Privacy Policy

Now What (now-what.app) grows the products you give it, using the accounts you connect and the authority you grant. This policy says what that requires us to collect, what we do with it, who else handles it, and how you remove it. Questions go to davemen@gmail.com.

What we collect

• Your account. Your name, email address and profile picture, from the sign-in you use (Google, or email with a code). Sign-in is run by Clerk.
• Your products. The addresses you give us, and what we read from those products’ public pages: what they sell, to whom, at what price, and how they appear in search and in AI assistants’ answers.
• Connected accounts. When you connect a tool such as an ad account, a store, analytics or Search Console, we read the data the capabilities you turned on need: spend, orders, revenue, traffic, search queries and similar figures. The sign-in tokens for those accounts are held by Composio, which makes the connections; Now What keeps a reference to each connection, not the password or token.
• Your decisions. Goals, budgets, capital you authorize, autonomy settings, guardrails and approvals, and a log of every action Now What proposes or takes for you.
• Billing. Payments are handled by Stripe. We keep your Stripe customer and subscription references and your plan, never your card number.

We set only the cookies sign-in needs. There are no advertising or analytics trackers on now-what.app.

How we use it

Only to run Now What for you: to understand your products, recommend and carry out growth work within the limits you set, measure what it did, and send you the weekly report (an admin can stop the email in Settings, under Notifications; the report is still kept in the app). We don’t sell your data, use it for advertising, or use one customer’s data to act for another.

Google user data

When you sign in with Google, we receive your name, email address and profile picture, and use them only to create and identify your account. When you connect a Google service (such as Google Ads, Analytics or Search Console), we use its data only to provide the features you turned on for that product. Now What’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use Google user data to train AI models, and no person at Now What reads it unless you ask us to for support, it’s needed for security, or the law requires it.

Email marketing (Klaviyo)

When you connect Klaviyo and turn on lifecycle messaging for a product, Now What reads the account’s list names, its flows’ names, status, trigger and creation date, its email template names, its metric names (to find “Placed Order”), its default sender name and address, and the totals Klaviyo reports for a flow Now Whatproposed: recipients, deliveries, opens, clicks, unsubscribes, and the number and value of the orders Klaviyo attributes to it. It doesn’t read your subscribers’ profiles or email addresses. If you approve a welcome email, Now What creates it in your Klaviyo account as an email template and a draft flow that uses it; the flow sends nothing until it is turned on. Turning it on is a separate proposal you approve each time: then Now What sets that flow live, and if you stop it, sets it back to a draft. Its text is written from your product’s name and address, not by an AI provider, and nothing from Klaviyo is sent to one.

AI providers

• OpenAI, or Anthropic or Google (Gemini) when OpenAI can’t take the request, reads your product’s public pages to describe the product, and drafts changes such as a page title or headline. For a draft it receives that page’s text and only the figures the change is based on, for example the Google searches that showed the page, or sign-up and activation counts for an onboarding page. We send OpenAI’s requests with storage turned off.
• OpenAI, Anthropic, Google (Gemini) and Perplexity are asked the questions a buyer might ask, such as “what are the best alternatives to …” your competitors, to see whether their answers mention your product. Those questions name your category, audience and competitors, and contain nothing from your connected accounts.

We use these providers’ business APIs, whose terms don’t let them train their models on what we send.

Who else handles your data

Service providers that run parts of Now What, each only for that purpose:

• Vercel: hosting
• Neon: the database
• Clerk: sign-in and accounts
• Composio: connections to your other tools
• Stripe: payments
• Resend: sending email
• OpenAI, Anthropic, Google and Perplexity: as described above

Actions you authorize go to the platform they belong to, such as a budget change to your ad account. We disclose data otherwise only if the law requires it.

Keeping and deleting it

We keep your data while your account exists. Deleting your account (Settings → Your sign-in) deletes your workspace and everything in it: products, connections, history and settings. Database backups roll over and drop it within weeks. An admin can also delete one product from Settings, which deletes everything Now What kept for it; the workspace’s activity log keeps a line saying who deleted it, with its name and address, and AI usage records stay with the workspace without the product. Disconnecting a tool stops Now What reading it; you can also revoke access from that tool’s own settings, for Google at myaccount.google.com/permissions. To get a copy of your data or have it corrected or deleted, email davemen@gmail.com.

Security

Data is encrypted in transit and at rest. Every request checks whose workspace it is for, and Now What acts on a connected account only within the capability, budget and guardrails you granted.

Children

Now What is a service for businesses and isn’t meant for anyone under 16.

Changes

We’ll post changes here with a new date, and email you before any change that widens how your data is used.