Privacy Policy
Last updated: September 18, 2026
This Privacy Policy explains how utobo ("utobo," "we," "us," or "our") collects, uses, shares, and protects personal information when you visit utobo.com, create an account, or use our products — including utobo Email (transactional email, campaigns, and automations) and utobo Store (courses, digital products, and memberships). It applies worldwide, including to individuals in the European Economic Area (EEA), the United Kingdom, and other regions with data-protection laws.
If you are a resident of California, additional disclosures apply to you. Please see our Privacy Notice for Californians, our California Supplemental Privacy Notice, and your California Privacy Choices, which supplement this policy.
Who we are
Utobo is the data controller responsible for the personal information described in this policy. You can reach our privacy team at privacy@utobo.com.
Our role depends on the data. For information about your account, our website, and our own marketing, utobo acts as a controller. For the contact and recipient data that our customers upload and send through utobo Email, utobo acts as a processor on the customer's behalf; that processing is governed by our Data Processing Addendum, and this policy does not change the customer's own privacy commitments to their contacts.
Information we collect
We collect the following categories of personal information:
- Information you provide. Account details (name, email address, password), business and profile information, billing and payment details, and the content of messages you send us for support or sales.
- Contact and recipient data you import. When you use utobo Email, you may upload email addresses, names, and contact properties of your own recipients. We process this data on your instructions as your processor.
- Product usage and delivery data. Delivery events such as sends, opens, clicks, bounces, and unsubscribes; logs; and information about how you interact with our products and website.
- Device and cookie data. IP address, browser and device information, and identifiers collected through cookies and similar technologies (see Cookies below).
How we use personal information
We use personal information to:
- Provide, operate, secure, and improve our products and website;
- Process transactions and manage billing and subscriptions;
- Send, receive, route, and measure email and other communications you request;
- Provide customer support and respond to your requests;
- Detect, prevent, and address fraud, abuse, and security incidents;
- Send service and, where permitted, marketing communications; and
- Comply with legal obligations and enforce our agreements.
Legal bases for processing (EEA and UK)
Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract with you; our legitimate interests in operating, securing, and improving our business (balanced against your rights); your consent (for example, for certain marketing or cookies), which you may withdraw at any time; and compliance with a legal obligation.
AI features
Some features — including AI email drafting, AI spam scoring, and AI-assisted contact tagging — are powered by Google's Gemini API. When you use these features, the relevant content and, where applicable, contact data are processed by Google as our subprocessor to return a result to you. We do not use this data to train third-party foundation models, and we only process it to provide the feature you invoked.
How we share personal information
We do not sell your personal information. We share it only as described here:
- Subprocessors. Vendors that process personal information on our behalf under contract, including:
- Amazon Web Services — cloud infrastructure and data storage;
- Stripe — payment processing;
- Supabase — database and authentication;
- Google (Gemini API) — AI email drafting, spam scoring, and contact tagging.
- Professional advisors and authorities where required to comply with law, legal process, or to protect rights, safety, and security.
- Business transfers in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
International data transfers
We operate globally, and personal information may be transferred to and processed in countries other than your own, including the United States. Where we transfer personal information out of the EEA or the UK, we rely on an appropriate safeguard such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism. You may request a copy of the relevant safeguard by emailing privacy@utobo.com.
Data retention
We retain personal information for as long as your account is active and as needed to provide the products, and thereafter as required to comply with our legal obligations, resolve disputes, and enforce our agreements. Contact and delivery data processed on a customer's behalf are retained for the duration of that customer's subscription and deleted or returned as described in the Data Processing Addendum. You can export or delete your data from your dashboard at any time.
Security
We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, access controls, and hosting on established cloud infrastructure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information; to restrict or object to certain processing; and to withdraw consent where processing is based on consent. To exercise these rights, email privacy@utobo.com. You may also manage much of your data directly from your account dashboard.
If you are in the EEA or the UK and believe we have not addressed your concern, you have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office). Where a contact's data was uploaded by one of our customers, we will refer the request to that customer, who is the controller of that data.
Cookies
We use cookies and similar technologies to run the website, remember your preferences, measure performance, and support marketing. You can control non-essential cookies through the cookie banner and your browser settings. Declining non-essential cookies will not prevent you from using core features of the site.
Children's privacy
Our products are intended for businesses and adults. We do not knowingly collect personal information from children under the age required by applicable law (for example, 16 in parts of the EEA and 13 in the United States). If you believe a child has provided us personal information, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of our products after an update means you accept the revised policy.
Contact us
Questions about this policy or your personal information? Email privacy@utobo.com or legal@utobo.com and we will respond within a reasonable time. If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data protection authority.