Privacy Policy

1. Who this policy applies to

This policy applies to:

• Tenant administrators — businesses subscribing to SeamlessSale.
• Agents — individuals invited by a tenant who use our dashboard to handle hot-lead handoffs and meeting bookings.
• Leads / customers — end users who interact with a tenant's automated messaging on channels such as WhatsApp, Telegram, or email.

2. Information we collect

2.1 Account information

When a tenant signs up we collect business name, billing contact, and login email. When an agent is invited we collect their full name, contact phone, and email.

2.2 Lead / customer messaging data

When a customer messages a tenant on a connected channel we receive the message content, channel identifier (e.g. phone number, Telegram username), and any media they sent. We use this to power automated replies, lead enrichment, and analytics for the tenant.

2.3 Google account data (calendar integration)

Agents may optionally connect their Google account from inside our dashboard so we can place customer meetings on their Google Calendar. Connecting is always voluntary; an agent can use SeamlessSale without it. When an agent connects, we request the following limited Google OAuth scopes:

• https://www.googleapis.com/auth/calendar.events — to create calendar events for booked meetings on the agent's calendar.
• https://www.googleapis.com/auth/calendar.freebusy — to check the agent's busy/free windows so we don't double-book.
• https://www.googleapis.com/auth/userinfo.email — to display the agent's connected Google email in the dashboard so they can confirm which account is linked.

We store the resulting OAuth refresh token in encrypted form (AES-256) in our database, alongside the agent's Google email and the granted scope. We do not request, store, or read any other Google data — no Gmail messages, contacts, Drive files, profile photos, or any calendars outside of event creation and free/busy look-ups on the agent's own primary calendar.

3. How we use Google user data

The Google data we access is used solely to provide and improve the calendar booking feature inside SeamlessSale. Specifically:

• Create a calendar event on the agent's Google Calendar when a lead has agreed to a meeting time. The event includes the meeting summary, start/end time, optional location, optional Google Meet link (for online meetings only), and adds the lead's email as an attendee so Google sends them the invite.
• Check the agent's free/busy window before booking, to avoid scheduling on top of an existing event.
• Display the connected Google email in the agent's settings page so they can see which account is linked and disconnect it at any time.

We do not use Google user data for advertising, do not sell it, do not share it with third parties for marketing, and do not use it to train, fine-tune, or improve any generalized or third-party AI/ML model. Google user data is only handled as needed to provide the user-facing calendar feature described above.

4. How we store and protect data

• All connections to our services use TLS in transit.
• Google OAuth refresh tokens are encrypted at rest using AES-256-CBC with keys held only by our backend infrastructure.
• Database access is restricted to our application service role; row-level security ensures one tenant cannot see another tenant's data.
• Our backend hosts and database providers are reputable third parties (Supabase, Render) that maintain industry-standard security practices.

5. Data sharing

We do not sell or rent personal data. We share data only with the following categories of recipients, and only as needed to operate the service:

• The tenant who controls the data. Lead messaging data is shared with the tenant whose channel the lead messaged.
• Sub-processors we rely on — hosting (Render), database / auth (Supabase), AI providers used to generate replies (Google Gemini), email delivery (Resend), and messaging platforms the tenant has connected (Meta / WhatsApp Cloud API, Telegram). Each sub-processor only receives the minimum data needed for its role.
• Law enforcement when required by valid legal process, and only to the extent legally compelled.

6. Data retention and deletion

Account and lead data is retained for as long as the tenant's subscription is active and for a reasonable period afterwards to allow re-activation. Tenants and agents can request deletion of their data at any time by emailing us at support@seamless.sale.

Agents can disconnect Google Calendar from the agent settings page at any time. Disconnecting immediately removes our copy of the refresh token. Agents can also revoke our access independently from their Google account page at https://myaccount.google.com/permissions.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data. To exercise these rights, contact us at the email below. We will respond within a reasonable timeframe and verify your identity before fulfilling the request.

8. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of the page when we do. Material changes will be communicated to tenant administrators by email.

9. Contact us

Questions about this policy or about how your data is handled? Email support@seamless.sale.