Privacy Policy

Last updated: July 12, 2026

Conduit ("we," "our," or "us") operates the buildyourconduit.com website and the Conduit integration platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

We collect the following types of information:

  • Account information: When you sign up, we collect your name, email address, and authentication credentials via our authentication provider (Clerk).
  • API credentials and access tokens: You may provide API keys, or connect accounts via OAuth (for example, your Google account), for third-party services such as Metabase, Mixpanel, HubSpot, Google Sheets, Airship, and Instantly.ai. These credentials and tokens are encrypted at rest using AES-256-GCM encryption.
  • Sync data: When automations run, we temporarily process data from your configured data sources (e.g., a Metabase question or a Google Sheets spreadsheet) to sync it to your configured destinations (e.g., HubSpot or a Google Sheets spreadsheet). We do not permanently store the contents of your synced data.
  • Usage and log data: We collect sync logs, error reports, and general usage information to operate and improve the Service.

2. How We Use Your Information

  • To provide and maintain the Service
  • To execute data syncs between your configured sources and destinations
  • To send you error notifications and service updates
  • To monitor and improve the reliability and performance of the Service
  • To respond to your requests and support inquiries

3. Data Storage and Security

Your data is stored in secure, managed databases hosted by Supabase. API credentials are encrypted at rest using AES-256-GCM encryption and are never logged or exposed in plaintext. We use industry-standard security practices to protect your information, but no method of transmission over the Internet is 100% secure.

4. Third-Party Services

We use the following third-party services to operate the platform:

  • Clerk for authentication and user management
  • Supabase for database hosting
  • Vercel for application hosting
  • Metabase, Mixpanel, HubSpot, Google Sheets, Airship, and Instantly.ai as configured by you for data integration

Each third-party service has its own privacy policy governing its use of your data.

5. Google User Data and Limited Use

When you connect a Google account, Conduit requests only the drive.file scope, which grants per-file access limited to the specific Google Sheets you explicitly open or select through the Google Picker. This scope lets Conduit read from and write to only those spreadsheets you choose. We use this access solely to move data into or out of the specific spreadsheets you configure in an automation. Conduit does not request access to your full Google Drive or to any files you do not explicitly select.

Conduit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data for advertising, we do not sell it or transfer it to third parties for purposes unrelated to providing the Service, and we do not allow humans to read your Google data except with your explicit consent, where necessary for security purposes (such as investigating abuse), or to comply with applicable law. You can revoke Conduit's access at any time from the Settings page or from your Google Account permissions.

How Google data is transferred: When you build an automation, the spreadsheet data you select is read from your source and written to the destination you choose (for example, another Google Sheets spreadsheet). In transit, that data is processed by our infrastructure subprocessors, Supabase (database) and Vercel (application hosting), solely to operate the sync you configured. We do not sell your Google user data, and we do not transfer it to data brokers, advertisers, or any third party for purposes unrelated to providing the Service.

How Google data is protected, retained, and deleted: Your Google OAuth refresh and access tokens are encrypted at rest using AES-256-GCM and are transmitted only over TLS. Conduit does not permanently store the contents of your spreadsheets; rows are processed transiently in memory while a sync runs. Your tokens are deleted when you disconnect Google in the Settings page or revoke access from your Google Account permissions, after which Conduit can no longer access any of your spreadsheets.

6. Data Retention

We retain your account information and automation configurations for as long as your account is active. Sync logs are retained to provide you with historical run data. You may delete your account and associated data at any time by contacting us.

7. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Disconnect third-party integrations at any time via the Settings page

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at support@buildyourconduit.com.