Effective date: 24 September 2026. Last updated: 24 September 2026. Version: 2026-09-24.
GoUltra Systems LLC, a Wyoming limited liability company. Postal address: 312 W 2nd St #2692, Casper, WY 82601, USA. Support: support@goultra.ai. Privacy: privacy@goultra.ai.
Designated privacy contact where required: privacy@goultra.ai.
1. Scope identity and roles
GoUltra Systems LLC operates goultra.ai, go.goultra.ai and the GoUltra mobile applications. It controls processing for its account administration, billing administration, support, security and its own website and product usage information. For contacts, messages and other information processed on a business Customer's instructions, that Customer normally controls the processing and GoUltra acts as processor under the DPA. A Customer that is itself a processor remains responsible for its controller's instructions. A provider may act in different roles for different services. Contact privacy@goultra.ai about this policy or rights.
2. Information and sources
Depending on use, we process account and business contact details; authorized-user, device and installation identifiers; authentication and subscription references; interactions, diagnostics and support correspondence; contact names and telephone numbers; WhatsApp profiles, messages and metadata; images, video, voice notes and documents; templates, notes, appointments, quotes and signing records. Information comes from you, your business and its users, people communicating with it, connected platforms and devices. A business may provide information about someone who has no GoUltra account. Full payment-card details entered in Stripe, Apple or Google payment interfaces are not received by GoUltra. We do not import the device address book or request precise or coarse device location for the current applications.
3. Purposes and legal bases
For our controller activities, we use account and business-contact information to establish and administer access, billing and support. Contract necessity applies where the individual is party to the relevant contract; appropriate business-contact administration and security may rely on legitimate interests after the required assessment, rather than assuming every employee is a contracting party. Required accounting, legal and regulatory records rely on the applicable legal obligation. Optional analytics, advertising measurement and communications use consent or another lawful route only where the relevant law allows it and its conditions are met. Our interests include operating a reliable service, preventing fraud, protecting accounts and resolving support issues. Customer-directed messages and appointments are processed under the Customer's instructions, not under a blanket GoUltra consent. We collect information necessary for the chosen function; if necessary information is not supplied, that function may be unavailable. Optional choices do not become conditions of unrelated basic access.
4. Retention by purpose
Account and business-contact records are kept while needed to operate the account, then deleted or restricted under the deletion process. Subscription, invoice and transaction references are retained for applicable tax and accounting duties and the resolution of actual payment disputes. Security and audit records are limited to the period needed to investigate incidents, prevent repeated abuse and meet applicable legal duties. Support correspondence is retained while resolving the issue and any justified follow-up or dispute. Optional analytics follows the configured retention disclosed in Cookie settings. Customer messages, media, contacts and appointments follow the Customer's instructions and account-deletion process. We periodically review these purposes and erase or anonymize records when they no longer apply. A possible future need does not justify indefinite retention. The DPA states verified backup maxima and cleanup delay; a maximum schedule does not override a requirement to erase sooner.
5. Device permissions and notifications
Camera, photo and microphone access is requested for a capture, upload or recording action you choose. Notification permission supports operational alerts and can be denied in device settings without preventing basic account access. Push messages are generic by default. If a device's previews are enabled, its notification may contain the sender's name and a message preview. Routing information can include a conversation telephone number and internal identifiers. Push payloads do not include account credentials, authentication codes, payment information or media attachments. Authorized conversation content is retrieved through the application. Firebase Cloud Messaging, Apple Push Notification service and applicable diagnostics providers process the data described in the recipient register.
6. Google Calendar information
Connecting Google Calendar authorizes the account identity and calendar permissions shown on the consent screen for the appointment features you choose. The current integration requests the calendar.events permission and, where Google account verification is enabled, the openid and email permissions. Relevant records can include appointment time and title and attendee name and telephone number. They are stored in GoUltra's systems and shared only as needed for the disclosed feature, security or legal duties. GoUltra's use and transfer of Google API information complies with the Google API Services User Data Policy, including its Limited Use requirements. Google-derived information is not used for advertising or generalized AI training. The policy is available at https://developers.google.com/terms/api-services-user-data-policy. Disconnecting or switching the connected Google account stops synchronization and removes synchronized appointment records from active storage. Any protected residual backup copies remain subject to lawful retention and erasure controls. The recipient register identifies the backup services and their handling of those records.
7. AI and customer information
When a business enables an AI feature, the relevant messages and configured business information may be sent to its selected provider. The recipient register identifies the enabled service and the actual processing arrangement, including relevant retention and training restrictions. A provider engaged through a Customer's own credentials is distinguished from one engaged by GoUltra. We do not sell personal data. We do not use Customer Data for cross-customer advertising profiles or train our own generalized AI models with it. Other permitted provider processing depends on the actual agreement and configuration; no unsupported provider-wide guarantee is made. Google-derived and WhatsApp data remain subject to their applicable additional use restrictions.
8. Recipients and transfers
We disclose information to the service providers needed for hosting, communications, payments, diagnostics, optional AI and selected website functions, as detailed in the recipient register. Stores independently handle their account, purchase, tax and refund information. We may disclose necessary information to comply with law, protect rights or security, or carry out a lawful business transaction with appropriate safeguards and notices; Google and other restricted data retain their additional transfer conditions. Processing may occur outside your country. The applicable transfer schedule identifies the actual countries or supported location description, parties and safeguards. Where required, these include a valid adequacy route or an appropriate executed contractual or other statutory mechanism and supplementary measures. Consent to this policy is not blanket authorization for every international transfer. Ask privacy@goultra.ai for the applicable safeguards or a copy, subject to necessary protection of confidential information.
9. Automated safeguards and decisions
Automated controls help identify abnormal activity and may pause sending or restrict access. The published processing schedule explains any solely automated decisions that produce legal or similarly significant effects where disclosure is required, including meaningful information about the logic, importance, likely consequences and available human review. A customer-configured AI reply is not automatically such a decision; the actual use and effect matter. Contact privacy@goultra.ai to seek an explanation or exercise applicable review rights.
10. Website storage and communications
The Cookie Policy and Cookie settings explain essential storage, analytics and any enabled advertising measurement. Our default design requires an affirmative choice before optional analytics or advertising tools run. Refusing optional tools does not prevent essential account access. Customer messages and contacts are not used as advertising audiences. Necessary verification, security and billing messages are separate from optional promotional or payment-setup reminders. Optional communications require an applicable permission route and include a usable stop mechanism. A withdrawal of optional consent does not affect the lawfulness of earlier processing or stop messages genuinely necessary for the account.
11. Security and deletion
We use access controls, tenant separation, encrypted credentials, provider encryption for stored content, HTTPS/TLS, security logging and backup procedures described in the DPA. These reduce risk but do not guarantee absolute security or represent an unheld certification. A team member may delete their profile; only an authorized owner or administrator may request whole-workspace deletion. Requests are available within the application and at https://goultra.ai/delete-account without requiring a new purchase, payment or support call. Reasonable identity and authority checks protect against unauthorized deletion. Active-system deletion is normally completed within 30 days, with earlier action where law requires. Justified legal records and backup handling are explained in the deletion policy; they do not extend statutory response deadlines.
12. Rights children and contact
Depending on applicable law, people may obtain information and access, correct records, request erasure, restrict or object to processing, obtain portable data, withdraw consent, opt out of covered advertising or sale/sharing, and challenge relevant automated decisions. The Privacy Rights Notice explains routes and regional protections. Contact privacy@goultra.ai; a person whose information is controlled by a business Customer may also contact that business, and we assist as required. Business account holders must be adults; information supplied by Customers may concern minors and requires appropriate safeguards. The Service is not marketed to children. We do not claim that every contact in a Customer's database is an adult. Complaints about children's information can be sent to the privacy address.
13. Policy updates
We maintain document versions, effective and publication dates, language and content identifiers, preserve prior accepted versions and provide required notice of material changes. We seek renewed agreement or specific consent where required. A policy update does not retroactively authorize a new use of information. Applicable representatives and designated privacy contacts, where required, are disclosed with this notice and remain reachable through privacy@goultra.ai.