# Migaru privacy policy

How Migaru collects, uses and protects your data. Last updated October 30, 2026.

Migaru is a CRM that keeps itself: it reads the mail, calendars and conversations a workspace connects, files them on the right records, and drafts what comes next for a person to approve. This policy covers the Migaru website, the web app at app.migaru.ai, and the Migaru apps for iPhone and Android. “We” and “us” mean Migaru.

A Migaru workspace belongs to the company that set it up. For the business data in it (records, mail, meetings, notes), that company decides what is connected and who can see it, and we process that data on its behalf.

## What we collect

- **Your account:** your name, email address, a password (stored only as a hash) or the Google account you sign in with, and your settings.
- **What your workspace keeps in Migaru:** accounts, contacts, deals, tasks, notes, files, pages and the questions you ask the assistant.
- **Mail you connect (Google or Microsoft):** who wrote to whom and when, the subject and a short snippet of each message. Full message bodies are read only if a workspace turns that setting on, and then only in memory, to find commitments and learn how you write. Bodies are never stored. A mailbox can be limited to external mail, or to who and when alone, with subjects and snippets left out.
- **Calendars you connect:** meeting titles, times, attendees and conferencing links.
- **Slack, if connected:** activity in public channels the Migaru bot is invited to: who spoke, and how many messages, never what they said, and never private channels or other people’s direct messages. If you write to the Migaru bot in a direct message, it reads that message to answer you, and it can send you your notifications there if you turn that on.
- **Calls the notetaker records, if a person turns it on:** the video, audio and a transcript of their Google Meet, Zoom and Teams calls. The notetaker joins under their name and announces itself in the call’s chat. A workspace can have it ask everyone on the call to agree instead: then anyone who types “stop” in the chat, or removes it, makes it leave at once, and that call’s recording and transcript are deleted, here and at Recall.ai.
- **Your phone number, if you turn on meeting reminders by text message or WhatsApp:** the number you confirm with a code, used only to send you those reminders, and forgotten when you remove it.
- **Zoom, if you connect it:** a token that lets the notetaker join your Zoom calls alongside you, kept encrypted.
- **Call transcripts you upload, and data from other tools** a workspace connects, such as another meeting recorder, or a CRM it imports from.
- **Billing:** the workspace’s plan, seats and billing address. Card details go straight to our payment processor, Stripe; we never see or store them.
- **Security records:** for each signed-in session, the IP address and device or browser it came from, so you can see and end your sessions. Failed sign-in attempts are recorded for a day, to stop password guessing.

We do not use advertising trackers, on the website or in the apps, and we do not track you across other companies’ apps or websites.

On the website and the sign-up pages we count visits ourselves, to learn which pages and links lead people to try Migaru: the pages viewed and for how long, the buttons clicked, whether a form was started, the site and campaign tags of the link you arrived by, your type of device and your country. We do not record what you type into a form, or your IP address. This is kept in our own database and never sold, and none of it is collected inside the app or the phone apps. If you go on to create an account, the visits are linked to it, so we can see how our customers found us.

Separately, the same pages use Google Analytics. Google receives the address and title of each page viewed, the link you arrived by, your device and browser, your approximate location, which it works out from your IP address, the sign-up, sign-in, demo and pricing buttons you click, and whether you started, sent or got an error on the sign-up or demo form, but not what you typed. If you sign up or request a demo from a browser Google Analytics counts, our servers also tell Google, under that browser’s Google Analytics id, when your account and workspace are created, when you go to checkout, and later when your trial starts, your first payment goes through, or your subscription is canceled or ends, with the plan, the number of seats and the price; and, for a demo, the team size and current CRM you chose. Google never receives your name, your email address or anything in your workspace. We have turned off Google signals and ad personalization, so none of this is used to personalize ads or linked to your Google account. Google Analytics does not run inside the app or the phone apps, and apart from the billing steps above nothing you do there reaches it. You can opt out of it with [Google’s opt-out add-on](https://tools.google.com/dlpage/gaoptout).

## How we use it

- To run Migaru: keeping records up to date, preparing meeting briefs, answering questions, drafting follow-ups for you to review, and showing suggestions for you to approve.
- To sign you in, keep your account secure and send the emails the service needs, such as sign-in links and invitations.
- To bill the workspace and to provide support when you ask for it.

We do not sell personal data, and we do not use your workspace’s data to train AI models.

## AI processing

Migaru’s AI features send the data a task needs, such as a record, a transcript or a message snippet, to a large language model to produce the result. Models are provided by Anthropic and reached through Vercel’s AI Gateway, which sends a request only to a provider that has agreed with Vercel to keep none of it and not to train on it, and refuses the request when none has. When the assistant runs an analysis, it does so in an isolated Vercel sandbox with no network access, over data you can already see.

On plans that include web research, the assistant can search the web through Exa, reached through Vercel’s AI Gateway. It sends a search question, such as a company’s name and website or a person’s name and company, and is told to put nothing from your mail, meetings or notes into it.

## Google user data

Migaru’s use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Gmail data is used only to provide and improve the features you see in Migaru. It is never used for advertising, never sold, and never read by people at Migaru, except with your permission, for security, or where the law requires it.

A mailbox connected for syncing can read mail and calendars and create drafts in your mailbox. It cannot send. A mailbox connected for Outreach campaigns sends the emails of the campaigns you set up, from your account. You can remove Migaru’s access at any time at [myaccount.google.com/permissions](https://myaccount.google.com/permissions).

## Who we share it with

We share data only with the providers that run Migaru for us, each for that purpose alone:

- **Vercel**: hosting, file storage, the AI Gateway, and sandboxed analysis.
- **Neon**: our database.
- **Anthropic**: the language models behind the AI features.
- **Stripe**: payments.
- **Resend**: the emails the service sends, such as sign-in links and invitations.
- **Google**: website analytics (Google Analytics), for the website, the sign-up pages and the sign-up and billing steps described above.
- **Recall.ai**: the notetaker that joins, records and transcribes calls, for the people who turn it on. Once a recording is copied to our storage, Recall’s copy is deleted.
- **Twilio**: meeting reminders by text message or WhatsApp, for the people who turn them on, and the code that confirms their phone number first. It receives the number, and each reminder’s meeting title, time and link.
- **Exa**, through Vercel’s AI Gateway: web search, on plans that include it.
- **Lusha**: company and contact enrichment, on plans that include it. For a company we send its website domain. For a contact somebody looks up, we send what identifies them: their name, company, email address or LinkedIn profile.

Data also goes to tools *your workspace* connects. That includes Google, Microsoft, Slack, HubSpot, Pipedrive, Attio, Notion and the connectors listed in Migaru’s settings, and only what the connection needs. We may disclose data where the law requires it, or as part of a merger or acquisition, in which case this policy would continue to protect it, and data from Google accounts would move only with each person’s explicit consent first.

An owner or admin can also let other apps work in the workspace on someone’s behalf: an AI assistant such as Claude or ChatGPT that signs in to Migaru’s MCP server, anything holding an API key, or a workflow that sends a record to an address they set. Each gets what it asks for within the access it was given, acting as the person who allowed it, and what it does with the data is then governed by that app’s own policies. A connection or key can be revoked at any time under Settings, API keys.

## Outreach emails

If a workspace sends campaigns with Outreach, emails go to the recipients it chooses from its own connected mailboxes. Open and click tracking is off unless the workspace turns it on for a campaign. When it is on, we count opens and clicks, but we do not record the recipient’s IP address or device. Recipients can unsubscribe from a campaign’s emails.

## Links you share

You can share a meeting summary or publish a page by link. Anyone with the link can see what was shared, until you turn the link off or it expires. Shared links are hidden from search engines unless you choose otherwise for a published page.

## Cookies and your device

The website and web app use the cookies they need: your sign-in session and preferences such as light or dark mode. They also set two of our own for counting visits as described above: a random visitor id, kept for 13 months, and a visit id that lapses after 30 idle minutes. Neither is read by anyone but us. On the website and the sign-up pages, Google Analytics sets two more, _ga and _ga_42WVRCR08C, kept for up to two years, which Google reads, and which our servers read when you sign up, to send the steps above under the same id. The Migaru apps keep your sign-in in the iPhone Keychain or Android Keystore and store nothing else about you on the device.

## How we protect it

Data is encrypted in transit and at rest. The credentials for your connected accounts are encrypted a second time inside our database, and API keys, and the tokens of apps you connect, are kept only as hashes.

## How long we keep it, and deleting it

- Records stay in your workspace until you delete them. A deleted record moves to Settings → Deleted, where it can be restored or deleted for good.
- When a workspace’s subscription ends, its mailboxes and calendars stop syncing, its campaigns stop sending and the notetaker stops joining its calls, and it stays read-only for 90 days, so its people can still read and export everything. Paid for again in that time, it picks up where it stopped. Within 30 days after those 90 days, it is deleted as an owner’s deletion does it, and its owners are emailed when it is.
- Disconnecting a mailbox, calendar or Slack stops Migaru from reading it. It does not remove the records already filed from it; delete those in the workspace if you want them gone.
- You can delete your account under Settings, Profile. It goes at once, with your sign-ins, connected mailboxes, keys and private pages; the records you kept for your workspace stay with the workspace.
- An owner can delete a whole workspace under Settings, General. It is locked and its billing stops at once, and 14 days later it is deleted for good, with its records, files and the accounts of the people in it; any owner can keep it until then. Export what you want to keep first: while it waits, it opens for nobody but an owner keeping it. If you would rather we did it, email [support@migaru.ai](mailto:support@migaru.ai) from the address on the account.
- Deleted data is gone from our database backups within [Neon history retention, e.g. 7 days] of being deleted.

## If Migaru shuts down

- **You hear first:** we email every workspace owner and admin, and say so in the app, at least 90 days before Migaru stops. Until then the workspace keeps working as it always has.
- **You can take everything:** after the last day, every workspace stays read-only for 90 days. An owner or admin can still export the whole workspace, any view still exports as CSV, Excel or JSON, and every record can still be read through the API and the MCP server.
- **Billing stops:** nothing renews once notice is given, and time paid for past the last day is refunded.
- **Then it is deleted:** within 30 days of those 90 days ending, every workspace is deleted as an owner’s deletion does it, with its records, files, call recordings and transcripts, the credentials of its connected mailboxes, calendars, Slack and Zoom, and the accounts of the people in it, and its owners are emailed when it is. Recall.ai is asked to delete what it holds of recorded calls, and our database and file storage are deleted with their backups. Only invoices and payment records outlast it, for as long as the law requires them kept.
- **It is not sold off:** the data in a workspace is not sold as an asset of Migaru. If another company takes the service on instead, we tell owners before anything moves, that company is bound by this policy, and a workspace that would rather not go can be exported and deleted first. Data from Google accounts moves only with each person’s explicit consent.

## Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it. Most of this you can do yourself in Migaru. For anything else, email [support@migaru.ai](mailto:support@migaru.ai). If your data is in a workspace your employer runs, we may pass your request to them, since they decide what that workspace holds.

## Children

Migaru is a business tool and is not meant for anyone under 16.

## Changes

If we change this policy, we will update the date above, and tell workspace owners before a significant change takes effect.

## Contact

Questions about privacy, or a request about your data: [support@migaru.ai](mailto:support@migaru.ai).

---

Canonical page: https://www.migaru.ai/privacy
Last updated: 2026-10-30