How accounts are protected

What stands between your connected accounts and anyone else.

Tokens are encrypted

Network tokens are sealed with AES-256-GCM under a key held outside the database. A database dump alone cannot post as you.

Few passwords to lose

Most people sign in with Google, LinkedIn or X, so we hold no credential. Where there is a password it is hashed with bcrypt.

Short sessions

Access lasts fifteen minutes and a refresh thirty days. Signing out ends both.

One workspace per row

Every record is keyed to a workspace and every query is scoped to it on the server.

Roles on the server

Owner, admin, editor and viewer. A viewer cannot publish by finding the right URL.

Approval first

A new workspace holds every draft and first email for a person to read. Turning that off is a choice.

An audit trail

Who connected an account, approved a post or changed a schedule, recorded as it happens.

Permissions checked

Publishing is refused unless the stored token carries the permission the network needs.

How we comply

The rules that apply to what touchbase does, the practice that meets each, and the control that carries it.

• GDPR and UK GDPR

  Data is collected for a stated purpose and kept while the workspace exists. A copy, a correction or a deletion can be requested, and is answered within 30 days.

  Deleting a workspace removes its data by database constraint, not by a cleanup job.

• Email outreach rules

  First emails go to business addresses found published on the company’s own site, never guessed from a pattern. The sender is named, and the lawful basis is stored with every contact.

  An opt-out is checked before anything else happens to a reply and suppresses that person for the workspace at once.

• Google API Services User Data Policy

  touchbase asks for four Google permissions, each only when its feature is used, and complies with the Limited Use requirements.

  Mail access is send-only. Calendar access reads busy times, never meeting details.

• Network platform terms

  LinkedIn, Meta, X, TikTok and YouTube are reached through their official sign-in and publishing interfaces, with the permissions each requires.

  Disconnecting an account deletes its stored tokens, and you can revoke access from the network itself at any time.

• Payment card security

  Card details are entered with Stripe, which is certified to the PCI standard for handling them, and never reach touchbase.

  touchbase stores a plan and a Stripe customer reference, nothing a card can be rebuilt from.

• Infrastructure

  touchbase runs on Google Cloud, whose data centres carry their own independent audits, and the website is served through Netlify.

  Every other processor that sees customer content is listed under Who else sees it.

What we collect

Everything in the database, grouped by what puts it there. Each row exists because you connected something or asked touchbase to make something.

Your account

Name, email address and the workspace you belong to. If you sign in with Google, LinkedIn or X we receive your name, email and picture from them and hold no password of yours.

What your company sells

Your website address, your products, who you say buys them, and anything touchbase read off your own site when you asked it to.

What touchbase writes

Drafts, posts, images, videos, courses and ads, and the numbers the networks report back about them.

Connected accounts

Access and refresh tokens for the networks, mailboxes and calendars you connect, sealed with AES-256-GCM.

People you contact

Companies touchbase suggests, business addresses published on their own sites, and the messages sent and received. The page each address came from is stored beside it.

People who receive your emails

Their address and whatever you or touchbase knew about them, that an email was sent, when it was opened, which link was followed and the kind of device, and, if they unsubscribe, a record that they did. We do not store their IP address ourselves; our hosting provider’s request logs can include it for a limited time. You are the sender and the controller of this data, and we act on your instructions. A person who wants to see or delete it can ask you or us, and we pass the request on.

Presenters, voices and images

A photo or recording you give touchbase to build a presenter or a voice. It is used for your workspace only, is not used to train models, and is deleted with the workspace or on request. You confirm you have the right to use it and the consent of anyone in it.

Developer API

A fingerprint of each key, never the key, and a record of each call: when, what for and what it cost, so your balance and usage can be shown.

Billing

Your plan, your trial dates and a Stripe customer reference. Card details go to Stripe directly.

Last updated 2 October 2026.

Google account data

touchbase asks for four Google permissions, only when you use the feature that needs one. Signing in never carries calendar or mail access.

openid, email, profile

Signing in. touchbase learns your name, email and picture, and nothing else about your Google account.

calendar.freebusy

Reading when you are busy so an email can offer a real time. Never the title, the attendees or anything else about a meeting.

calendar.events

Creating the one meeting somebody books with you. Asked for separately, so a workspace that only wants times offered never grants it.

gmail.send

Sending an email you asked touchbase to send. Send-only: it cannot read, search, list or delete anything in your mailbox.

Who else sees it

Every third party that receives customer content, including the model provider, which is the one most products leave off.

Google Cloud

Hosting and the database.

OpenAI

Writing drafts and generating images. Receives your brand description, products and post topics.

Stripe

Payments. Card details go to Stripe directly.

Netlify

Serves the website in front of the application.

Networks and mailboxes you connect

They receive what you publish or send through them, under their own terms.

Canva and Slack

Only if you connect them, and only what those features need.

Your content is not sold and is not used to train anyone’s models. We share it with nobody outside this list except where the law requires it.

People you contact through touchbase

Written for the people on the receiving end as much as for the company sending.

• Found, not guessed

  touchbase finds business addresses by reading a company’s own public website and keeps the page each one was published on. It will not write to an address it only guessed from a naming pattern.

• The basis is recorded

  The lawful basis being relied on is stored beside every contact.

• Opt-outs come first

  An opt-out is honoured before anything else happens to a reply. The check runs first, by pattern match, with no model and no network call, so it can stop mail and can never start it.

• Removal is immediate

  Reply “unsubscribe” and you are suppressed for that workspace at once, or write to us and we remove you everywhere.

Keeping it, and taking it back

Data is kept while your workspace exists.

• Disconnect any time

  Disconnecting a network, mailbox or calendar deletes its stored tokens. You can also revoke touchbase from your Google account directly, without telling us.

• Delete the workspace

  Drafts, connected accounts, analytics, prospects, contacts, uploaded media and the audit trail are removed together, by database constraint.

• Published posts

  Posts already on the networks stay there, because they belong to the network now and are deleted there.

• Ask about your data

  Ask for a copy, a correction or a deletion and we answer within 30 days.

Terms of service

The agreement in plain sentences. Last updated 2 October 2026. Using touchbase means you accept these terms.

1. 1.What touchbase is

   Software that writes social posts, videos, courses and adverts for your company, publishes them to networks you connect, finds companies worth contacting, and sends and answers email from a mailbox you connect. You keep an account; we keep the software running.

2. 2.Your content is yours

   Everything you put into touchbase and everything touchbase writes for you belongs to you. We claim no ownership of it and do not use it to train models. We hold it only to run the service for you.

3. 3.You are the publisher

   touchbase drafts; you decide what goes out, and by default nothing is published until somebody approves it. If you switch that off, posts go out automatically and they are still yours. Anything published under your company name is your statement, and you are responsible for it being true, lawful and yours to say.

4. 4.What a model writes is a draft, not a fact

   touchbase is built to refuse invented claims a reply containing a number, price, date, link or name that is not on file is held for a person rather than sent, and a suggested company is dropped unless its domain and website can be checked. Those controls are mechanical and they are not complete. Read what goes out under your name.

5. 5.Accounts you connect

   You must be entitled to connect each network, mailbox and calendar you connect, and to publish or send from it. Each of those services has its own terms, and using touchbase does not change them: a network can rate-limit, refuse or remove what you publish, and we cannot overrule that.

6. 6.Outbound email is your responsibility

   You are the sender. touchbase writes and sends on your instruction, and you are responsible for what goes out and for having the right to send it to each person: a lawful basis under GDPR, PECR or CASL, or the sender and postal address details CAN-SPAM requires, whichever governs you or them. touchbase will not write to an address it merely guessed, adds an unsubscribe link to every email, and honours an opt-out before doing anything else with a reply; you must not remove that link, work around it or write to somebody again after they opted out. touchbase can add tracking to what you send, an image that shows an email was opened and links that record a click, and telling recipients about that wherever the law requires is yours. We do not promise an email is delivered, avoids a spam folder or gets a reply, and a mailbox provider can limit or suspend the mailbox you connect. Contact details touchbase finds come from public sources and are provided as they are. We may hold or stop sending from a workspace that appears to be harming recipients or the service.

7. 7.The unsubscribe page and attribution

   We host the page a person reaches from the unsubscribe link in your email. It shows your company’s name, logo, website and postal address, taken from your workspace, and a line saying the email automation is managed by touchbase, a product of TouchBase Technologies. You authorise that, and you keep those details accurate. An opt-out lasts for as long as your workspace exists unless the person asks to hear from you again.

8. 8.People, voices and third-party rights

   touchbase can make a presenter, a voice or an image from a photo or recording you provide. You confirm that you own, or have written permission for, everything you upload, including the right to use the likeness and voice of anyone in it. Do not use touchbase to imitate a real person without their consent, to mislead people about who is speaking, or to make content that is defamatory, infringing or unlawful. Generated content can resemble existing work by coincidence, we do not promise it is free of third-party rights, and checking before you publish is yours. We may remove content, or refuse to make it, where these rules are being broken.

9. 9.Advertising is billed to you by the network

   touchbase writes adverts and can create a campaign on an ad account you own, but the network bills your own card on your own account. touchbase is never the payer of record, holds no card for advertising and fronts no spend. A budget shown in touchbase is a number we stop the campaign at; it is not a guarantee against what a network charges you.

10. 10.Acceptable use

    Do not use touchbase to send unlawful, deceptive or harassing messages, to impersonate a person or organisation you are not, to publish content you have no right to, or to attack the service or anybody else through it. We may suspend a workspace doing any of these, and we will say why.

11. 11.Plans, trials and billing

    Every paid plan includes a trial of the length shown when you chose it. You give a card at signup and nothing is charged until the trial ends, at which point the plan you selected is charged automatically on its normal cycle. Cancel before the trial ends and you are not charged. Fees already paid are not refunded for a period already served.

12. 12.Ending it

    You can delete your workspace at any time, which removes everything belonging to it. We can end an account for non-payment or for a breach of the acceptable use section above, with notice except where the breach makes notice unreasonable. Posts already published stay on the networks, because they belong to the network once they are sent.

13. 13.What we do not promise

    touchbase is provided as it is. We do not promise it will be uninterrupted, that a network will keep working the way it does today, that a post will perform, or that a prospect list will convert. We are not liable for what you send or publish, for how recipients, platforms, mailbox providers or authorities respond to it, or for indirect or consequential loss. Where the law allows it, our total liability to you for any claim is limited to what you paid us in the twelve months before it arose, and nothing here limits liability that the law does not allow to be limited.

14. 14.Changes

    We will update this page when the software changes, and the date at the top will say when. A change that materially reduces what you get will be sent to the email on your account before it takes effect.

15. 15.The developer API and prepaid credit

    If you use the developer API, these terms apply to that use too, with the API terms you accept when you create a key. Keys are secret and you are responsible for every call made with yours. API usage is paid from credit you buy in advance and used as calls are made. Credit for a call that fails, or for the part of a request that could not be delivered, is returned to your balance. Except where the law requires otherwise, credit already bought is not refunded in cash. We may limit, suspend or revoke a key that is abused.

16. 16.Third-party services

    touchbase depends on services we do not run, including Google, Microsoft, Zoho, Meta, LinkedIn, X, TikTok, YouTube, Stripe and AI model providers. They can change, fail or end access without notice, some features wait on a platform’s own approval and are marked where that is pending, and your use of them is under their own terms. We are not responsible for what they do.

17. 17.Your responsibility for claims

    You will defend us against, and pay the costs and damages of, claims by third parties that arise from what you send or publish, the people you contact, what you upload, the accounts you connect, or your breach of these terms or of the law. We will tell you promptly about a claim and let you handle it, and you will not settle one that admits fault on our part without our agreement.

18. 18.Governing law

    If something goes wrong, contact us first and give us thirty days to put it right before either side starts a formal claim. These terms are governed by the laws of the jurisdiction in which TouchBase Technologies is established, and its courts have exclusive jurisdiction, except where the law of your country gives you a right to bring a claim elsewhere. We may give you notice by email to the address on your account or inside the product.

Contact and reviews

TouchBase Technologies operates touchbase.