Privacy Policy

This Privacy Policy ("Policy") describes how Mapo Labs, Inc. ("Company," "we," "us," or "our") collects, uses, discloses, and safeguards information when you use our website and Tomo service (the "Service"). By using the Service, you agree to the practices described in this Policy. If you do not agree, please discontinue use of the Service.

This Policy also applies to people who take part in a Group Chat that includes Tomo, even if they have not created an Account. Section 18 explains how Group Chats work.

1. Interpretation and Definitions

1.1 Interpretation

Words with initial capital letters have meanings defined in this section. The following definitions apply whether they appear in singular or plural.

1.2 Definitions

• Account: A unique account created for you to access the Service or parts of it.
• Affiliate: An entity that controls, is controlled by, or is under common control with a party; "control" means ownership of 50% or more of voting securities or equivalent rights.
• Cookies: Small files placed on your device by a website, often used to track activity and remember preferences.
• Jurisdiction: United States; primary governing state: California.
• Device: Any device that can access the Service (e.g., computer, smartphone, tablet).
• Group Chat: A group conversation (for example, an iMessage group) that includes Tomo, whether someone added Tomo to it or Tomo started it at a user's request.
• Group Participant: Any person in a Group Chat other than Tomo, whether or not that person has an Account.
• Personal Data: Any information that relates to an identified or identifiable individual.
• Service: The Tomo service, including the website and any related apps or interfaces.
• Service Provider: Any natural or legal person who processes data on behalf of the Company.
• Usage Data: Data collected automatically, generated by use of the Service or the Service infrastructure (e.g., page visit duration).
• Website: The Tomo website at https://www.tomo.ai.
• You: The individual using the Service, or the company/other legal entity on whose behalf such individual is using the Service, as applicable.

2. Information We Collect

2.1 Personal Data

We may collect Personal Data that you provide to us, such as:

• Email address
• First and last name
• Phone number
• Any user-generated content you submit through the Service

We may also receive Personal Data about you from other people. For example, when you are a Group Participant, we receive your messages, attachments, name, phone number or other messaging handle, and group membership changes, and other participants may tell Tomo about you. A user may also give Tomo your phone number or email address so that Tomo can start a Group Chat with you. See Section 18.

2.2 Usage Data

Collected automatically and may include:

• IP address, browser type/version, device identifiers
• Pages visited, timestamps, and time spent
• Mobile OS, mobile browser, and diagnostic data

3. Tracking Technologies and Cookies

We use Cookies, web beacons, tags, and scripts to track activity and improve the Service.

• Cookies or Browser Cookies: You can set your browser to refuse Cookies or alert you when Cookies are being sent. Some features may not function without Cookies.
• Web Beacons: Small electronic files in pages or emails that help count users, measure popularity, and verify system integrity.

Cookie Types

• Necessary/Essential (Session; administered by us): Authenticate users and prevent fraud.
• Notice Acceptance (Persistent; administered by us): Record Cookie consent.
• Functionality (Persistent; administered by us): Remember preferences (e.g., login, language).
• Advertising/Targeting (Persistent; administered by us and our advertising partners, including Meta, TikTok and Snap): Measure advertising effectiveness, attribute conversions to ad campaigns, and support cross-context behavioral advertising. Examples include _fbp, _fbc (Meta), _ttp (TikTok) and _scid (Snap). These cookies are not set on /privacy or /terms pages.

4. How We Use Your Information

We may use Personal Data to:

• Provide, operate, and maintain the Service (including monitoring usage).
• Manage your Account and provide registered-user features.
• Perform and enforce contracts, including purchases of products or services.
• Contact you via email, phone, SMS, or push notifications for updates and security notices.
• Provide you with news, offers, and information about similar goods/services unless you opt out.
• Manage and respond to your requests.
• Evaluate or conduct business transfers (e.g., merger, acquisition, asset sale).
• Perform data analysis, identify trends, measure campaign effectiveness, and improve the Service.
• Provide Group Chat features, including remembering group context and showing connections between people who share a Group Chat (see Section 18).
• Integrate with Google services (see Section 16). We use Google APIs per Google's API Services User Data Policy and do not use Google Workspace data to develop, improve, or train generalized AI/ML models.
• Comply with legal obligations and enforce our agreements, including fraud prevention, security, and incident response.

5. How We Share Your Information

We do not sell your Personal Data. We may share information:

• With Service Providers: To operate, analyze, and support the Service or to contact you. This includes providers of the artificial intelligence (AI) models that generate Tomo's responses, which process your conversations, including Group Chats, on our behalf.
• For Business Transfers: In connection with or during negotiations of a merger, sale, financing, or acquisition.
• With Affiliates: Subject to this Policy (e.g., parent, subsidiaries, joint ventures).
• With Business Partners: To offer products, services, or promotions.
• With Other Users: When you share information in public areas, and with other Group Participants as described in Section 18.
• With Your Consent: For any other purpose you authorize.

The sharing described in this section does not include your mobile number or text messaging consent. See Section 19.

Authorized members of our team may review conversations with Tomo, including Group Chats, to provide support, investigate problems, keep the Service safe, and improve it.

6. Analytics, Logs & Advertising Tech

We use analytics and logging tools (e.g., product analytics, performance monitoring, and crash reporting) to understand usage, improve reliability, and secure the Service. These tools may set Cookies and collect identifiers and usage events. The identifiers may include contact details, such as a phone number or email address, including for Group Participants who do not have an Account.

We use advertising and conversion-measurement technologies provided by Meta Platforms, Inc. (Facebook/Instagram), TikTok Pte. Ltd. and Snap Inc. (Snapchat) on our public marketing pages. These technologies set first-party Cookies (e.g., _fbp, _fbc, _ttp, _scid) and transmit information such as IP address, user agent, page URL, and referral parameters to those providers so that we can measure advertising performance and attribute conversions to ad campaigns. We do not load these technologies on our privacy policy or terms pages, or on signed-in product pages.

We do not "sell" Personal Data for monetary consideration. We may "share" Personal Data for cross-context behavioral advertising as those terms are defined by California law (Cal. Civ. Code § 1798.140), specifically by transmitting visitor identifiers and interaction data to Meta, TikTok and Snap for ad measurement and targeting. California residents have the right to opt out of this sharing. To exercise this right, contact us at hello@tomo.ai with the subject line "Do Not Share My Personal Information." You may also opt out at the platform level by adjusting your Meta, TikTok and Snapchat ad-personalization settings.

7. Retention of Personal Data

We retain Personal Data only for as long as necessary to fulfill the purposes described in this Policy, including to comply with legal obligations, resolve disputes, and enforce our agreements.

Usage Data is typically retained for shorter periods of time, unless it is required to maintain the security of the Service, improve functionality, or comply with applicable law. When Personal Data is no longer needed, we will securely delete or anonymize it.

8. International Transfers of Personal Data

Your information, including Personal Data, may be processed and stored at the Company's operating offices and in other jurisdictions where our Service Providers are located. These jurisdictions may have data protection laws that differ from those in your country of residence.

By submitting Personal Data, you consent to its transfer to and processing in jurisdictions outside of your home country. We will take reasonable measures to ensure your Personal Data is treated securely and in accordance with this Privacy Policy, including requiring adequate safeguards where applicable.

9. Your Rights to Access and Delete Data

You have the right to request access to, correction of, or deletion of your Personal Data that we hold about you.

The Service may allow you to update or delete certain information directly within your account settings. You may also contact us to request changes or deletions.

To request complete deletion of your Personal Data, you may submit our data deletion form. We will delete associated Personal Data within 30 days, subject to retention obligations described in Section 7.

Please note that certain information may need to be retained where we have a legal obligation, a legitimate business interest, or to prevent fraud and abuse.

Regional rights. Depending on your location (e.g., EEA/UK, certain U.S. states), you may have additional rights: access/portability, correction, deletion, restriction, objection, and the right to opt out of targeted advertising or profiling. You may also have the right to appeal a decision or lodge a complaint with a supervisory authority.

10. GDPR Legal Bases

Where the GDPR/UK GDPR applies, we process Personal Data on the following legal bases: (i) performance of a contract (providing the Service), (ii) legitimate interests (e.g., security, fraud prevention, product improvement, communications about similar services), (iii) consent (where required, e.g., certain marketing), and (iv) legal obligations. For Group Participants who do not have an Account, we process Personal Data on the basis of legitimate interests: providing the Service that the Group Chat's members asked for, and keeping it secure.

11. Disclosure of Personal Data

Business Transactions

If the Company is involved in a merger, acquisition, financing, or sale of assets, your Personal Data may be transferred as part of that transaction. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement and Legal Requests

We may disclose Personal Data if required to do so by law or in response to valid requests by public authorities (e.g., courts, regulators, government agencies).

Other Legal Grounds

We may disclose Personal Data where we believe such action is reasonably necessary to:

• Comply with a legal obligation
• Protect and defend the rights, property, or safety of the Company
• Prevent or investigate potential wrongdoing related to the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability or fraudulent activity

12. Security of Personal Data

We use commercially reasonable technical and organizational measures to protect your Personal Data. However, no method of transmission over the Internet or method of electronic storage is completely secure.

Accordingly, while we strive to protect your information, we cannot and do not guarantee the absolute security of Personal Data. You are responsible for maintaining the security of your account credentials and limiting unauthorized access to your devices.

13. Security Incidents

If we become aware of a security incident that affects your Personal Data, we will investigate and, where required by law, notify you and/or regulators without undue delay, including providing information about steps you can take to mitigate potential harm.

14. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect Personal Data from children under 13. If we become aware that we have collected such data without verified parental consent, we will promptly delete it.

Please do not add Tomo to a Group Chat that includes children under 13. If we learn that a Group Participant is under 13, we will delete the Personal Data we hold about that child as soon as reasonably practicable.

If you are a parent or guardian and believe your child has provided us with Personal Data, or that your child is in a Group Chat with Tomo, please contact us. Where applicable law requires parental consent for minors, we may request such consent before collecting or using Personal Data.

15. Links to Other Websites

The Service may contain links to third-party websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly encourage you to review the privacy policy of every site you visit.

We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

16. Use of Google User Data and Artificial Intelligence

We use Google Workspace APIs (e.g., Gmail, Google Drive, Google Calendar) solely to provide features directly requested by users. Any personal data accessed from these APIs is only processed as needed to complete that request and is never used to develop, train, or improve any machine learning or artificial intelligence (AI) model—whether our own or any third party's.

Tomo complies with the Google Workspace API User Data and Developer Policy. We affirm that:

• We do not use user data returned from Google Workspace APIs to train or improve any generalized or non-personalized AI/ML models.
• We do not allow any third-party AI services, to train on user data obtained from Google Workspace APIs.
• All data processing is specific to fulfilling a request made to Tomo, including the Group Chat scheduling requests described below, and no Workspace data is used beyond that scope.

If you connect Google Calendar and are in a Group Chat, Tomo may check your calendar's busy times when members of that Group Chat ask Tomo to help schedule something, and may create or update events on your calendar for that Group Chat. Tomo shares only when you are busy with the group, not the details of your events. To stop this, disconnect Google Calendar or leave the Group Chat.

You may revoke access to Google services at any time via your Google Account permissions page.

17. Apple Health and HealthKit Data

17.1 What We Collect

With your explicit consent, Tomo collects health and fitness data from Apple HealthKit. Depending on the permissions you grant, this may include data such as activity and workouts, steps and distance, energy expenditure, sleep, heart rate, body measurements (e.g., height and weight), and related fitness metrics. We only access the specific HealthKit data categories you authorize, and you can review or change these permissions at any time in the Apple Health app or your device settings.

17.2 How We Use Your Health Data

Health data you authorize is transmitted to and stored on Tomo's servers so that your personal AI agent can use it to provide the Service. Specifically, we use your health data to:

• Power your personal AI agent so it can keep you accountable and track your progress over time.
• Generate personalized coaching, insights, summaries, and proactive reminders based on your activity, sleep, and other authorized metrics.
• Maintain continuity across your conversations so the agent can reference past trends and goals.

17.3 How We Share Your Health Data

• We do not sell your health data.
• We do not use your health data, or data derived from it, for advertising, marketing, or any cross-context behavioral advertising.
• We do not share your health data with third parties for their own advertising or data-mining purposes.
• We do not use your health data to train or improve generalized or non-personalized AI/ML models.
• We do not intentionally disclose your health data to other participants in a Group Chat. We take steps designed to keep health information out of Group Chats (see Section 18.4).

We may process health data only through Service Providers that host or operate infrastructure on our behalf, and only as needed to deliver the Service to you, subject to confidentiality and security obligations. Our use of Apple HealthKit data complies with Apple's HealthKit and App Store requirements.

17.4 Your Controls

You may disconnect Apple Health at any time in the app settings or by revoking permissions in the Apple Health app, after which we will no longer collect new health data. You may also request deletion of previously collected health data as described in Section 9 ("Your Rights to Access and Delete Data").

18. Group Chats

18.1 How Group Chats Work

A Group Chat is not a private conversation between you and Tomo. When someone adds Tomo to a Group Chat, or asks Tomo to start one, Tomo receives every message and attachment sent in that Group Chat, along with each Group Participant's name, phone number or other messaging handle, and changes to the group's membership. Tomo's replies in a Group Chat are visible to everyone in it. Please do not share information in a Group Chat, or ask Tomo about private matters there, unless you are comfortable with every Group Participant seeing it.

18.2 Group Participants Without an Account

If you are in a Group Chat with Tomo but have not created an Account, we create a record linked to your phone number or messaging handle so that Tomo can operate the Group Chat. We use this information to provide the Service to the Group Chat, to keep the Service secure and prevent abuse, and for the analytics and logging described in Section 6. Tomo may also message you directly in connection with a request made in the Group Chat. To stop these direct messages, contact us at hello@tomo.ai from, or with, the phone number or handle Tomo messaged.

18.3 Group Memories

To remember context, Tomo may save notes and summaries of a Group Chat, including facts, preferences, and plans attributed to individual Group Participants. Tomo may use these saved group memories when replying in that Group Chat, and when replying to any current Group Participant who has an Account in that person's own private conversations with Tomo. Once you leave a Group Chat, its memories are no longer used in your private conversations, but anything Tomo already referenced there is not removed.

18.4 Information From Your Private Conversations

To personalize its replies, Tomo may share a limited, general profile drawn from your private conversations with Tomo (for example, your name, school or work, and hobbies) in Group Chats you are part of. This profile is designed to exclude sensitive information, such as health, medical, and mental health information and relationship details. Tomo is an AI system and can make mistakes, so we cannot guarantee that nothing private will ever appear in a Group Chat. Please contact us if you see information about you in a Group Chat that should not be there.

18.5 Connections Between Participants

When two people share a Group Chat with Tomo, we record a connection between them. Tomo may show a person their connections, including names and profile pictures, including in content that person can share. Connections stay in place after someone leaves a Group Chat.

Tomo may also create summaries of a Group Chat's activity, such as members' names and how many messages each has sent, which members can view and share, including outside the Group Chat.

18.6 Adding Tomo to or Starting a Group Chat

If you add Tomo to a Group Chat, or ask Tomo to start one, you are responsible for making sure that you are allowed to do so, that the other Group Participants have agreed to be contacted, and that they know Tomo is present and that this Policy applies. Do not add Tomo to, or ask Tomo to start, a Group Chat with anyone under 13, or with anyone under 18 who does not have a parent or guardian's permission to use the Service.

18.7 Your Choices

• You can leave a Group Chat, or remove Tomo from it where your messaging app allows, at any time. Once you leave, Tomo no longer receives your messages from that Group Chat, though it keeps receiving messages from the Group Participants who remain. Once Tomo is removed, it receives no further messages from that Group Chat.
• Any Group Participant, including someone without an Account, can request access to or deletion of the Personal Data we hold about them by emailing hello@tomo.ai from, or with, the phone number or handle they use in the Group Chat, or by submitting our data deletion form. We handle these requests as described in Section 9.
• Where information about you is part of a Group Chat's shared records, such as its summaries, we will delete or de-identify it where reasonably practicable.
• Deletion does not remove messages from other Group Participants' devices, and may not remove information that other people have shared about you in their own conversations with Tomo.

19. Text Messaging (SMS)

When you give us your mobile number and agree to receive text messages, we use your number to send the messages described in our Terms of Service, such as replies, reminders, account notices, support messages, and occasional promotional messages. Message frequency varies, and message and data rates may apply.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

You can opt out at any time by replying STOP to any text message from us. Reply HELP for help, or contact us at hello@tomo.ai.

20. Changes to this Privacy Policy

We may update this Privacy Policy at any time. Any updates will be posted on this page with the "Last updated" date revised accordingly. Your continued use of the Service after changes take effect indicates your acceptance.

21. Contact Us

If you have any questions about this Privacy Policy, you can contact us at hello@tomo.ai.