Last updated: October 27, 2026
Long Group, LLC, doing business as Long & Co. Technologies ("we", "us"), makes LongCoreHQ, available at longcorehq.com and app.longcorehq.com. This policy explains what we collect, why, who we share it with, and the choices you have.
Questions or requests: ryan@longcotechnologies.com.
What we collect
Account information. Your name, email address, and sign-in details. If you sign in with Google, Microsoft, or Apple, we receive your name and email from that provider.
Company information. The company workspaces you belong to, your role in each, and the products your company has bought.
What you put into LongCoreHQ. Contacts, companies, deals, notes, tasks, files, and other records you or your coworkers enter.
Connected mailboxes and calendars. If you choose to connect a Gmail, Google Calendar, Outlook, or Microsoft 365 account to SalesHQ, see "Connected email and calendar" below.
Billing. Our payment provider, Stripe, handles card details. We receive only what we need to run your subscription, such as plan, status, and the last four digits of the card.
Usage and technical data. Pages visited, actions taken, device and browser type, IP address, and error reports, used to run, secure, and improve the service.
Waitlist. Your email and consent if you join the waitlist on longcorehq.com.
Connected email and calendar
SalesHQ can connect to your Gmail and Google Calendar, or your Outlook and Microsoft 365 mail and calendar, only when you choose to connect them. You can disconnect at any time.
What we access. When connected, SalesHQ reads the email messages (headers, body, and attachment names and sizes) and calendar events from the last 12 months, plus meetings scheduled up to 6 months ahead, and from then on. It sends email that you write in SalesHQ from your own mailbox. If an admin connects a shared mailbox (such as sales@), the same applies to that mailbox.
Google permissions we ask for. When you connect a Google account, we ask Google for:
- your basic profile and email address (openid, email), to know which account you connected,
- read and organize your Gmail (gmail.modify), to sync your mail and keep it up to date as it changes,
- send email as you (gmail.send), to send the email you write in SalesHQ,
- read your Google Calendar (calendar.readonly), to show your meetings. We do not change your calendar.
Why. Only to provide LongCoreHQ features you can see:
- show your emails and meetings with a contact on that contact's, company's, and deal's page,
- suggest new contacts from people you correspond with,
- let you write and reply to email from inside SalesHQ,
- file your synced mail into your company's brain in BrainHQ, so you can search it and ask questions about it.
Filing mail into the brain. When new mail arrives in a connected Gmail account, LongCoreHQ files it into the brain automatically, without you asking each time. To make it searchable by meaning, we send the text of each filed message to our AI provider, which turns it into numbers called embeddings. We store the embeddings with the filed mail. AI features may later read filed mail to pull out facts and to answer your questions.
Who can see it. Your mail and meetings are visible only to you until you choose to share them. When you choose to share with a contact, your mail and meetings with them become visible to coworkers in your company who have SalesHQ access, so the team shares one history. In your own mailbox, mail and meetings with your coworkers are never shared, and neither are meetings your calendar marks private. You can mark any thread or meeting private, which hides it from everyone but you. If your company connects a shared inbox, such as sales@, its mail and meetings are visible to everyone in your company who uses SalesHQ, except items an owner or admin marks private. Anyone who can edit in SalesHQ can send from it, and each message shows who wrote it. People outside your company never see your mail.
What we do not do. We do not:
- sell your email or calendar data,
- use it for advertising, including targeted or interest-based ads,
- let people read it, except (a) with your permission, (b) when needed for security, such as investigating abuse, (c) to comply with the law, or (d) when it has been made anonymous and combined for running the service,
- use it to train or improve general-purpose AI or machine learning models,
- transfer it to anyone except as needed to provide the features above, for security, to comply with the law, or as part of a merger or sale of the business with notice to you.
Attachments on synced mail are not copied. SalesHQ shows each attachment's name and size and opens it from your mailbox when you ask. Files you attach to an email in SalesHQ are held in private storage only until it is sent, then deleted; if sending is interrupted, they are deleted within a day.
Security. Access tokens for connected mailboxes are encrypted and stored separately from other data. They are never shown in the browser or to other users.
When you disconnect, we stop syncing right away, revoke our access with Google or Microsoft, and delete the access tokens. Mail from people who are not contacts, and threads you marked private, are deleted. Mail already shared on a contact's history stays as part of your company's record, and your company can delete it.
Google API Services. LongCoreHQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we use information
- To provide LongCoreHQ and the features you use.
- To keep it secure, prevent abuse, and fix problems.
- To bill your company.
- To contact you about your account, and, with your consent, about LongCoreHQ news. You can opt out of news at any time.
- To comply with the law.
AI features
Some LongCoreHQ features use AI to help you, such as the chat box. AI features can read data you can already see, including synced email, to answer you. Mail filed into the brain is also sent to AI automatically, to create its embeddings, as described above.
Included AI runs through Vercel AI Gateway, which passes the request to the AI model provider we turn on, such as Google (Gemini) or OpenAI.
Your own AI key. If you or your company connect your own Anthropic (Claude), OpenAI (ChatGPT), or Google (Gemini) account, requests you send that way go to that provider under your own agreement with it.
We do not use data from Google, including your Gmail and Google Calendar data, to train, develop, or improve AI or machine learning models, and we require the AI providers we use not to train their models on it.
Who we share it with
We share data only with providers that help us run LongCoreHQ, under contracts that limit their use of it:
- Supabase (database and sign-in)
- Vercel (hosting, and Vercel AI Gateway for included AI)
- Stripe (payments)
- Resend (email delivery)
- Google and Microsoft (only for sign-in and the mailboxes you connect)
- AI model providers reached through Vercel AI Gateway, such as Google (Gemini) and OpenAI (included AI and brain embeddings)
- Anthropic, OpenAI, or Google (only when you or your company connect your own AI key)
We also share data if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business.
Your company's workspace data is visible to the people your company gives access to, according to the roles it sets.
How long we keep it
We keep your data while your account or company's subscription is active. When a company closes its workspace, we delete its data within 30 days, except what we must keep for legal or billing reasons. Backups roll off within 30 more days.
Your choices and rights
You can view and edit your profile, disconnect mailboxes, and ask us to access, correct, export, or delete your personal information. Email ryan@longcotechnologies.com. If you live somewhere with privacy laws that give you extra rights (such as the EU, UK, or California), we will honor them. We do not sell or "share" personal information as California law defines those terms.
If your company gave you your account, some requests may go through your company's admin, since they control the workspace.
Security
We protect data with encryption in transit and at rest, strict separation between companies, role-based access, and access limited to people who need it. No system is perfectly secure; we will tell you promptly if a breach affects your information.
Children
LongCoreHQ is for businesses and is not meant for anyone under 16.
Changes
If we change this policy in a way that matters, we will tell you by email or in the product before it takes effect.