Privacy Policy

1. Information We Collect

2. How We Use Information

We use information processed through the Services for the following purposes:

• Providing, operating, and maintaining the Services
• Authenticating users and managing accounts
• Analyzing email content to generate structured deal data
• Creating or updating CRM records at the user’s direction
• Providing customer support
• Improving service reliability, security, and performance
• Detecting fraud, abuse, or unauthorized activity
• Complying with legal and regulatory obligations

We do not use Google Workspace API data to develop, improve, or train generalized artificial intelligence or machine learning models.

3. Google API Data Handling and Limited Use

Rendeal’s use of information received from Google APIs is limited to providing or improving user-facing features that are visible and directly relevant to the user’s use of the Services.

We do not:

• Sell Google user data to third parties
• Use Google user data for advertising purposes (including personalized or interest-based ads)
• Create advertising profiles based on Gmail content
• Transfer Google user data to data brokers or information resellers
• Use Gmail content for generalized AI model training

Access to Gmail data is limited to authorized functionality requested by the user.

4. Zero-Retention Ephemeral AI Processing & Data Retention

Rendeal is designed to minimize retention of email content wherever reasonably practicable.

We protect your commercial transaction secrets with strict ephemeral processing: we do not store, write to disk, or persist the contents of your email body, email metadata, or email thread text.

All email parsing calculations are processed entirely in-memory using secure, high-speed RAM buffers. Once the AI analysis is completed and returned to your Gmail sidebar, the email content is instantly and permanently purged from our RAM buffers. We generally do not store email content after processing, except where temporary retention is necessary for:

• Security monitoring and abuse prevention
• Error detection and operational debugging
• Service reliability and telemetry
• Legal or compliance obligations

Account metadata (emails, domains, seat counts), integration credentials (encrypted CRM refresh tokens), and subscription records are retained securely for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements.

5. Third-Party Service Providers & AI Sub-processors

We may engage trusted third-party service providers to support the operation of the Services, including:

These providers process information solely on our behalf and under contractual obligations designed to protect confidentiality and security. Third-party providers maintain their own independent privacy policies and practices, and users are encouraged to review those policies directly.

6. Security Measures

We implement commercially reasonable administrative, technical, and organizational safeguards intended to protect information against unauthorized access, disclosure, alteration, or destruction.

Such safeguards include:

• Encryption of data in transit using the TLS 1.3 protocol
• Encryption at rest of sensitive credentials (such as CRM OAuth refresh tokens using military-grade **AES-256 encryption**)
• Access controls, Multi-Factor Authentication (MFA), and administrative authentication mechanisms
• Active monitoring, logging, and security auditing systems
• Security patching and automated vulnerability management procedures

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

7. International Data Transfers

Your information may be processed or stored in jurisdictions outside your country of residence where our service providers or infrastructure providers operate (including the United States and European Union).

Where required by applicable law, we implement appropriate safeguards designed to protect personal information transferred internationally.

8. Your Rights, Choices, and Deletion

Subject to applicable law, users may have rights to:

• Access personal information held by us
• Correct inaccurate or incomplete information
• Request deletion of account information
• Withdraw consent for CRM integrations
• Object to certain processing activities
• Request export of certain account information

Methods to revoke and manage your credentials:

• Data Deletion Requests: You can request full deletion of all saved account metadata at any time by contacting us at privacy@rendeal.co. We process all valid requests within 3 business days, destroying all metadata entries and encrypted refresh tokens.
• CRM Disconnection: You can instantly revoke Rendeal's access to your HubSpot, Zoho CRM, or Zendesk Sell accounts directly from your admin console dashboard, deleting all encrypted keys from our systems.
• Add-on De-authorization: You can completely disconnect Rendeal's access to your Google account at any time by visiting your Google Account Permissions portal and removing Rendeal AI Deal Creator.

9. Children’s Privacy

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technologies, legal requirements, or business operations.

Updated versions will be posted on this page together with the revised effective date.

11. Contact Information