Storm OS Privacy Policy

Effective date: October 20, 2026
Last updated: October 20, 2026
Version: 1.4

The short version

• Your Workspace data is yours. We hold it only to run the product for you.
• We do not sell or share your data, we do not serve ads, and we do not use your data to train AI models.
• We ask for the minimum from Google: sign-in identity only. We do not read your mailbox, calendar, files, or contacts.
• The assistant and research are on unless a Workspace Admin turns them off, during setup or at any time. While they are on, the content they work with goes to the providers listed in §8.
• We do not browse your Workspace. Storm OS personnel access Workspace content only when you ask us to for support, or when we must to fix a security or availability incident. Every such session is logged, time-limited, and visible to your Workspace Admins.
• You can export everything and delete everything, at any time.

The rest of this policy is the detail behind those statements.

1. Who we are and what this covers

On-Call CMO, doing business as Storm OS ("Storm OS," "we," "us"), 239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA, operates the Storm OS marketing site and the Storm OS application, both at storm-os.app. The application is an installable Progressive Web App for managing customer, investor, and partner relationships.

This policy explains what personal data we handle, why, and what rights you have. It applies to visitors to our site, people who create or join a Workspace, and individuals whose information appears inside a customer's Workspace.

Two different roles. This distinction determines who you should contact about your data:

If your details appear in someone's Storm OS Workspace and you want them corrected or removed, contact that organization directly. If you contact us instead, we will forward your request to the relevant customer and, where the law requires, assist them in responding. See §12.

2. What we collect

2.1 Data you give us

2.2 Data we collect automatically

We do not use advertising cookies or cross-site tracking pixels. Google Analytics sets its cookies only on the pages and screens where it runs, listed above, and we configure it not to use Google signals or ad personalization. Everywhere else, the application sets only strictly necessary cookies: the httpOnly, Secure, SameSite=Lax cookies that sign you in and keep you signed in, a cookie that records only that you are signed in, so our site can take you straight to the application, and the fraud-prevention cookies of our payment processor, Stripe, whose payment form the application loads during onboarding and on the billing screen. Because they are strictly necessary, no consent is required for them.

Marketing email a Workspace sends to its own contacts is a different case. When a Workspace turns tracking on for a send, that message carries an open pixel and links rewritten through go.storm-os.app, or through a hostname on that Workspace's own domain, beside its sending domain, once the Workspace has published the record for one, to record opens and clicks for that Workspace's own reporting. The unsubscribe address in the message header always stays on go.storm-os.app, so unsubscribing keeps working even if the Workspace's own hostname stops. Tracking is the Workspace's choice, set per campaign and per sending domain, and it never applies to the application itself.

2.3 Data from third parties

• Identity provider (Google): see §3.
• Payment processor: subscription status and payment outcomes. Card numbers never reach our servers.
• Data you import: CSV/XLSX files you upload, and information from Integrations you connect. We do not buy or sell contact lists.
• Research, unless a Workspace turns it off: while the assistant and web research are on, a member who can edit a record can ask Storm OS to research that person or company, or a saved list of them. The run looks them up with the data providers listed in §8, which we pay for each lookup, and on the public web through Anthropic's web search, and shows what it found as suggestions, each with its source. No field on a record is changed until a member reviews and accepts a suggestion. A research run on a company also files the further company details the data providers return, such as funding, technology, headcount, industry codes, products and competitors, on that company's record. What Storm OS stores from a research run, including the providers' answers, is kept private to the Workspace that ran it, for the periods in §11. A request to erase a person from the research results a Workspace has saved for reuse is carried out for each Workspace separately, and everything else research keeps follows the periods in §11.

3. Signing in with Google

Storm OS offers "Sign in with Google" so you don't need another password. This section is the full disclosure of what that involves. Google is currently our only third-party sign-in provider. If we add another, we will update this policy before that option becomes available to you.

3.1 What we request

We request identity scopes only:

We neither request nor can access your Gmail mailbox, your Google Calendar, your Drive files, or your Google Contacts. No message content, no attachments, no meeting data.

3.2 What we do with it

We use this information solely to: authenticate you; create or match your Storm OS account; populate your display name; and send you transactional email at the address on file. We store the provider's unique identifier, your email address, and your name as your display name. We do not take your avatar from Google. We do not store tokens beyond what is needed to complete sign-in, and we do not use provider data for advertising, profiling, or model training.

3.3 Google API Services User Data Policy and Limited Use

Storm OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we:

• Use Google user data only to provide or improve user-facing features that are prominent in the Storm OS interface;
• Do not transfer Google user data except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's explicit prior consent;
• Do not use Google user data for serving advertisements of any kind, including retargeting, personalized, or interest-based advertising;
• Do not sell Google user data; and
• Do not allow humans to read Google user data unless we have the user's affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and de-identified.

3.4 If we ever need more

Automatic email capture is on our roadmap. If we build it, mailbox access will be a separate, optional, clearly explained authorization that you can decline while continuing to use sign-in normally. Adding those permissions would require a new consent prompt from Google, so access cannot expand silently. We will update this policy and notify Workspace Admins before any such feature launches.

3.5 Revoking access

You can disconnect Storm OS at any time:

• Google: myaccount.google.com/permissions

Revoking stops us from authenticating you through Google. It does not delete your Workspace; to delete data, see §11.

4. Why we use your data, and our legal bases

5. What we never do

• We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We have not done so in the preceding 12 months.
• We do not serve advertising in Storm OS, and we do not let anyone pay to influence what you see.
• We do not use Customer Data to train, fine-tune, or evaluate machine-learning or generative AI models, ours or anyone else's.
• We do not disclose Customer Data to third parties except as described in §7.

6. Who can access Workspace data

This is the part most people actually want answered, so here it is plainly.

Access is limited to:

1. Authorized Users of your Workspace. What each one sees is governed by your Workspace's org-wide defaults, ownership, admin sharing rules, and individual record shares. Every record has an access explainer showing who can see it and why. Workspace Admins have full access to Workspace content by design, and their actions are audited.
2. Integrations you connect. Only the data required for that integration, only after a Workspace Admin authorizes it, and only for as long as it stays connected.
3. Our subprocessors (§8). Each receives data to provide its service to us, as §8 describes. Stripe also acts as an independent controller for purposes its own terms list, such as fraud prevention and legal compliance.
4. Storm OS personnel, narrowly and on the record. We do not browse Workspaces and we have no general-purpose window into your data. Our staff may access Workspace content only in these situations:

• You ask us to. Support may start a time-limited session acting as your user to reproduce a problem. Every session requires a stated reason, is capped at 60 minutes, displays a persistent banner in the app, is recorded in our platform audit log, and appears in your own Workspace audit log so your admins can see exactly who accessed what, when, and why.
• Security or availability incidents. Where we must investigate abuse, a breach, data corruption, or a serious outage, access is limited to what the investigation requires, is role-restricted, and is audited the same way.
• Legal compulsion. See §7.

Support sessions cannot change your password or email address, and cannot export your data, unless the operator holds an explicitly elevated support permission. Routine engineering does not use production Workspace data; development and testing run against synthetic seed data.

These limits are enforced technically as well as contractually: every row in our database carries a workspace identifier, Postgres row-level security is applied as defense in depth, access is resolved server-side by a single authorization module on every read and write, and audit writes are append-only.

7. When we disclose data

We disclose personal data only:

• To subprocessors who help us run the Service (§8).
• To Google, for site analytics: Google Analytics receives what §2.2 describes.
• At your direction: to Integrations you connect, or to recipients you share with.
• For legal reasons: to comply with a valid legal process, or to protect the rights, safety, or property of Storm OS, our customers, or the public. Where we are legally permitted, we will notify the affected customer before disclosing Customer Data so they can seek protective relief. We will push back on requests that are overbroad or defective.
• In a business transfer: if we are involved in a merger, acquisition, financing, or sale of assets, data may transfer to the successor, which will remain bound by this policy or give notice before any material change. Google user data would transfer only with the affected user's explicit prior consent (§3.3).

8. Subprocessors

We use a small number of vendors to operate the Service. Current subprocessors:

Used for every Workspace

Used only while a Workspace has a feature on

The assistant and web research are on unless a Workspace Admin turns them off. Nothing is sent to these subprocessors while the assistant is off, and the three data providers are used only while web research is also on and a member runs research on a record or a saved list.

Anthropic publishes its own subprocessors, including any provider behind its web search, at anthropic.com/subprocessors.

Google also provides the site analytics described in §2.2. That covers visits to our own site, sign-up and onboarding, never Customer Data, so Google Analytics is not on this list.

Integrations a Workspace connects itself. MailChimp, a Workspace's own Stripe account for invoice payments, and a Workspace's own Anthropic key are Integrations the Workspace controls. Each runs on the Workspace's own account with that provider, under the Workspace's own agreement with it, and none of them is our subprocessor. With a Workspace's own Anthropic key, two things still run on our accounts: the background reading of documents already filed on people, companies and deals, and a research run's calls to the data providers above.

We maintain the current list at storm-os.app/subprocessors and will give Workspace Admins at least 30 days' notice before adding a new subprocessor that processes Customer Data, with an opportunity to object.

During the Early Access Period defined in the Terms of Service (August 1, 2026 through at least March 31, 2027), that 30 day period does not apply, because the third party services we run on are still being selected and configured. We will tell Workspace Admins by email as soon as we reasonably can and update the subprocessors page, and the opportunity to object is unchanged. From the day after the Early Access Period ends, the 30 day period applies in full.

9. International transfers

Storm OS is operated from the United States. Customer Data is hosted in the United States and Germany. While a Workspace has the assistant or research on, what is sent to the providers in §8 is processed in the locations listed there. Wherever your Workspace is hosted, our personnel, support, and administrative systems are located in the United States, so operating the Service involves processing your data in the US and in other countries whose data protection laws may differ from your own.

Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on:

• the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, or the Swiss equivalent), executed in our Data Processing Addendum, as our primary transfer mechanism;
• supplementary technical and organizational measures, including encryption in transit and at rest, tenant isolation, least-privilege access, and a policy of challenging overbroad government requests; and
• where a subprocessor holds a valid certification, the EU-US Data Privacy Framework and its UK Extension and Swiss-US Framework, as an additional basis.

The Standard Contractual Clauses do not extend to a research data provider that offers no separate data protection terms (§8, DPA §7.4).

A copy of the relevant transfer mechanism is available on request at privacy@storm-os.com.

Storm OS is not currently self-certified under the EU-US Data Privacy Framework. Standard Contractual Clauses are our own transfer mechanism; the Framework is relevant only where a subprocessor is separately certified.

10. Security

We design for hard tenant isolation and least privilege. Our current measures include:

• In transit: TLS 1.2+ everywhere; HSTS.
• At rest: encryption at the storage layer for the database and blob storage.
• Credentials: passwords hashed with Argon2id with a strength requirement; passwords are never stored or logged in readable form.
• Sessions: short-lived access tokens plus rotating refresh tokens in httpOnly, Secure, SameSite=Lax cookies that are never readable by JavaScript; token-reuse detection invalidates the whole session family; per-device sign-out and "sign out everywhere."
• Multi-factor authentication: optional TOTP per user; Workspace Admins can require it for everyone.
• Tenant isolation: every row is workspace-scoped, Postgres row-level security applied as defense in depth, cross-tenant access tested in CI as a failing-closed test.
• Authorization: a single server-side module resolves access on every read and write, including search, reports, and offline sync, so clients never receive rows they aren't entitled to.
• Files: attachments and exports are stored privately and served only through short-lived signed URLs; nothing is publicly addressable.
• On your device: offline data is scoped to user and Workspace and wiped on sign-out; an optional app lock re-authenticates after inactivity; revoking a session remotely takes effect on the device's next connection.
• Operations: brute-force and rate limiting, append-only audit logging, error and performance monitoring, automated dependency vulnerability scanning, an automated test suite that gates every deployment and includes denied-path authorization tests on every endpoint, and least-privilege access for personnel bound by written confidentiality obligations. We have not yet commissioned an independent third-party penetration test. When we do, we will say so here and make the summary available to customers on request.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected Workspace Admins without undue delay and in any event within 48 hours of becoming aware, matching our contractual commitment in DPA §9, and will notify regulators and individuals where required by law. Report suspected vulnerabilities to security@storm-os.com.

11. How long we keep data

12. Your rights

If you are an Authorized User or account holder, you can view and update most of your data directly in the app: profile and preferences, active sessions and devices, notification settings, and Workspace export. For anything else, contact privacy@storm-os.com.

Depending on where you live, you may have the right to: access your personal data; correct it; delete it; obtain a portable copy; restrict or object to processing (including profiling); withdraw consent; opt out of the sale or sharing of personal information and of targeted advertising (we do neither); limit the use of sensitive personal information (we do not collect it for the purposes the law targets); and appeal a refused request. We will not discriminate against you for exercising these rights.

To exercise a right, email privacy@storm-os.com. We will verify your identity by confirming control of the email address on the account, or by other proportionate means. We respond within 30 days (extendable by a further 60 where the law allows, with notice). You may use an authorized agent where the law provides for one.

If your information is in a customer's Workspace, that customer is the controller. Send your request to them. If you send it to us, we will route it to them within 10 business days and support them in responding; we will not unilaterally alter or delete their records.

Complaints. You may lodge a complaint with your local supervisory authority: in the EEA, your national data protection authority; in the UK, the Information Commissioner's Office; in California, the California Privacy Protection Agency or the Attorney General. We would appreciate the chance to resolve it first.

EU/UK representative. Storm OS markets and sells the Service in the United States. Prices are quoted only in US dollars and the Service is offered only in English, so we do not consider ourselves to be offering goods or services to individuals in the EU or UK within the meaning of GDPR Article 3(2), and we have not appointed an Article 27 representative. If we begin actively marketing to the EU or UK, we will appoint one and update this policy before doing so.

13. Children

Storm OS is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact privacy@storm-os.com and we will delete it.

14. Automated decision-making

Storm OS computes two relationship scores: a Fit Score from criteria your Workspace Admin configures, and an Activity Score based on recency and type of interactions. Both are decision support. Each is shown with a full breakdown of how it was calculated, and can be manually overridden by your users. They are not used by us to make automated decisions producing legal or similarly significant effects about any individual.

15. Changes to this policy

We will update this policy as the product changes. For material changes we will notify Workspace Admins by email and post an in-app notice at least 30 days before the change takes effect, and update the "Last updated" date above. During the Early Access Period defined in the Terms of Service, the 30 day period does not apply, as Terms of Service §1 describes. Where the change requires consent, we will ask for it. We keep prior versions of this policy, the Terms of Service and the Data Processing Addendum at storm-os.app/privacy/archive.

16. Contact us

On-Call CMO d/b/a Storm OS
239 4th Ave, Ste 1401, Pittsburgh, PA 15222, USA

Privacy: privacy@storm-os.com · Security: security@storm-os.com · Storm OS has not appointed a Data Protection Officer, as it is not required to do so under GDPR Article 37. Privacy inquiries are handled at the address above.