Privacy Policy

1. Information we collect

• Account information: name, email address, role and profile picture of users invited to a workspace.
• CRM data you enter or import: contacts, notes, tags, tasks, opportunities, attachments and messages, which belong to your organisation.
• Connected services (optional): if you connect Google Calendar, Google Sheets, Calendly or an email provider, we receive the data described in sections 2 to 4.
• Technical data: basic log and device information (such as IP address and browser type) used to keep the service secure and working.

2. Google Calendar

If you choose to connect Google Calendar, we ask for permission to:

• view and create events on your calendar (calendar.events), so booked meetings appear in the Calendars page and you can reserve new meetings, optionally with a Google Meet link;
• read your Google account email address (userinfo.email), so we can show which account is connected.

We use this data only to provide those features to you inside EzyTeams. We do not sell it, use it for advertising, or use it to train generalised AI or machine-learning models. EzyTeams' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Authorised staff of your organisation who hold the "view all calendars" permission can see event details of colleagues' connected calendars in the same workspace.

3. Google Sheets and Drive files

If you choose to connect Google Sheets, we ask for permission to:

• see, create and share only the Google Drive files that you create with EzyTeams or pick yourself in the Google Picker (drive.file), so you can open, create and share those sheets and documents from the Sheets page. We cannot see any other files in your Drive;
• read your Google account email address (userinfo.email), so we can show which account is connected.

We store only the file details needed to list them for you (file ID, name, link and last modified time); the file contents stay in your Google Drive. When you share a file from EzyTeams, the email addresses you enter are sent to Google to add them to that file. This data is used only to provide these features, is not sold, not used for advertising and not used to train AI or machine-learning models, and is handled under the same Google API Services User Data Policy and Limited Use requirements described above.

4. Other integrations

Calendly and email (SMTP) integrations are used only to sync bookings and send the emails you ask us to send. You can connect and disconnect each integration yourself from Settings → Integrations.

5. How we use information

• to provide, maintain and secure the service;
• to authenticate users and enforce workspace permissions;
• to send service emails such as sign-in codes, invitations and notifications;
• to respond to support requests and fix problems.

6. Sharing

We do not sell personal information. We share data only with service providers that host or operate the service on our behalf (for example cloud hosting, database and email delivery providers), with the integrations you connect, when required by law, or with your organisation's administrators.

7. How we protect your data

We protect all data, including sensitive data and data received from Google APIs, with these measures:

• Encryption in transit: all traffic between your browser, our servers, Google and our providers uses HTTPS (TLS 1.2 or higher).
• Encryption at rest: our database and file storage are encrypted at rest (AES-256) by our hosting provider.
• Token protection: Google OAuth access and refresh tokens are stored only on our servers, are never sent to the browser or shown to other users, and are used only to call the Google APIs for the features you turned on.
• Access control: database row-level security keeps each organisation's data separate, and in-app permissions limit what each user can see. Server credentials are kept in secure environment settings and never exposed to the browser.
• Secure sign-in: email one-time codes and optional two-factor authentication protect accounts.
• Limited staff access: only authorised EzyTeams staff can access production systems, and only when needed to provide support or keep the service running.
• Browser protection: a strict Content Security Policy and secure cookies reduce the risk of script injection and session theft.

8. Retention and deletion

• We keep your data while your account or workspace is active.
• When you disconnect Google Calendar or Google Sheets, we delete the stored Google tokens for that connection straight away. Files and events stay in your own Google account.
• When you ask us to delete your account or workspace, we delete or anonymise its data, including stored Google data, within 30 days, unless we must keep it by law.
• You can ask for deletion at any time by emailing info@ezyteams.net.

9. Your choices and rights

• Disconnect Google Calendar from Settings → Integrations, or Google Sheets from the Sheets page, at any time; this deletes the stored tokens for that connection.
• You can also revoke access from your Google Account (Security → Third-party access).
• Ask us to access, correct or delete your personal information by contacting us below.

10. Changes

We may update this policy from time to time. The "last updated" date above shows the latest version.

11. Contact

Questions about this policy: info@ezyteams.net