Good Company

Privacy policy

Last updated November 4, 2026.

This policy covers Good Company, including the portal at app.dareactivation.com: the place where you chat with Cass, sign in, set up your team of AI agents, connect your tools, and review their work.

Who we are

Good Company is run by Darius Dimitriadis, doing business as Dare Activation, in Ontario, Canada. Mailing address: 1108 - 250 Consumers Road #247, North York, ON M2J 4V6, Canada. Privacy questions and requests: support@dareactivation.com.

The chat with Cass, before you have an account

What you tell Cass is used to design your team. The text is sent to Anthropic's Claude API, which processes it for us.

You can start the chat without an account or an email address. When you do, we set one cookie in your browser, named gc_guest, that ties your browser to your chat. It is signed so it cannot be forged, hidden from scripts on the page, and lasts 7 days. If a link brought you here with a short source tag (for example where you found us), we keep that tag with your chat. If you typed your first answer on our home page, a second cookie, named gc_q, carries those words to the chat once. It is hidden from scripts on the page and lasts 10 minutes.

If you leave before giving an email, we keep that chat for up to 7 days so you can come back to it. After 7 days we delete the chat and all of its data, automatically. If you give an email and open the sign-in link, the chat becomes your account. If that email already has an account, you choose after signing in: use the new team (we keep a copy of your current team and can bring it back if you ask) or keep your current team (we save the new design in your account, under Settings). Either way the separate chat is then deleted. If you don't choose, it is deleted after 7 days.

To protect the service from abuse, we use a bot check from Cloudflare (Turnstile) and limits on how many chats and answers one network can use. We store your IP address only as a salted hash, never the address itself: with your chat, in the limit counters and in the short log of blocked attempts. The counters run for a day or less, and blocked attempts are deleted after 7 days.

When your blueprint is ready, we ask where to send it. We use that email to send the blueprint and a sign-in link. A separate box, unticked unless you tick it, asks whether we may also send you tips and product news.

If you tick the box, we keep a record of your consent: your email, the exact words you agreed to, which version they were, the time, the page, the sender details shown to you, and a salted hash of your IP address (never the address itself). If you unsubscribe, we keep your email and the time so we never email you again.

If you buy a plan, we may also send you tips on using your team, like the weekly recap, without the box, because you're a customer. That stops 2 years after your last payment, or straight away if you unsubscribe. Emails about the plan itself, like receipts, renewal notices and payment problems, still go while you have one. Each send record notes why we were allowed to send it.

For every email we send you about your account or your team, we keep a short send record: which email it was, the address, when it was due and sent, which of two subject lines you got, why we were allowed to send it, and, if your mail app reports it, when it was opened or a link in it was clicked. We use this to avoid sending too many emails, to stop a series once you have done the thing it was about, and to make our emails better. If an email bounces or is marked as spam, we keep the address on a do-not-send list.

How you use the app

We don't use analytics cookies unless you say yes in the cookie banner. If you say no, or ignore it, no analytics code is loaded. If you say yes, we use PostHog to count page views, which cards on your home screen you see and use, and clicks on the main buttons, and to record sessions so we can see where the app is confusing. Everything you type is hidden in recordings, we respect Do Not Track, and the events carry no email address or name. You can change your answer with the “Cookie choice” link in the footer. Your answer is kept in your browser's local storage (gc-analytics-consent).

What we collect, and why

  • Your account. Your email address, so we can send you a sign-in link and know which team is yours. We keep a session cookie so you stay signed in.
  • Your setup answers and files. What you tell us about your work, goals and preferences, any files you add, and anything you paste from another AI assistant such as ChatGPT or Claude (only the lines you choose to keep are saved), so your team is built for you and follows your rules.
  • Your team's work. Chat messages, tasks, drafts, approvals, the corrections you make and the rules your team learns from them, so you can see what was done and the team improves.
  • Connections. When you connect a tool, we store the access it grants (encrypted) and the items your team needs to do the job you asked for. The Google section below covers Google accounts in detail.
  • Other apps. Many apps (for example QuickBooks, HubSpot, Notion, Slack or Calendly) connect through Nango the same way as Google: the app's sign-in screen may show Nango, and Nango holds the access tokens, not us. Apps you connect with a private key (for example Airtable, Square or Shopify) store that key encrypted with a key unique to your account; it is sent only to that app's own address and never shown to an AI model. In every app your helpers read what the job needs; anything they would add or change waits for your approval, and our software blocks deleting, sending, publishing, payments and account settings. Every call is logged in your account.
  • Billing. If you choose a plan, Stripe takes your payment. The Billing section below says what we keep.
  • Usage and safety records. Logs of what each agent did and what it cost, so you can check the work and we can keep the service secure and within your plan.

Google user data

You can connect Google Calendar, Google Sheets, Google Drive (and Docs) and Gmail. You choose whether to connect each one, you can connect more than one account, and you can disconnect at any time.

Who holds your Google sign-in: Nango

We connect to Google through Nango (Nango, Inc., United States), an integration service. When you click Connect, the Google sign-in screen shows the name Nango, not Good Company. That is expected: Nango registered the Google app, keeps the access tokens Google issues, and passes our requests to Google. We never store your Google password or your Google tokens ourselves. We keep only a reference to the connection and the account's email address, so you can tell your accounts apart.

Later we plan to move to our own Google app. When we do, the sign-in screen will show Good Company, you will be asked to reconnect once, and we will update this page first.

What Google lets us access, and what our helpers actually do

Google grants these permissions in broad terms. Our software limits what your helpers can do with them: they read, they write drafts, and anything that leaves your account waits for your approval.

  • Gmail (full Gmail access, https://mail.google.com/). Helpers read your recent email and write drafts in your Gmail. An email is sent only after you approve it in the portal. Helpers never delete, archive, label or forward your email, and never change your Gmail settings. Our software blocks those actions even though Google's permission would allow them.
  • Google Calendar (calendar). Helpers read your events so they can plan around your schedule, and add an event only after you approve it. Events are added without guests, so no one else is invited or emailed.
  • Google Sheets (spreadsheets). Helpers read the sheets you point them to and add rows only after you approve them.
  • Google Drive and Docs (drive). Helpers find and read the files and documents you point them to, by name or link. They never change, share or delete your files.

How we use it

We use Google user data only to provide and improve the user-facing features you asked for in the portal: your helpers reading the email, events, sheets and files they need for the jobs you gave them, writing drafts, sending the emails and adding the events and rows you approved, and showing you that work.

If we ever want to use your Google data in a new way, or ask Google for more access, we will update this page and ask you again before using it.

Limited Use. Good Company's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • No selling. We do not sell Google user data, and we do not transfer it to anyone except as needed to run the features you use, to comply with the law, or as part of a merger or sale of the business with notice to you.
  • No ads. We do not use Google user data for advertising, including retargeting, personalized or interest-based ads.
  • No human reading. No person reads your Google user data unless you give us permission for specific messages (for example, when you ask for help with a problem), it is needed for security (such as investigating abuse or a bug), or the law requires it. In those cases we look at only what is needed.
  • No training of general AI models. We do not use Google user data to develop, improve or train generalized or non-personalized AI or machine learning models. The rules your own team learns from your corrections stay with your team and are not shared with anyone else.
  • No credit or lending decisions. We do not use Google user data to determine credit-worthiness or for lending purposes.

Who processes it for us

  • Nango (Nango, Inc., United States): holds the Google and Microsoft access tokens and passes our requests to Google and Microsoft. It does not use your data for its own purposes.
  • Anthropic (Claude API): the relevant text is sent to it to draft and check your team's output. Anthropic processes it on our behalf under its commercial terms, which do not allow it to train its models on that data.
  • Our hosting and database providers store it for us. None of them may use it for their own purposes.

How we protect it

Google access tokens are held by Nango, not by us. Other access tokens and keys we store are encrypted at rest. Data moves over encrypted connections (HTTPS). Each customer's data is kept separate from every other customer's.

How long we keep it

We keep Google user data only while your Google account is connected and your team needs it to do the work you asked for. When you disconnect a Google account, we remove the connection in Nango too, and your team stops using that account. When you delete your account, we delete all of your data, including Google user data, from our database right away.

How to revoke access and delete your data

  • In the portal, go to Connections and choose Disconnect next to the Google account.
  • At any time, remove Nango (the name on the Google sign-in screen) from your Google Account at myaccount.google.com/permissions.
  • In Settings, choose Download my data for a copy, or delete everything. Deleting everything also revokes our Google access.
  • Or email support@dareactivation.com and we will delete your data and confirm by email.

Microsoft accounts: Outlook, Teams and Excel

You can connect Outlook, Microsoft Teams and Excel (work, school or personal Microsoft accounts). You choose whether to connect each one, you can connect more than one account, and you can disconnect at any time.

These also go through Nango (Nango, Inc., United States). The Microsoft sign-in screen shows the name Nango, Nango keeps the access tokens Microsoft issues, and passes our requests to Microsoft Graph. We never store your Microsoft password or tokens. We keep only a reference to the connection and the account's email address, read once from your Microsoft profile, so you can tell your accounts apart.

Microsoft grants these permissions in broad terms. Our software limits what your helpers can do with them: every request is checked against a short list before it leaves, and anything that leaves your account waits for your approval.

  • Outlook (Mail.Read, plus offline_access and User.Read). Helpers read your recent email. A reply waits in Approvals for your OK, ready for you to send. They never send, delete, move or forward your email, and never change your mailbox settings or rules.
  • Microsoft Teams (Chat.ReadWrite, ChannelMessage.Read.All, ChannelMessage.Send, Team.ReadBasic.All, Channel.ReadBasic.All, Directory.Read.All, Group.ReadWrite.All, plus offline_access and User.Read). Helpers read your chats and channel messages, and post a message only after you approve it. The directory and group permissions come with the sign-in; our software never reads your organisation's directory and never creates, changes or deletes a group, a team, a channel, a member or a message.
  • Excel (Files.Read, plus offline_access and User.Read). Helpers find and read the workbooks you point them to, by name or link. They never change, share or delete your files. If Excel later allows adding rows, a row is added only after you approve it, as plain text.

Work and school accounts. Some organisations require their IT admin to approve an app before staff can connect it, especially for Teams. If that happens, Connections says so, and nothing is connected until your admin approves.

We use Microsoft data the same way as Google data above: only for the features you asked for, never sold, never for ads, never read by a person without your permission (except for security or the law), and never used to train general AI models. Disconnecting in Connections removes the connection in Nango too. You can also remove Nango from your Microsoft account at myaccount.microsoft.com (Apps and services), or your IT admin can remove it for a work account.

Billing, refunds and pauses

Stripe handles your card. We never see or store the full card number. We keep your plan, billing status, renewal date, pauses used and any money-back request with the note you wrote, so a person can review it.

Referrals

If someone joins with your referral link, we record that link between your account and theirs, so the rewards can be applied. We never email your friends. You share the link yourself.

Your public share page

It is off unless you turn it on. When it is on, anyone with the link can see your helpers' names, roles and what they are ready to do. It never shows your answers, files, contacts or work, and it asks search engines not to list it. Turning it off removes the link.

Sharing

We do not sell your information. We share it only with the service providers above (including Stripe for payments and Cloudflare for the bot check), to run the portal, or when the law requires it.

How long we keep it

A chat without an email: up to 7 days, then deleted with its data. The gc_guest cookie also lasts 7 days. The gc_q cookie lasts 10 minutes. Your account and your team's work: while you have an account. If you delete your account in Settings, we delete your data from our database.

Your choices and rights

You can unsubscribe from tips and product news at any time with the link in any email. You can see, download, correct or delete what we hold about you. Most of it is in the portal; for anything else, email support@dareactivation.com.

Where we offer this

Good Company is not available in Quebec yet.

Changes

If we change this policy, we will update the date at the top of this page, and email you before a significant change takes effect.

Contact

Questions about privacy: support@dareactivation.com. Dare Activation, Ontario, Canada.