Privacy Policy – Google API Services

This section summarizes how the Firefly Suite, operated by Firefly Technologies (Manuel Hutter, Plüddemanngasse 56/2/37, 8010 Graz, Austria), handles Google user data.

Data accessed. When a user connects a Google account, the Firefly Suite requests: basic profile information (openid, email, profile) to sign the user in; read access to Gmail (gmail.readonly) to retrieve incoming emails from the mailbox the user connected for a specific purpose (receipts, customer inquiries, support requests); send access to Gmail (gmail.send) to send emails the user or their team triggers in the Suite (quotes, invoices, ticket replies, reminders); and Google Calendar access (calendar.events) to create and sync appointments created in the Suite.

Data usage. Google user data is used solely to provide and improve user-facing features of the Firefly Suite that are visible in the application: creating receipts, inquiries and tickets from incoming emails, sending emails on the user's behalf, and syncing appointments. Incoming emails may be processed by a large language model (Mistral AI, Paris, via API, processing within the EU, under a data processing agreement) solely to extract and classify information for the requesting user; decisions are always made by a human.

Data storage. Data is stored on a dedicated server per customer within the European Union, encrypted in transit; OAuth tokens are stored encrypted. Only the emails and events needed for the respective feature are stored.

Data sharing. Google user data is shared only with service providers necessary to provide the feature (hosting provider in the EU; Mistral AI for processing within the EU without model training), when the user explicitly requests it, to comply with applicable law, or as part of a merger or acquisition with prior notice. We do not sell Google user data.

Restrictions. We do not use Google user data for advertising, retargeting or personalized ads; we do not use it to determine creditworthiness or for lending purposes; we do not use it to develop, improve or train generalized AI or machine-learning models; and humans do not read it unless the user gives affirmative consent for specific messages, it is necessary for security purposes, it is required by law, or the data is aggregated and anonymized for internal operations.

Retention and deletion. Data is kept as long as needed for the respective business process or as required by statutory retention obligations of the customer. When a user disconnects their Google account, OAuth tokens are deleted immediately and no further data is retrieved. After termination of the contract, all customer data is deleted within 30 days unless statutory retention applies. Users can revoke access at any time at https://myaccount.google.com/permissions or request deletion via manuel.hutter@firefly-technologies.io.

Limited Use. The Firefly Suite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.