Privacy Policy

1. Who we are

HomieDesk is a CRM operated by HomieDesk, which acts as the data controller.

For any privacy question, or to request access to, correction of, or deletion of your data, write to hello@homiedesk.com.

2. What Google data we use, and why

Connecting your Google account is optional. Without it, the CRM works minus the email and meeting features. When you connect it, we request these permissions and use them only for this:

• Your email (gmail.modify), for three things: reading the messages exchanged with each customer, to show them on their record, detect when someone replies to you and build the timeline of the relationship; sending, from your own address, the messages you approve inside the CRM (we never send anything you have not approved); and reflecting in your Gmail what you do in the CRM (saving or discarding a draft, and marking as read the email you open in the CRM). This permission does not let us permanently delete email.

• Your email address (userinfo.email): to know which account is connected and show it to you.

• Events on the calendars you own (calendar.events.owned): to list the upcoming meetings on your primary calendar and to schedule, change or cancel meetings with a Meet link from the CRM. We do not access other people's calendars shared with you.

We do not use your Google data for advertising, we do not sell it, and we do not use it to train artificial intelligence models.

3. Limited Use of Google data

HomieDesk's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we do not transfer Google data to third parties except as necessary to provide or improve the features you requested, to comply with applicable law, or as part of a merger or acquisition with your consent; no humans read your Google data unless you give explicit permission for support purposes, for security, or where required by law; and we do not use that data for advertising or to train generalized artificial intelligence models.

4. What Microsoft data we use, and why

If instead of Google you connect a Microsoft account (Outlook or Microsoft 365), it is also optional, and we request these permissions and use them only for this:

• Your email (Mail.ReadWrite and Mail.Send): reading the messages exchanged with each customer to show them on their record, detect when someone replies to you and build the timeline; sending, from your own address, the messages you approve inside the CRM (we never send anything you have not approved); and reflecting in your Outlook what you do in the CRM (saving or discarding a draft, and marking as read the email you open in the CRM). A discarded draft goes to your Deleted Items: we do not permanently delete email.

• Your profile (openid, email, profile, User.Read): to know which account is connected and show it to you. With offline_access, to keep syncing without asking you to sign in every hour.

• Your calendar (Calendars.ReadWrite) and its time zone (MailboxSettings.Read): to list your upcoming meetings and to schedule, change or cancel meetings with a Teams link from the CRM.

These are permissions over YOUR mailbox: we do not request access to other people's mailboxes in your company. We do not use your Microsoft data for advertising, we do not sell it, and we do not use it to train artificial intelligence models. What we store and how you delete it is the same as with Google (sections 5 and 7).

5. What we store, and for how long

So the CRM does not have to ask Google for everything on every screen, we store copies in our database:

• Email messages related to your customers: sender, recipients, subject, date and the BODY of the message, in plain text and HTML. We store the full body, not just a summary.

• Calendar events associated with customer meetings.

• Meeting transcripts, plus the summary, key points and tasks that artificial intelligence extracts from them.

• The access tokens Google issues for your account, which are what make the connection possible.

We keep this data while your account is active. If you disconnect Google from the CRM, we stop syncing and delete the tokens. If you request account deletion, we delete your data within 30 days, except what the law requires us to retain.

6. Who we share data with

We do not sell data. We share it only with the providers required to run the service, each with access only to what it needs:

• Supabase: database and file storage.

• Vercel: application hosting.

• Sentry: application error reports and load times. It receives the error message, the part of the code where it happened and how long a sample of screens and requests took; never the content of your email, your Google data, your email address or your IP address.

• OpenAI and Anthropic: the artificial intelligence models that classify incoming email, draft messages, summarize meetings and answer in chat. They receive only the text needed for each task, through their APIs. Neither uses this data to train its models.

• Recall.ai: only if you enable meeting recording. Its bot joins the call and produces the transcript.

• Apollo.io: only if you use prospecting. It receives search criteria, not your email.

• Stripe: payments. It receives billing data; we do not store card numbers.

• Resend: account email (confirmation, invitations, notices). It receives your name and address, not the content of your Gmail.

The content of your email and meetings is never shared with other organizations using the CRM. Each organization sees only its own data.

7. How to revoke access and delete your data

You can cut off access at any time, through two independent paths:

• From the CRM: Settings → Email → Disconnect, whether your account is Google or Microsoft. Tokens are deleted and syncing stops.

• From your Google account: go to myaccount.google.com/permissions, find HomieDesk and remove its access. This invalidates the tokens immediately, without going through us.

• From your Microsoft account: for a work or school account (Microsoft 365), go to myapps.microsoft.com, find HomieDesk and revoke its permissions; for a personal account (Outlook.com), go to account.live.com/consent/Manage. Microsoft does not give applications a way to revoke the permission themselves: that is why, when you disconnect from the CRM, we delete the tokens, which is what cuts off access.

To delete data already stored (email, transcripts, summaries), write to hello@homiedesk.com and we will do it within 30 days.

8. Security

Data access is restricted per organization: each account can only read its own organization's data, and this is enforced in the database, not just in the interface. Communication with the application is always encrypted in transit (HTTPS).

No system is infallible. If we detect a breach affecting your data, we will notify you.

9. Changes

If we change this policy, we update the date above. If the change affects how we handle your Google data, we will notify you inside the application before it takes effect.