Privacy Policy

Effective Date: 1 April 2026 Last Updated: 1 April 2026

At Pebbles Ai, we take the protection of your privacy seriously. You share your data with us so that we can help you build and execute effective go-to-market strategies. That is a privilege and a responsibility we do not take lightly.

This Privacy Policy describes what personal data we collect, how we use it, who we share it with, and your rights regarding your data. It applies to all users of our website (www.trypebbles.ai), our application (app.trypebbles.ai), and any related services (collectively, the "Service").

Please read this policy carefully. By using our Service, you acknowledge that you have read and understood the practices described below.

1. Data Controller

For the purposes of the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU 2016/679), and the Data Protection Act 2018, the data controller is:

GTMSAI Ltd 82 Wandsworth Bridge Road, London, United Kingdom, SW6 2TF Trading as Pebbles Ai

Data Protection Officer: data@trypebbles.ai

References to "GDPR" in this policy include both the EU GDPR and the UK GDPR as retained in UK law.

2. Who We Are

GTMSAI Ltd (trading as Pebbles Ai) provides an AI-powered Go-To-Market (GTM) intelligence platform designed for B2B success. Our platform helps businesses research prospects, create personalised outreach, manage contacts, and execute multi-channel campaigns.

We may also provide ancillary services such as training and support for our B2B clients.

3. Information We Collect

3.1 Information You Provide

We collect personal data when you register for an account, use our Service, contact us, or otherwise interact with us. This typically includes:

Full name
Email address
Company name and information
Job title
Postal address
Telephone number
Payment and billing information (processed by third-party payment providers — see Section 10)
Correspondence history (support tickets, emails, chat)
Any other information you voluntarily provide

3.2 Information We Collect Automatically

When you visit our website or use our application, we automatically collect:

IP address
Browser type and version
Operating system and platform
Pages visited, time and date of visit, time spent on pages
Referring URL
Unique device identifiers
Diagnostic and performance data

For mobile device access, we may additionally collect device type, mobile operating system, and mobile browser type.

3.3 Information from Third-Party Integrations

If you connect third-party services to Pebbles Ai (such as Google Workspace, LinkedIn, or your email provider), we may receive data from those services in accordance with the permissions you grant. See Section 8 for details on Google API data.

3.4 Information About Your Contacts

When you use Pebbles Ai to manage contacts or create outreach campaigns, you may upload or import contact information about third parties. You are responsible for ensuring you have a lawful basis to share this data with us.

3.5 Our Role: Data Controller and Data Processor

Pebbles Ai operates in two capacities depending on the type of data:

Data Controller: For data about your account, your usage of the Service, and your interactions with us (Sections 3.1, 3.2, 3.3). We determine the purposes and means of processing this data.
Data Processor: For customer-uploaded data such as contact lists, campaign content, and other data you provide for processing through the Service (Section 3.4). You remain the data controller for this data and are responsible for ensuring a lawful basis for processing. Our Data Processing Agreement governs this relationship.

4. How We Use Your Information

We use your personal data for the following purposes:

4.1 Service Delivery

To provide, maintain, and improve the Service
To manage your account and authenticate your identity
To process transactions and send related information (receipts, invoices)
To respond to your enquiries and support requests

4.2 Communication

To notify you about changes to our Service or policies
To send product updates, security alerts, and administrative messages
To send marketing communications (where you have consented or where we have a legitimate interest), which you can opt out of at any time

4.3 Analytics and Improvement

To analyse usage patterns and improve our Service
To conduct research, testing, and troubleshooting
To measure the effectiveness of our features and marketing

4.4 Security and Compliance

To detect, prevent, and address fraud, abuse, and security incidents
To comply with legal obligations
To enforce our Terms of Service and Acceptable Use Policy

We process your personal data under the following legal bases:

Legal Basis	Examples
Contract	Providing the Service you signed up for, processing payments, managing your account
Legitimate Interest	Improving the Service, fraud prevention, internal analytics, direct marketing to existing customers
Consent	Marketing communications to non-customers, cookie tracking (non-essential), connecting third-party integrations
Legal Obligation	Tax reporting, responding to lawful requests from public authorities

Where we rely on legitimate interest, we have conducted a balancing test to ensure our interests do not override your fundamental rights.

6. Cookies and Tracking Technologies

Our website and application use cookies and similar technologies (beacons, tags, scripts) to enhance your experience, analyse usage, and support marketing. For comprehensive information, see our Cookie Policy.

Category	Examples	Purpose
Essential	`__cf_bm` (Cloudflare), `pebbles_session`	Security, bot protection, session integrity
Analytics	`_ga`, `_gid` (Google Analytics), `_clck`, `_clsk` (Microsoft Clarity)	Usage analysis, heatmaps, session insights
Marketing	`__hssc`, `__hssrc`, `__hstc`, `hubspotutk` (HubSpot), UTM cookies	Campaign tracking, lead attribution
Functional	`slack_session_id`	Internal integrations

You can manage or disable non-essential cookies at any time via your browser settings or our cookie preference tool.

7.1 Service Providers (Sub-processors)

We share personal data with trusted third-party service providers who assist us in operating the Service. These providers process data only on our instructions and are bound by data processing agreements. See our Subprocessor List for a complete list.

Key service providers include:

Google Cloud Platform (GCP) — Infrastructure hosting (europe-west1, Belgium)
Stripe — Payment processing
HubSpot — Sales CRM and marketing automation
SendGrid — Email delivery
Google Analytics — Website usage analytics
Microsoft Clarity — User behaviour analytics (heatmaps, session replays)
Cloudflare — CDN, DDoS protection, bot management
Google Workspace — Internal business operations
Sentry — Error tracking and performance monitoring
Pusher — Real-time message delivery for streaming AI-generated content to users (EU cluster)
Anthropic — AI language model provider (Claude) for copilot and content generation features
OpenAI — AI language model provider (GPT) for copilot and content generation features
Google Cloud Vertex AI (Gemini) — AI language model provider (Gemini) for copilot and content generation features, hosted on GCP europe-west1
xAI — AI language model provider (Grok) for copilot and content generation features
Perplexity AI — AI-powered research and information retrieval
Weaviate — Vector database for AI-powered search and retrieval (Weaviate Cloud, EU — Frankfurt)

7.2 Business Transfers

If GTMSAI Ltd is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.

7.3 Legal Requirements

We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency), or where necessary to:

Comply with a legal obligation
Protect and defend the rights or property of GTMSAI Ltd
Prevent or investigate possible wrongdoing in connection with the Service
Protect the personal safety of users or the public
Protect against legal liability

We may share your information with third parties when you have given us explicit consent to do so.

8. Google API User Data

This section applies if you connect your Google Account to Pebbles Ai. It describes how we handle data obtained through Google APIs and our compliance with Google's policies.

8.1 Scopes We Request

When you connect your Google Account, we request only the minimum OAuth scopes necessary for the features you use:

OAuth Scope	Purpose	Data Accessed
`gmail.readonly`	Display your email conversations in the Pebbles Ai Smartbox	Email metadata and message content (read-only)
`gmail.modify`	Mark emails as read, archive, or label within Smartbox	Email state modifications
`gmail.compose`	Draft and send emails through your Gmail account via Pebbles Ai campaigns	Email composition and sending
`gmail.send`	Send campaign emails directly from your Gmail address	Outbound email delivery
`contacts.readonly`	Import your Google Contacts for recipient selection	Contact names and email addresses
`contacts.other.readonly`	Access "Other contacts" for more complete recipient lists	Auto-saved contact information

You explicitly approve each scope through Google's OAuth consent screen before we access any data.

8.2 How We Use Google User Data

Google user data is used solely to provide the in-product features you have requested.
We do not sell, rent, or trade Google user data.
We do not use Google user data for advertising, retargeting, or profiling.
We do not share Google user data with third parties, except as strictly necessary to deliver the functionality you requested (e.g., sending an email through Gmail's API). Where an AI-powered feature you have initiated processes Google user data (such as drafting an email reply or summarising inbox content in Smartbox), data may be transmitted to the AI service providers listed in our Subprocessor List for transient processing. These providers are contractually prohibited from retaining Google user data beyond the duration required to generate the response.
We do not combine Google user data with other data sources for marketing or profiling.
We do not allow humans to read Google user data unless (a) you have given affirmative consent, (b) it is necessary for security purposes such as investigating abuse, or (c) it is required by law.
We apply the principle of data minimisation, accessing and retaining only the data elements strictly necessary to deliver the functionality you have enabled.

8.3 AI/ML Disclosure

We do not use data obtained through Google Workspace APIs to develop, improve, or train generalised AI and/or ML models.

Google user data is processed solely to provide the in-product features you have requested (such as displaying your inbox in Smartbox, drafting campaign emails, or importing contacts). No Google user data is used for model training, fine-tuning, or any form of machine learning development.

8.4 In-Product Privacy Notifications

Whenever Pebbles Ai accesses your Google Account data, you will see clear in-product privacy notifications explaining:

What data is being accessed
For what purpose
How it will be used

These notices appear in the product at the time of access or collection.

8.5 Data Retention for Google Data

Active account: Google user data is retained for the duration of your active integration with Pebbles Ai, and only as needed to provide the features you have enabled. Email content displayed in Smartbox is fetched via the Gmail API; contact data imported from Google Contacts is stored in your Pebbles Ai account for the duration of the integration.
Revocation or disconnect: If you revoke Pebbles Ai's access from your Google Account settings or disconnect the integration within Pebbles Ai, all associated Google user data is permanently deleted from our systems within 30 days.
Account deletion: If you delete your Pebbles Ai account, all Google user data is permanently deleted within 30 days. Database backups containing Google user data are purged within 90 days. During the backup retention period, data is not accessible for operational purposes and is retained solely for disaster recovery. Backups are encrypted at rest and access is restricted to authorised personnel.

8.6 Revocation

You may revoke Pebbles Ai's access to your Google data at any time through either:

In-app: Navigate to Settings → Integrations → Google and click "Disconnect"
Google Account: Visit myaccount.google.com/permissions, find Pebbles Ai, and click "Remove Access"

Upon revocation, all Google user data is deleted from our systems as described in Section 8.5.

8.7 Limited Use Compliance

Pebbles Ai's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We limit our use of Google user data to providing or improving user-facing features that are prominent in the requesting application's user interface.

For sensitive or restricted Google API scopes, we undergo Google's verification process and, where required, independent security assessment (CASA Tier 2).

9. Artificial Intelligence and Machine Learning

Pebbles Ai uses artificial intelligence to power several features of the Service, including:

AI Copilot — Assists users with research, strategy, and content generation
Tactical Outreach — Generates personalised outreach messages
Research Agents — Gather publicly available information about prospects and organisations
Content Intelligence — Evaluates and improves communication quality

9.1 What Data Feeds AI Features

Our AI features process the following types of data to generate outputs:

Information you provide directly (e.g., prompts, instructions, campaign parameters)
Your contact and organisation data stored in Pebbles Ai
Publicly available information gathered by research agents
Email content and metadata, when you have connected your email integration and are using Smartbox or campaign features

9.2 How AI Processes Your Data

AI outputs are generated for your use within the Service and are not shared with other users or customers.
We do not use your individual content, emails, or customer data to train generalised AI or machine learning models.
We may use aggregated, anonymised usage patterns (such as feature adoption rates and general usage statistics) to improve the Service. This aggregated data cannot be used to identify any individual user.

9.3 Third-Party AI Providers

Our AI features utilise multiple third-party large language model providers, including Anthropic (Claude), OpenAI (GPT), Google Cloud Vertex AI (Gemini), xAI (Grok), and Perplexity AI. The specific provider used may vary by feature and task. Data sent to these providers is governed by data processing agreements that prohibit them from using your data for their own model training. Data is transmitted securely via encrypted connections. Providers may retain data for limited periods for abuse monitoring and safety purposes, as governed by our data processing agreements with them, but do not use it for model training or improvement.

AI features also utilise a vector database (Weaviate Cloud, hosted in the EU — Frankfurt, europe-west3) to store embeddings derived from user content for semantic search and retrieval. Weaviate is a third-party subprocessor bound by a data processing agreement; see our Subprocessor List for details.

9.4 Automated Decision-Making

Our AI features are designed to assist you and do not make automated decisions that produce legal effects or similarly significant effects on you or your contacts. All AI-generated content (such as outreach messages, research summaries, and campaign suggestions) is presented as suggestions for your review and approval before use.

10. Payments

We use third-party payment processors to handle billing. We do not store or collect your payment card details. Payment information is provided directly to our payment processors, who adhere to PCI-DSS standards.

Our payment processor:

Stripe — Stripe Privacy Policy

11. International Data Transfers

Your data is primarily stored and processed on Google Cloud Platform in the europe-west1 (Belgium) region within the European Economic Area (EEA).

In some cases, data may be transferred to, or accessed from, destinations outside the EEA — for example, by service providers or team members located internationally. Where this occurs, we apply appropriate safeguards to ensure your data remains protected:

Standard Contractual Clauses (SCCs) approved by the European Commission
UK International Data Transfer Agreement (IDTA) addendum where applicable
Data processing agreements with all sub-processors
Due diligence on the data protection practices of recipients

Where data is transferred to countries outside the EEA that do not benefit from an adequacy decision, we conduct Transfer Impact Assessments to evaluate the level of data protection in the recipient country and implement supplementary measures where necessary.

We do not transfer data outside the EEA without appropriate safeguards in place.

12. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law.

Data Type	Retention Period
Account data	Duration of account + 30 days after deletion
Google user data	Duration of integration + 30 days after disconnect/deletion
Usage/analytics data	Up to 26 months (aligned with analytics tool defaults)
Marketing email data (HubSpot)	Up to 3 years from consent, or until unsubscription
Payment records	As required by tax and financial regulations (typically 7 years)
Support correspondence	Duration of account + 12 months
Database backups	Purged within 90 days of data deletion

During the backup retention period following data deletion, your data is not accessible for operational purposes and is retained solely for disaster recovery. Backups are encrypted at rest and access is restricted to authorised personnel.

For full details, see our Data Retention and Deletion Policy.

When you delete your account, there is a 20-day grace period during which you may cancel the request and restore your account. After this period, permanent deletion begins and your personal data is removed from our primary systems within 30 days of the original request. We retain data beyond this period only where required for legal, tax, or regulatory purposes.

13. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

Encryption at rest: All data stored in Google Cloud SQL is encrypted using AES-256 with Google-managed encryption keys
Encryption in transit: All data transmitted between you and our Service, and between our internal services, uses TLS 1.2 or higher
Access controls: Role-based access control (RBAC) with the principle of least privilege
Infrastructure security: Google Cloud Platform provides ISO 27001, SOC 2, and SOC 3 certified infrastructure
Monitoring: Security event logging, intrusion detection, and regular vulnerability assessments

While we strive to protect your personal data using commercially acceptable means, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents in accordance with our Incident Response Policy.

13.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, in accordance with GDPR Article 34. If the breach involves Google user data, we will also notify Google in accordance with the Google API Services Terms of Service.

14. Your Rights

If you are in the European Economic Area or United Kingdom, you have the following rights:

Access — Request a copy of the personal data we hold about you
Rectification — Request correction of inaccurate or incomplete data
Erasure — Request deletion of your personal data where there is no compelling reason for continued processing
Restriction — Request that we restrict processing of your personal data
Portability — Request transfer of your personal data to another party in a structured, machine-readable format
Objection — Object to processing based on legitimate interests or direct marketing
Withdraw Consent — Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
Complaint — Lodge a complaint with a supervisory authority

To exercise any of these rights, contact our Data Protection Officer at data@trypebbles.ai. We will respond within 30 days.

A subject access request submitted to our Data Protection Officer will not incur a fee, as required by the GDPR.

14.2 Rights Under CCPA (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know — Request disclosure of the categories and specific pieces of personal information we have collected about you
Right to Delete — Request deletion of personal information we have collected from you
Right to Opt-Out — Opt out of the sale or sharing of your personal information. We do not sell your personal information. Our use of analytics cookies (such as Google Analytics and Microsoft Clarity) is solely for internal analytics purposes and does not constitute "sharing" for cross-context behavioural advertising under the CPRA.
Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights
Right to Correct — Request correction of inaccurate personal information

To exercise your CCPA rights, contact us at data@trypebbles.ai.

15. Contact Forms and Email

If you contact us using a form on our website, the data you provide will be forwarded to HubSpot, our CRM and marketing automation provider (a third-party data processor). If you contact us via email, your data will be processed through Google Workspace.

If you subscribe to our email newsletter, your email address will be stored in HubSpot. Your email address will remain in HubSpot's database for up to 3 years from the date of your consent, or for as long as we use HubSpot for email marketing, or until you request removal.

Email marketing campaigns may contain tracking for opens, clicks, forwards, and engagement frequency. This information helps us provide more relevant content.

You can unsubscribe at any time using the unsubscribe link in any newsletter, or by emailing data@trypebbles.ai.

17. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on this page and updating the "Last Updated" date. Where required by law, we will notify you by email.

We encourage you to review this policy periodically.

19. Contact

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact: