1. Google Data We Access

When you connect your Gmail account, Connekt requests the following Google OAuth scope:

This scope allows Connekt to read your email messages and settings in read-only mode. Specifically, we access:

• Email thread content (subject, body, sender, recipient, timestamp)
• Email metadata (folder labels, read/unread status)
• Sender and recipient email addresses

When you connect your Google Calendar in the Connekt Notetaker Chrome extension, we request this separate OAuth scope:

This scope allows Connekt to read your calendar events in read-only mode. Specifically, we access:

• The title of the calendar event associated with the Google Meet call being recorded
• The names and email addresses of that event's attendees

We do not request access to send emails, delete emails, modify emails, or access Google Drive or any other Google product. We do not create, modify, or delete calendar events, and we do not browse or store your calendar beyond the single event tied to the meeting being recorded.

2. How We Use Google Data

Google user data accessed via the Gmail API is used exclusively for the following purpose:

• Email thread synchronisation: We retrieve email threads involving your candidates' and contacts' email addresses and display them alongside the corresponding CRM records, so recruiters can view full communication history without leaving the platform.
• Conversation matching: We match email senders and recipients against email addresses stored in your Connekt CRM. Only emails that match a known candidate or contact are stored; all other emails are discarded immediately.

Google user data is not used for advertising, profiling, training AI or ML models, or any purpose beyond displaying your own email history within Connekt. We do not use Gmail data to build profiles about users beyond the recruiter's own CRM context.

Google Calendar data accessed via the Calendar API is used exclusively for the following purpose:

• Meeting note enrichment: When you record a Google Meet call with Connekt Notetaker, we look up the calendar event matching that specific call and use its title and attendee list to automatically fill in the title and attendees on the generated meeting notes, instead of relying on scraping the Meet interface.

Calendar data is looked up silently in the background only during an active recording — connecting your calendar never triggers a surprise sign-in prompt mid-meeting.

3. Sharing of Google User Data

We do not sell, rent, or trade Google user data. We do not share Google user data with third parties except in the following strictly limited circumstances:

• Infrastructure providers: We use Supabase (database hosting) and cloud infrastructure to store and serve your data. These providers act as data processors and are contractually prohibited from using your data for any purpose other than providing the service to us.
• Legal obligations: We may disclose data if required by law, court order, or to protect the rights and safety of our users or the public.

No Google user data is shared with any advertising networks, data brokers, analytics platforms, or other third parties.

4. Storage and Protection of Google User Data

• Encryption in transit: All data transferred between your browser, our servers, and Google APIs is encrypted using TLS 1.2 or higher.
• Encryption at rest: Email content stored in our database is encrypted at rest.
• Access controls: Only authenticated users can access their own Gmail data within Connekt. Our engineers access production data only when required for support or incident resolution, under strict access controls.
• OAuth tokens: Gmail OAuth tokens are stored securely via Nylas (our email API provider) and are never exposed in logs or client-side code. Calendar OAuth tokens are managed entirely by Chrome's built-in Identity API on your device — they are never transmitted to or stored on Connekt's servers.
• Minimal data principle: We only store email threads that match a candidate or contact in your CRM. Unrelated personal emails are never stored. For Calendar, we only retain the event title and attendee list of the specific meeting you recorded, as part of that meeting's notes — no other calendar events or details are ever stored.

5. Retention and Deletion of Google User Data

Retention period: Synced email data is retained for as long as your Connekt account is active and the Gmail integration is connected. Email threads older than 90 days that no longer match active CRM records are automatically purged.

Disconnecting Gmail: You can revoke Connekt's access to your Gmail account at any time by:

• Going to Settings → Integrations → Gmail → Disconnect within the Connekt platform, or
• Visiting Google Account Permissions and revoking access for Connekt.

Upon disconnection, we immediately invalidate your OAuth token. All previously synced Gmail data associated with your account is deleted within 30 days.

Disconnecting Calendar: You can disconnect Google Calendar at any time from the Connekt Notetaker extension's settings. Disconnecting immediately revokes the OAuth grant directly with Google (not just locally), so the permission is fully withdrawn from your Google account, not merely hidden from Connekt's UI.

Account deletion: When you delete your Connekt account, all associated Google user data is permanently deleted within 30 days. To request deletion, email privacy@letsconnekt.com or use the account deletion option in your settings.