Privacy Policy

Information we handle

We handle the account, business, and operational information needed to provide the Zucker & Co client portal and Business Agent. The exact information depends on the services you choose to connect.

• Account details such as your name, email address, business profile, and portal settings.
• Website, lead, booking, review, proposal, approval, and activity information stored in your portal.
• For Google Workspace connections, basic Google profile information and read-only Google Calendar availability. The limited internal inbox-intelligence pilot may also use Gmail message metadata such as headers, labels, participants, and timestamps; the public connection does not request that restricted permission. If you separately grant controlled-action permissions, the service may send an exact email or create an exact calendar event only after the action is prepared in your portal, approved by you, and executed by a separate owner action. We do not request Gmail message-body or attachment access, and we do not read calendar event titles, descriptions, or attendee details.
• Connection records, encrypted provider tokens, security logs, and diagnostic information used to keep the service reliable and auditable.

How we use information

• Provide the portal, connected tools, reports, and Business Agent features you request.
• Show relevant business context, identify follow-up needs, and prepare reviewable proposals for your approval.
• Authenticate users, enforce permissions, prevent misuse, troubleshoot failures, and improve reliability.
• Communicate about your account, service changes, support requests, and security matters.

Google user data

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google Workspace data is used only to provide the user-facing features you authorize. It is not used for advertising, sold to third parties, or used to train general-purpose AI models.

The public Google connection uses calendar availability and connection status for scheduling assistance. Only accounts explicitly enrolled in the limited internal inbox-intelligence pilot may also use bounded message facts such as participants, timestamps, and labels for inbox triage. The Business Agent does not receive Gmail message bodies, snippets, attachments, or Google Calendar event titles, descriptions, or attendee details.

When controlled-action permissions are enabled, the Business Agent can prepare an email or calendar event for your review. Approval does not execute it. A separate owner-controlled execution step rechecks the exact recipient, content, time, attendees, connection, scope, and approval record before calling Google. You can reject the proposal or revoke the Google connection at any time.

Sharing and service providers

We share information only when needed to operate the service, follow your instructions, comply with law, protect users, or complete a business transaction with appropriate safeguards. Infrastructure and AI providers process data on our behalf under their applicable terms and security controls. Connected providers such as Google and Intuit process information according to their own policies.

Storage, security, and retention

Provider access tokens are stored as encrypted ciphertext. Access is scoped to the customer and provider permissions selected, and sensitive actions use portal approval controls and audit records. No system is perfectly secure, but we use reasonable administrative, technical, and organizational safeguards designed for the nature of the information we handle.

We retain information while your account or connection is active and as reasonably needed for service delivery, security, dispute resolution, and legal obligations. Revoking a provider connection stops future access. You may also ask us to delete associated connection data, subject to legitimate retention requirements.

Your choices

• Choose which provider permissions to grant and disconnect a provider at any time from the portal or provider account.
• Request access, correction, export, or deletion of personal information by contacting us.
• Decline optional integrations and continue using features that do not depend on them.

Contact and updates

The service is intended for business users and is not directed to children. We may update this policy as the service changes and will post the revised date here. Questions or privacy requests can be sent to zucker.jason@gmail.com.