Goodstream Privacy Policy

Goodstream is operated by VeriGood LLC (“VeriGood,” “Goodstream,” “we,” “us,” or “our”). Goodstream provides business workflow, CRM, file-management, communication, and related operational tools for organizations.

This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use Goodstream, visit our websites, create an account, participate in a pilot or trial, or communicate with us.

1. Scope of This Policy

This Privacy Policy applies to:

• Goodstream websites, including pages used for login, registration, support, and request-access forms;
• The Goodstream web application;
• Goodstream trial, beta, pilot, and evaluation programs;
• Communications with VeriGood or Goodstream; and
• Information processed through Goodstream features, including CRM records, email tools, files, notes, workflows, and account administration.

This Privacy Policy does not apply to websites, applications, or services that are not owned or controlled by VeriGood LLC.

2. Information We Collect

A. Account and User Information

When a user creates or receives a Goodstream account, we may collect:

• Name;
• Email address;
• Password or authentication information;
• Company, organization, or workspace information;
• Role, title, department, and permission level;
• Profile information, such as a profile image if uploaded;
• Account status, invitation records, and login-related information.

B. Organization and Workspace Information

Goodstream may collect information configured by an organization administrator, including:

• Company or organization name;
• Branding, logo, and workspace settings;
• Team members and roles;
• Table, field, workflow, and permission configurations;
• Module or feature access settings.

C. CRM, Workflow, and Operational Records

Users and organizations may enter or import records into Goodstream. Depending on how an organization uses Goodstream, those records may include:

• Names;
• Email addresses;
• Phone numbers;
• Addresses;
• Prospect, customer, student, vendor, or project information;
• Notes;
• Statuses, stages, tags, follow-up dates, and assignments;
• Calendar or workflow information;
• Message history and activity records;
• Other information provided by the organization or its users.

Organizations are responsible for deciding what information they enter into Goodstream and for making sure they have permission or a lawful basis to use that information.

D. Email and Communication Information

If an organization uses Goodstream’s email or CRM communication features, Goodstream may process:

• Sender and recipient email addresses;
• Email subject lines;
• Email body content;
• Email templates;
• Email signatures;
• Message timestamps;
• Sent status, reply status, and related metadata;
• Reply content and synchronized email records;
• SMTP, IMAP, OAuth, or other email-connection settings.

The organization using Goodstream is responsible for the recipient list, the content of its messages, required opt-out handling, and compliance with applicable email rules.

E. Files and Attachments

If users upload files, Goodstream may process:

• File names;
• File types;
• File sizes;
• Folder names, categories, and tags;
• Upload dates and related metadata;
• The file contents themselves.

Users and organizations should not upload sensitive information unless it is necessary for the authorized use of Goodstream and they have permission to do so.

F. Technical, Security, and Usage Information

We may automatically collect technical and security-related information, including:

• IP address;
• Browser and device information;
• Pages or features accessed;
• Login times;
• Session, token, and authentication-related events;
• Error logs;
• Security logs;
• System activity needed to operate, secure, debug, and improve Goodstream.

G. Support and Contact Information

If you contact us, request access, report an issue, or ask for support, we may collect:

• Name;
• Email address;
• Organization;
• Message content;
• Screenshots, logs, or other information you choose to provide;
• Support history and resolution notes.

3. How We Use Information

We use information to:

• Provide, operate, and maintain Goodstream;
• Create and manage user accounts;
• Authenticate users and protect accounts;
• Configure organization workspaces;
• Provide CRM, workflow, file, email, messaging, calendar, and related features;
• Send, track, and synchronize authorized email communications;
• Provide customer support;
• Troubleshoot errors and technical issues;
• Improve Goodstream features and reliability;
• Protect the security and integrity of Goodstream;
• Enforce agreements and usage restrictions;
• Comply with legal obligations; and
• Communicate about account, trial, pilot, security, privacy, or service matters.

4. Customer-Controlled Data

Many records in Goodstream are controlled by the organization using the service. For example, if a college, business, nonprofit, or other organization imports contact records, sends emails, uploads files, or enters notes, that organization controls the content and purpose of that data.

For customer-controlled data, VeriGood acts primarily as a service provider or processor. We process that information to provide Goodstream, support the organization, secure the service, troubleshoot problems, and comply with applicable obligations.

If you are an individual whose information was entered into Goodstream by an organization, you should first contact that organization with questions about the accuracy, correction, deletion, or use of your information.

5. Trial, Pilot, and Beta Data

Goodstream may be used in limited trials, pilots, or beta programs. During a trial or pilot, users should enter only the information needed for the approved trial purpose.

Unless otherwise agreed in writing, trial and pilot users should not upload or enter:

• Social Security numbers;
• Driver’s license or passport numbers;
• Payment card or bank information;
• Medical or disability information;
• Financial-aid records;
• Grades, transcripts, or disciplinary records;
• Passwords or authentication secrets;
• Information about minors unless specifically authorized;
• Other sensitive information not necessary for the approved trial.

6. Education Records and FERPA

Some organizations using Goodstream may be educational institutions. Goodstream is not intended to receive protected education records unless the institution has authorized that use and appropriate terms are in place.

When Goodstream processes education-related information on behalf of an educational institution, VeriGood will use that information only to provide the authorized service, follow the institution’s instructions, restrict access to those with a need to provide the service, and avoid redisclosure except as necessary to provide the service or as required by law.

Educational institutions remain responsible for determining whether information entered into Goodstream is subject to FERPA or other education-privacy laws.

7. How We Share Information

A. With the Organization That Controls the Workspace

Information entered into a Goodstream workspace may be available to authorized users and administrators of that organization according to their roles and permissions.

B. With Service Providers

We may use service providers to host Goodstream, store data, send or receive email, provide file storage, manage infrastructure, secure the service, monitor errors, and support operations. These providers may process information only as needed to provide services to us.

C. With Connected Email or Integration Providers

If an organization connects an email account, calendar account, or other integration, Goodstream may exchange information with that provider to provide the connected feature.

D. For Legal, Security, or Safety Reasons

We may disclose information when we believe it is reasonably necessary to:

• Comply with law, legal process, or a government request;
• Protect the rights, property, or safety of VeriGood, Goodstream, users, organizations, or others;
• Investigate security incidents, fraud, abuse, or misuse;
• Enforce agreements or usage restrictions.

E. Business Transfers

If VeriGood is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information may be transferred as part of that transaction, subject to appropriate confidentiality and legal requirements.

8. Service Providers and Subprocessors

Goodstream may use third-party providers to operate the service. Current or expected providers may include:

• Application hosting and server infrastructure providers;
• Database hosting providers;
• File-storage providers;
• Image and media-storage providers;
• Email, SMTP, IMAP, domain, and DNS providers;
• Security, logging, monitoring, and support tools.

Goodstream’s current infrastructure may include providers such as IONOS, MongoDB Atlas, Backblaze B2, Cloudinary, and email-service providers, depending on the feature used. We may update our providers as Goodstream develops.

9. Cookies and Similar Technologies

Goodstream may use cookies, local storage, session storage, or similar technologies to:

• Keep users signed in;
• Remember account or interface settings;
• Maintain security;
• Support application functionality;
• Understand basic usage and performance.

Goodstream does not currently use personal information for cross-context behavioral advertising.

10. Do Not Track and Global Privacy Controls

Some browsers offer “Do Not Track” signals or similar settings. Because there is not a single industry standard for these signals, Goodstream does not currently respond to Do Not Track browser signals.

Goodstream does not currently sell personal information or share personal information for cross-context behavioral advertising. If our practices change, we will update this Privacy Policy and provide any legally required choices.

11. Data Retention

We retain information for as long as reasonably necessary to:

• Provide Goodstream;
• Maintain user accounts and organization workspaces;
• Support active trials, pilots, or subscriptions;
• Troubleshoot issues;
• Maintain security logs;
• Comply with legal obligations;
• Resolve disputes;
• Enforce agreements.

Customer-controlled data may be deleted, exported, or disabled according to the organization’s instructions, applicable agreements, technical limits, backup schedules, logging practices, and legal requirements.

We aim to keep only the information reasonably needed for the purpose for which it was collected.

12. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, disclosure, alteration, or destruction.

Security measures may include:

• HTTPS/TLS for application access;
• Account authentication;
• Password hashing;
• Role-based access controls;
• Company/workspace separation;
• Private file storage;
• Restricted server access;
• Firewall controls;
• Provider account security controls;
• Logging and monitoring;
• Backup or recovery procedures;
• Credential protection practices.

No system is perfectly secure. Goodstream is still developing, and beta or trial features may contain errors, interruptions, or incomplete functionality. Users should keep appropriate source records and backups outside Goodstream during any trial or pilot.

13. User Choices and Requests

Depending on your relationship with Goodstream, you may request to:

• Access certain information;
• Correct inaccurate account information;
• Delete certain information;
• Export certain available records;
• Disable an account;
• Disconnect an integration;
• Ask questions about privacy or security.

If your information was entered by an organization using Goodstream, we may direct your request to that organization because it controls the workspace and the data.

14. California Privacy Notice

This section applies to California residents.

Goodstream may collect the categories of personal information described above, including identifiers, account information, internet or network activity information, professional or organization-related information, and user-provided CRM, workflow, email, file, and support information.

We collect and use this information for the business and operational purposes described in this Privacy Policy.

We do not sell personal information. We do not knowingly sell or share personal information of minors for cross-context behavioral advertising.

California residents may have rights under applicable California privacy laws, depending on the circumstances and whether VeriGood is subject to those laws. These rights may include requesting access, correction, deletion, or information about certain data practices.

15. Children and Minors

Goodstream is intended for use by businesses, organizations, and authorized users. It is not directed to children under 13.

Organizations using Goodstream are responsible for determining whether they are authorized to enter information about minors and for complying with any applicable parental-consent, education-privacy, or child-privacy requirements.

16. International Users

Goodstream is currently intended primarily for users and organizations in the United States. If you access Goodstream from outside the United States, your information may be processed in the United States or other locations where our service providers operate.

17. Changes to This Privacy Policy

We may update this Privacy Policy as Goodstream develops, as our practices change, or as legal requirements change.

When we update the policy, we will revise the “Last Updated” date above. If we make material changes, we may provide additional notice, such as through the Goodstream application, by email, or through another reasonable method.

18. Contact Us

If you have questions about this Privacy Policy or Goodstream’s privacy practices, contact us at: