← Needo

TRUST

Privacy Policy

Last updated: 12 November 2026. Needo is operated by Sanfy Consultancy Services Pvt. Ltd., Prayagraj, Uttar Pradesh, India ("Needo", "we", "us").

Needo processes the information you provide to understand and work on your requested outcome. We collect only what is needed to provide the service.

What we process

Depending on your request: account information (name, email), your request text, solution history, uploaded images or documents, location only when you explicitly share it, payment status from our payment provider (we never receive or store full card details), and basic usage and attribution data. Public and authorized sources may be researched to answer requests.

Google user data

If you choose to connect your Google account (Gmail), Needo requests only these permissions:

  • gmail.send: to send emails you have reviewed and explicitly approved in Needo (for example, first-contact emails to the buyers in your Verified Shortlist and up to two follow-ups in the same thread), from your own address.
  • gmail.metadata: used only to read the metadata (From, To, Subject, Date, labels and message/thread identifiers) of the specific threads that Needo itself created on your behalf, so we can tell you when a recipient replies, detect bounced emails and stop follow-ups after a reply. This permission cannot read the body or attachments of any email. Needo does not search or browse your mailbox and does not access conversations Needo did not start.
  • Your Google account email address, to identify which account is connected.

What we store from Google: your connected email address, encrypted OAuth access/refresh tokens, and for Needo-sent messages only the message ID, thread ID, send time and reply/bounce status. We do not store the content of emails you receive.

Limited Use. Needo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data is used only to provide and improve the user-facing features described above; it is not transferred to others except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with notice to you; it is never used for advertising, never sold, and never used to determine credit-worthiness or for lending; and it is not used to develop, improve or train generalized or non-personalized AI or machine-learning models. No person at Needo reads your Google user data unless you give explicit consent for a specific message (for example, a support request), it is necessary for security purposes such as investigating abuse, or it is required by law.

How we protect your data

  • Encryption in transit: all traffic between your browser, Needo and Google uses HTTPS/TLS.
  • Encryption at rest: Google OAuth access and refresh tokens are encrypted with AES-256-GCM before they are stored, with the key held separately from the database. Our database and backups run on managed cloud infrastructure that encrypts stored data at rest.
  • Least privilege: tokens are decrypted only at the moment an approved action or reply check runs, in server-side code, and are never sent to your browser or to AI providers. Access to production systems is limited to authorised Needo personnel who need it to operate the service, using individual, protected accounts.
  • Data minimisation: we request the minimum Gmail permissions needed, read only metadata of Needo-created threads, and keep Gmail-derived records only as long as needed (see Retention).
  • Approval gates: nothing is sent from your account without your explicit approval in Needo, and you can pause or disconnect at any time.
  • Monitoring and response: we log access to sensitive operations, review errors and suspicious activity, and if a security incident affects your personal data we will notify you and the relevant authorities as required by applicable law.

Retention and deletion

  • You can disconnect Gmail at any time in your Needo account; we then delete the stored tokens immediately and stop all Gmail access. You can also revoke access at myaccount.google.com/permissions.
  • Gmail-derived records (message/thread IDs and reply status) are kept while your outreach is active and deleted within 90 days after it ends, or immediately when you delete your account.
  • When you delete your Needo account, we delete your account data, connected-account tokens, saved solutions and outreach records within 30 days, except records we must keep by law (for example, payment and tax records).
  • To request access, correction or deletion of your data, contact us using the details below.

Private solution archive and product improvement

Needo stores generated solution text, the request that produced it, available source references, status and basic acquisition context in a restricted internal archive for service continuity, quality review and product improvement. This never includes Google user data. The archive is private and is not a public case-study library. Public sharing is a separate user action; Needo Moments are created only when a user explicitly chooses to share. Avoid submitting secrets or highly sensitive personal information unless it is necessary for your request.

Optional ChatGPT connection

If you choose to connect your Needo account to ChatGPT, Needo verifies your existing account using a one-time email or mobile code. After you approve the connection, ChatGPT can request the account name and email, current plan status, research-credit balance, your saved Lead Finder search history and the saved lead details for searches you are permitted to view, and your saved Needo solution history. Lead details may include company names, business contact names, business email addresses, phone numbers, websites, locations and source references already present in your Needo results.

The first release is read-only. ChatGPT cannot start a paid search, spend or reserve credits, purchase a plan, make a payment, send an email, share results externally or change your Needo account through this connection. Needo checks account ownership on every data request. The gateway does not maintain a separate copy of returned lead or solution content; it retrieves that content from your Needo account when requested.

The separate gateway stores your internal Needo account reference for the connection, registered OAuth client metadata, short-lived authorization state, and hashes of access tokens, refresh tokens and authorization codes. It does not store plaintext access or refresh tokens, OTP codes, payment-card details or your Needo browser session cookie. You can disconnect the connection in ChatGPT; revoking the connection prevents further use of its tokens. You can also contact Needo to request account-data access or deletion as described below.

When you use the connection, information you choose to request may be sent to ChatGPT and processed by OpenAI under OpenAI's own terms and privacy policy. Review those terms before connecting. Needo does not control OpenAI's retention or handling of conversation data.

How we use data

We use information to provide, secure, improve and support Needo's user-facing features, to process payments, and to send emails you asked for (results, reports, alerts and follow-ups you can unsubscribe from). We do not sell personal data and do not intentionally collect private browsing activity or infer private intent about other people.

Sharing and third parties

We use service providers to run Needo: cloud hosting and database, AI and web-search providers (which receive your request text, never Google user data), Razorpay for payments, and email delivery. They process data on our behalf under their terms and privacy practices. Needo Moments are public only when you explicitly create and share one.

Sourcing requests and buyer introductions

If you send a "Source from India" request, we use your details to email you matching Indian suppliers. If you tick the box allowing it, we also share your requirement and contact details with at most 5 verified Indian exporters of that product, who may contact you with quotes. You can withdraw this at any time by emailing us; we then stop sharing your request.

Business contacts and outreach

Needo researches business contact details that companies publish themselves (their own websites or official trade directories) and may email businesses once or twice about relevant trade opportunities. Every such email includes a one-click opt-out, and we honour opt-outs permanently. If you are a business and want your details removed from Needo, email us and we will remove them within 7 days.

Your rights (India DPDP Act, GDPR and others)

Wherever you are, you can ask us to access, correct or delete your personal data, withdraw consent, or object to outreach, by emailing the address below. For people in the EU/UK, we process business contact data on the basis of legitimate interest in business-to-business communication, and request and account data to provide the service you asked for. Data may be processed in India and by our cloud providers in other countries under appropriate safeguards.

Your controls

You can use Needo without an account for the anonymous free allowance. Logged-in users can review saved solutions, disconnect integrations, unsubscribe from emails and delete their account. Sensitive or irreversible actions require approval.

Contact

Privacy questions, data requests or security reports: shahkar@sanfyservices.com · Sanfy Consultancy Services Pvt. Ltd., 651/2, Wasiyabad, Prayagraj 211003, Uttar Pradesh, India.

Read Terms → · Refund policy → · Contact →