gohvio never sees your full card number.
• CRM connection keys are encrypted with AES-256-GCM before they are stored, with the key held outside the database. Connections made before we shipped this are re-encrypted the first time they are used.
• When the founder opens a customer's data in our admin console, it is written to an append-only log. That log covers our application; direct database access at our hosting provider is covered by their audit log, not ours.
• When the founder reads Lumi questions through the app, each read is logged.

What we haven't done yet

• SOC 2 or any other certification.
• An independent penetration test.
• Self-serve account deletion. Email us and we'll do it for you.

Subprocessors

These are the companies that process data on Gohvio's behalf to run the service. We'll give 30 days' notice before adding a new subprocessor that handles customer data.

Services you choose to connect, such as HubSpot, Salesforce or Outreach, are your providers, not our subprocessors. Gohvio reads from them with your permission.

Read the full subprocessor list

Compliance, honestly

We don't hold SOC 2, ISO 27001 or any other certification, and we don't describe Gohvio as 'GDPR compliant' or 'CCPA compliant'. Those are legal obligations, not badges.

What we can do today

• Answer your security questionnaire.
• Walk you through this page with the evidence behind it.

Report a vulnerability

Email [email protected]. Please include the steps to reproduce. Please don't access or change other people's data, and don't disrupt the service. We'll confirm we've received your report, and we'll tell you what we've done about it.

Read how to report a security problem

Legal

The documents that govern how Gohvio works with you. Plain English first, legal detail inside.