Privacy Policy

Account information: your name, email address, company name, and password when you create an account.

Billing information: payment details processed by our payment provider; we store only the limited records needed to manage your subscription.

Customer data: the contacts, deals, messages, and other records you import or create inside the Service.

Usage data: log data, device and browser information, and how you interact with features, collected automatically to operate and improve the Service.

Communications: messages you send to our support and sales teams.

Connected accounts: when you connect a social account, your Gmail, Google Calendar, Google Meet or Google Drive, or your Dropbox, OneDrive or Box, the information that platform shares with us, described in sections 3, 5 and 6.

We use information to provide and maintain the Service, authenticate your account, process payments, deliver support, and operate features such as AI lead scoring and follow-up drafting on your data and at your direction.

We also use aggregated and de-identified usage data to improve performance, develop features, and keep the Service secure. We do not sell your personal information.

File storage you connect (Dropbox, OneDrive, Box). If you connect your own Dropbox, OneDrive or Box, the Service shows you its folders when you choose a file to add to the CRM or a folder to save a file into, opens only the file you pick, and puts in only the file you choose to save there. A file you add is kept in your workspace like one uploaded from your computer, and used like any other file in the place you added it. Nothing else in your storage is copied, read or synced. Disconnecting deletes the connection's access tokens at once and, for Dropbox and Box, withdraws our access there; you can also remove the Service from your account's settings at each provider. Google Drive is described in section 6.

We share information only as needed to run the Service: with subprocessors such as hosting (Supabase, in the United States), payment, email and AI model providers, who are bound by confidentiality and data-protection obligations; when required by law or to respond to valid legal process; and in connection with a merger or acquisition, in which case we will notify you. What we share of the information received from Google is described in section 6.

We never sell your data or your customers' data, and we never use your customers' data for our own advertising. It reaches an ad platform only if you connect one yourself, such as the Meta Conversions API.

Our own ads. When you come to us from one of our ads on Facebook or Instagram, we tell Meta when you create an account, start a trial or pay for a plan, so we can see which of our ads work and show them to people likely to find the CRM useful. Meta receives your email address and name in hashed form (it can only match them to an account it already has), a hashed ID for your account, your IP address and browser, and the ad's click identifier, and processes them under its business terms. To opt out, decline cookies in the banner on automatenexuscrm.com or email support@automatenexuscrm.com.

You can connect Facebook Pages, Instagram business accounts, LinkedIn profiles and Pages, X, TikTok, YouTube channels and Google Business Profile locations to publish and manage posts from the Service. You choose which accounts, Pages and locations to connect.

From each connected account we receive and store: its name, its id and picture; the access tokens the platform issues, encrypted at rest; the posts, pictures and videos you publish through the Service; comments, mentions and replies on those posts, for the inbox; and post and account statistics, for reports.

We use this only to publish, reply and report for the workspace that connected the account. It is never sold, never used for advertising, and never used to develop, improve or train artificial intelligence or machine-learning models.

When you disconnect an account, we ask the platform to revoke our access where it offers that, and we delete that account's access tokens at once. You can also remove our access from the platform's own settings, and ask us to delete what we hold. Our data deletion page explains each way.

AutomateNexus CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google APIs is never sold, never used for advertising, never shared with data brokers, and never used to develop, improve or train artificial intelligence or machine-learning models.

Sign in with Google. When you sign in with your Google account we receive your name and email address, and use them only to create your account and sign you in.

Gmail. If you connect your Gmail account, the Service may read the email in your Inbox and Sent Mail and send email as you. When you first bring your mailbox into the CRM, we copy your 50 most recent messages, and after that each new message, checked about every five minutes. For each message we keep its sender, recipients, subject, date, message and conversation identifiers, and its text and HTML body. We do not read attachments. We use this only to show your email in the CRM's inbox and on the records of the people and companies it concerns, and to send the emails you write, and the agent emails you approve, from your own address.

Google Calendar and Google Meet. If you connect Google Calendar, the Service reads the events on your calendars from seven days before today to thirty days ahead (their title, time, description, location, meeting link and status, and the guests' email addresses, which are used only to match the people in your CRM), the list of your calendars, and the times you are busy. It creates, moves and cancels the events you schedule in the CRM and the bookings people make on your booking pages, and Google emails the guests about each change. Events are kept as meetings in your workspace; busy times are used only to hide those times on your booking pages and are not stored. If you connect Google Meet, the Service creates Meet links for the meetings you schedule.

Google Meet transcripts. The Service does not read Google Meet transcripts or recordings: a Google Meet connection only creates the Meet links for meetings in your CRM, through Google Calendar. Notes for a Meet call come only from a recording you make yourself with Record meeting.

Google Drive. If you connect Google Drive, the Service can open only the files you pick in Google's own file picker, and the files it saves to your Drive at your request; it cannot see anything else in your Drive. A file you pick is copied into your workspace like one uploaded from your computer (Google Docs, Sheets and Slides as Word, Excel and PowerPoint files), and is then used like any other file in the place you added it, for example as an AI agent's knowledge when you add it there. Information from Google Drive is never used to develop, improve or train AI models. Nothing in your Drive is synced. Disconnecting Google Drive in Settings, Integrations deletes its access tokens and stops it at once.

AI features. Gmail is no longer connected through Google's API (it is added as an ordinary mailbox instead); on a Gmail connection made before October 30, 2026, your Gmail messages are sent to an AI model only if you turn on "Let AI read my Gmail" on that connection (Settings, Integrations, Gmail; it is off until you turn it on), and then only for the features you use that work on your email: reply drafts and the automatic replies your workspace switches on, your AI agents reading the replies to your outreach and deals and the emails sent to them, workflows that wait for a reply, suggestions on a record, and customer insights. While it is off, none of them reads that mail. Google Calendar events are kept as meetings in your workspace, and the features that work on your meetings, such as your daily brief and meeting recaps, may give their title, time and description to an AI model when you use them. Once anyone in a workspace connects a Google account, that workspace's AI features use only AI model providers whose terms forbid training on what they are sent: OpenAI or Anthropic, with the workspace's own key, OpenRouter, asked on every request to route only to hosts that neither keep nor train on it (no data collection, zero data retention), whether with the workspace's own key or ours, or a model running on the workspace's own computer. Keys the workspace has connected for any other AI provider are not used while it is connected to Google. No information received from Google is used to develop, improve or train any AI or machine-learning model, ours or anyone else's.

Who sees it. Your Google data is stored in your workspace and is seen by the people you give access to it. Our staff and administrators do not read your Gmail messages unless your workspace's owners or admins turn on "Let support open synced email" in Settings, Security to get our help with them. Our support team sees your calendar's events and Meet transcripts, as meetings in your workspace, only during a support visit made to help you, which is recorded with its reason in your workspace's audit log. Otherwise we read Google data only for security reasons, such as investigating abuse, or when the law requires it.

Sharing. We share information received from Google only with the providers who run the Service for us: our hosting provider (Supabase, in the United States), which stores it, and the AI model provider, only as described above. It also goes wherever you send it yourself, for example to your own webhook from a workflow you build.

Security. The access tokens Google issues for your connection are encrypted with AES-256-GCM, with the key held apart from the database. All data is encrypted in transit, and stored on encrypted disks.

Your control. Disconnecting Gmail, Google Calendar or Google Meet in Settings, Integrations deletes that connection's access tokens and stops it at once, and revokes our access at Google unless another of your connections still uses the same Google account. Messages, events and Meet transcripts already copied stay in your workspace as CRM records until you delete them; you can delete email conversations at any time, or ask support@automatenexuscrm.com to delete everything that came from your Google account, which we do within 30 days. You can also remove the Service's access from your Google account's security settings at any time.

YouTube and Google Business Profile. The Service uses YouTube API Services to upload the videos you choose to your YouTube channel and set their title, description and privacy. By connecting YouTube you also agree to the YouTube Terms of Service, and Google's handling of your information is described in the Google Privacy Policy. If you connect a Google Business Profile, the Service publishes the posts you choose to your locations, as described in section 5.

When you use AI features, such as writing a post or making pictures and videos in the Content Studio, the words, pictures and brand details you give are sent to the AI model provider that does the work, only to produce what you asked for. Where you connect your own AI provider key, that provider's terms apply.

Pictures and videos made in the Content Studio are marked as AI-made in the Service, and labelled as AI-generated when published wherever the platform offers a label.

We protect your data with encryption in transit and at rest, role-based access controls, and regular security reviews. We maintain SOC 2-aligned practices and restrict internal access to a need-to-know basis.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

We retain your account and customer data for as long as your account is active. After cancellation, we retain data for a limited recovery window described in our Cancellation Policy, after which it is permanently deleted, except where longer retention is required by law.

Access tokens for a connected account are deleted as soon as you disconnect it. If you ask us to delete the information we hold from a connected platform, we do so within 30 days.

Depending on your location, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

You can exercise most of these rights directly in your account settings, or by contacting us. We will respond within the timeframe required by applicable law.

We use essential cookies to keep you signed in and to operate core functionality, and limited analytics cookies to understand and improve usage. On our marketing site, Meta's pixel measures our own ads, with your consent where the law asks for it; the Cookie Policy lists every cookie and how to change your choice. You can control non-essential cookies through your browser settings; disabling essential cookies may prevent the Service from working correctly.

If you have questions about this policy or your data, or want to use any of your rights, email support@automatenexuscrm.com and we will help. AUTOMATENEXUS LLC is responsible for the information described in this policy. We will also update this page whenever our practices change and revise the "last updated" date below.