Skip to policy
Sign In Create your free page
Sign In Sign up free

Legal

Privacy Policy

Effective date: May 12, 2026 · Last updated: October 27, 2026

LetsCollab.bio ("LetsCollab", "we", "us", "our") provides a web application that helps users publish public offer pages, receive structured requests, manage request threads, prepare pitches, create contracts and invoices, track deliverables, and optionally connect Google Calendar for scheduling visibility. This Privacy Policy explains what personal information we collect, how we use it, how we share it, and the choices and rights you have. It applies to the LetsCollab.bio website, the authenticated dashboard, public pages, request portals, and related backend services (the "Service").

1. Who Is Responsible For Your Data

The data controller for personal data processed through the Service is the operator of LetsCollab.bio. For privacy-related requests — including access, correction, deletion, and Google Calendar data concerns — contact [email protected]. We respond to verified requests within 30 days.

2. Information We Collect

2.1 Information You Provide

  • Account data: email address, authentication identifiers issued by our auth provider, display name, handle, password (stored only as a one-way hash by the auth provider; we never see plaintext passwords).
  • Profile content: bio, avatar, content categories, social and web links, public offer listings, and any other profile fields you choose to fill in.
  • Offer and request data: intake answers, brief details, messages, attachments, deliverables, contract workflow activity, invoice records, payment status, and request activity.
  • Payment-routing data: payment-link URLs, handles, or instructions you choose to store so the paying party can pay you directly through your own processor. LetsCollab never collects, holds, settles, or routes funds (see Terms · "Payments").
  • Support and feedback: any content you submit through the in-app feedback form, support emails, or surveys.

2.2 Information Collected Automatically

  • Device and session data: IP address, user-agent string, locale, time zone, browser, OS, referrer, and pages visited — used for security, abuse prevention, and debugging.
  • Product analytics: feature usage, page performance, and aggregated event counts. Only collected when optional analytics are enabled by your privacy choice. If you opt in, our analytics service also records how you use our pages (what they show, where you click and scroll, and your browser's technical messages, with anything you type hidden) and keeps these recordings for 30 days.
  • Cookies and local storage: required cookies for authentication, CSRF, and privacy choices; optional cookies for analytics. See Section 6.

2.3 Information From Third Parties

  • Sign-in services: the verified email and a stable subject identifier when you sign in.
  • Google sign-in or Google Calendar connection (optional): see Section 4.

3. How We Use Information

  • Operate public pages, offer listings, request intake, request threads, notifications, contracts, invoices, deliverables, and dashboard workflows.
  • Authenticate users, secure accounts, prevent abuse, debug issues, and maintain service reliability.
  • Send transactional notifications related to requests, messages, invoices, payments, contracts, deliverables, and account events.
  • Improve usability and performance using optional product analytics, subject to your privacy choice and Global Privacy Control.
  • Comply with legal obligations, enforce our Terms, and protect the rights, property, and safety of LetsCollab, our users, and the public.

The lawful bases for processing under GDPR/UK-GDPR are: performance of a contract (delivering the Service to you), legitimate interests (security, abuse prevention, product improvement), consent (optional analytics and certain communications), and legal obligation.

4. Google User Data — OAuth Scopes And Limited Use

Google sign-in and connecting Google Calendar are optional. Google sign-in requests the basic account scopes below. Connecting Google Calendar also requests the three Calendar scopes:

  • openid, email (https://www.googleapis.com/auth/userinfo.email) — to identify your Google account, sign you in, and attach an optional calendar connection to your LetsCollab account.
  • profile (https://www.googleapis.com/auth/userinfo.profile) — to receive basic profile information, such as your name and profile picture, from Google and prefill your LetsCollab profile. You can review and edit your profile information.
  • https://www.googleapis.com/auth/calendar.calendarlist.readonly — to list calendars available for conflict checks.
  • https://www.googleapis.com/auth/calendar.events.freebusy — to check busy times on selected calendars without reading event titles, descriptions, or attendees.
  • https://www.googleapis.com/auth/calendar.app.created — to create a dedicated LetsCollab calendar and manage booking and deliverable events on that calendar.

The Google account email, the Google subject identifier (sub), the list of granted scopes, and an encrypted OAuth refresh token are stored so the backend can refresh access while you use calendar features. Calendar names and busy time ranges from other calendars are fetched at request time and are not retained as durable product records; we cache only the smallest working set needed to render the current scheduling view. We retain app calendar ownership and event bindings to update our own events reliably. Turning deliverable sync off pauses updates and retains existing Google events.

Limited Use disclosure. LetsCollab's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. In particular:

  • We do not use Google user data, including Google Calendar data, to serve advertising.
  • We do not sell Google user data or transfer it to data brokers, advertising platforms, or third parties for the purpose of advertising or lead generation.
  • We do not use Google user data to train generalized or third-party AI/ML models.
  • We never send Google Calendar data, such as your calendar list or busy times, to the AI or search providers listed in Section 5.
  • We do not allow humans to read Google user data except (i) with your affirmative agreement for specific messages, (ii) for security or abuse investigation, (iii) to comply with law, (iv) to debug an issue you have reported, or (v) for aggregated, anonymized operational metrics.

You can revoke LetsCollab's access at any time by disconnecting Google Calendar from your in-app settings, or by visiting Google Account → Security → Third-party apps (opens in a new tab). Disconnecting deletes the stored refresh token from our systems within 7 days and stops further calendar API calls. Events already created on your Google Calendar through LetsCollab remain in your Google Calendar and can be managed there.

5. How We Share Information

We do not sell personal information. We share data only as needed to operate the Service, and only with service providers bound by confidentiality and data-protection obligations that limit their use to the services they perform for LetsCollab. We use the following categories of services:

  • Hosting and accounts: services that store your account, content and workspace data and support sign-in. Storage region: United States.
  • Transactional email: delivery services receive recipient details and the content of service messages.
  • Electronic signatures: signing services in the United States receive each contract you send for signature and its signers' names and email addresses, email each signer their signing link, and keep the signing audit trail.
  • Diagnostics: monitoring services receive technical error and performance information, with personal information filtered where configured.
  • Video hosting: service providers store and play uploaded videos and their thumbnails. Region: global.
  • Optional Google connections: Google when you choose Google sign-in or connect Google Calendar.
  • Optional product analytics: analytics services in the United States, only when you opt in through the privacy banner; we do not enable analytics when Global Privacy Control is signaled.
  • AI features: OpenAI (United States) handles what you ask an AI feature to work on, such as your profile, offers, requests, messages, contracts and search briefs. Other processing services assess incoming requests against your offers, using request details and your offers.
  • Search and public content: third-party services help find opportunities and read public websites and social posts. They receive relevant search terms derived from your brief and the public page addresses needed to provide the feature.

When a page shows a video or post from another service, that service receives information directly from your browser (see Section 6.1).

We may also disclose information to comply with applicable law, valid legal process, or to investigate suspected fraud, abuse, or harm. In the event of a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to standard confidentiality terms and continued protection under this Policy or a successor policy with substantively equivalent protections. We will notify affected users where required.

For international transfers from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on the EU Standard Contractual Clauses and equivalent UK and Swiss safeguards with our service providers.

6. Cookies, Local Storage, And Privacy Controls

Required cookies and local storage keep authentication, CSRF protection, and your privacy choices working. Optional analytics cookies help us understand product usage and page performance. You can accept, reject, or change optional analytics at any time: select Cookie choices at the bottom of our home page, legal pages, public profiles and offer pages to open the privacy banner again. When you are signed in, you can also change it in Settings → Preferences. If your browser sends the Global Privacy Control (GPC) signal, optional analytics remain off and are treated as a Do-Not-Sell/Do-Not-Share signal for California residents.

6.1 Videos And Posts From Other Services

When a page on LetsCollab shows a video or post from YouTube, Instagram, TikTok, Substack or a video hosting service, that service's own player loads in your browser. The service may set its own cookies and collect information under its own privacy policy. Instagram posts, YouTube players in list view and thumbnails from these services can load as you scroll, before you tap anything. If you reject optional cookies or your browser sends Global Privacy Control, we load these players only when you tap them, except Instagram posts when your browser can load them without sending your Instagram cookies and deletes any cookies Instagram sets when you leave the page. These players show content chosen by those services, which can include ads.

We use YouTube API Services to show YouTube videos. Google's Privacy Policy (opens in a new tab) explains how Google uses information. The other services explain what they collect in their own policies:

7. Data Retention

  • Account, profile, offer, request, message, invoice, contract, deliverable, and workflow data: retained while your account is active. When you delete your account, your public page, profile and sign-in are removed at once, and the rest of your data within 30 days (usually within two days). Requests that other people run keep the messages you sent them, with your name, as their records; invoices, contracts and payment records are kept where tax or contract law requires it (for example, tax records may be retained up to 7 years).
  • Google Calendar refresh tokens and connection metadata: retained while the connection is active. When you disconnect or revoke access, the refresh token and connection metadata are deleted from our primary systems within 7 days; encrypted backup snapshots are rotated out within 90 days.
  • Security and audit logs: retained up to 13 months for fraud, abuse, and incident investigation.
  • Product analytics events (collected only if you allow analytics, never while your browser sends Global Privacy Control): kept by our analytics service for 1 year. Deleting your account in the app does not remove them. To have them deleted too, email [email protected] from your account email, as described at the end of Section 8.

8. Your Rights And Choices

8.1 Account Deletion

You can delete your LetsCollab account at any time from Profile → More → Delete Profile. Deletion signs you out and removes your public page, profile and sign-in at once. Your offers, request data, attachments, drafts, searches, AI history, analytics, saved payment details, private notes and the encrypted Google Calendar refresh token are removed from active systems within 30 days (usually within two days), and from backups within 90 days. The people you worked with keep the requests they run, with the messages you sent them, and invoices, contracts and payment records stay where tax or contract law requires it. If you cannot access the in-app flow, email [email protected] from the email address on file and we will action the request within 30 days.

8.2 GDPR / UK-GDPR Rights (EEA, UK, Switzerland)

  • Right of access, rectification, erasure, restriction, and portability.
  • Right to object to processing based on legitimate interests.
  • Right to withdraw consent (e.g., optional analytics) at any time without affecting prior processing.
  • Right to lodge a complaint with your local supervisory authority.

8.3 California Rights (CCPA / CPRA)

  • Right to know what categories of personal information we collect, use, disclose, and the sources/purposes.
  • Right to delete personal information.
  • Right to correct inaccurate personal information.
  • Right to opt out of "sale" or "sharing" — we do not sell personal information and we honor Global Privacy Control as an opt-out of sharing.
  • Right to non-discrimination for exercising any of the above rights.

To exercise any of the rights above, email [email protected] from the email address on file. We will verify the request and respond within statutory time limits (typically 30 days for GDPR, 45 days for CCPA).

9. Security

We use reasonable technical and organizational safeguards, including TLS for browser-to-backend traffic, encrypted storage for OAuth refresh tokens, least-privilege backend access, audit logging, and regular dependency monitoring. No internet service can guarantee absolute security; if you believe your account or data has been compromised, contact us immediately.

10. Children

The Service is not directed to children under 13 and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact [email protected] and we will delete it.

11. Changes To This Policy

We will update this Privacy Policy when the Service, legal requirements, or our data practices change. We will revise the "Last updated" date above and, for material changes (especially any new use of Google user data), we will provide reasonable prior notice — through the app, by email, or both — and obtain consent where required before applying the change to existing data.

12. Contact

For privacy questions, data-subject requests, or Google user data concerns, contact [email protected]. We monitor this address and respond within 30 days.