Privacy Policy

Effective: 14 November 2026. Service: SnapyCall Pilot Outreach (invitation-only pilot).

Privacy contact: Contact the organization or administrator who invited you to your SnapyCall Pilot Outreach workspace, using the communication channel provided with the invitation. EventNexus OÜ is responsible for technical operation of this pilot. Its designation does not by itself determine the data-controller role. A dedicated privacy contact and controller details must be confirmed before general public launch.

1. Data we process

For invited users, we process Google account identifier (subject), verified email address, display name, workspace membership and activity records. We store session cookies to authenticate users. When you explicitly connect Google data access, we store granted scope metadata and a Google refresh credential encrypted on the server; the raw credential is not exposed to other users.

Workspace operators may enter candidate names, professional contact addresses, categories, source URLs, evidence, review outcomes and draft correspondence. Users who configure an AI provider supply their own API key. It is encrypted at rest; the application may send a selected candidate's relevant details to the configured AI provider to prepare a draft when the user explicitly requests that operation.

2. Purpose and lawful basis

We use account data to provide the requested pilot service, secure invitations, maintain access controls and prevent abuse. Workspace operators must independently establish the applicable legal basis for candidate research, storage and any future outreach. Candidate data must not be collected or used solely on the assumption that its public availability authorizes marketing.

3. Google data and permissions

Google sign-in requests basic identity permissions. Optional Google data consent requests read-only Google Forms responses and Google Sheets access for the connected account. The current pilot stores the permission grant but does not synchronize the underlying Forms or Sheets content. Future synchronization, if introduced, will require an appropriate product update and transparent notice before activation. We do not change document-sharing permissions or send emails through Google on your behalf. A separate optional Gmail authorization may request the sensitive gmail.send scope to send approved outreach from your account; Gmail sending remains disabled. This grant is stored separately from Forms/Sheets permissions and can be disconnected independently.

Google user data is used only to provide user-requested app functionality. We do not sell Google user data or use it for advertising targeting. We do not use Google Workspace user data to train general-purpose AI models. A user can disconnect a Google data connection in the application; local stored credentials are removed, and the user may also revoke Google access through their Google Account settings.

4. Service providers and disclosure

We use hosting, database and authentication infrastructure to run this service, currently including Render, Neon and Google. Invitation emails may use Resend if configured. If a user chooses an AI provider and generates a draft, relevant draft inputs are transmitted to that provider under its own terms. We disclose personal data only as needed to operate the app, comply with law, or carry out an explicitly authorized action.

5. Retention and security

We maintain access-control records, candidate evidence, drafts and audit logs while necessary for the pilot and applicable legal obligations. Exact retention schedules and deletion processes must be finalized by the pilot operator before wider public use. Credentials are encrypted at rest and session cookies are HTTP-only. No system can guarantee absolute security.

6. Your choices and rights

Where applicable, you may request access, correction, erasure, restriction, portability or object to processing, and lodge a complaint with your relevant data-protection authority. Contact your inviting workspace administrator to initiate a request; they may need to coordinate with the service operator. You may disconnect Google data permissions independently within the app and at Google Account permissions.

7. Changes

Changes to how Google data or candidate data is handled will be reflected in this policy before relevant new processing is enabled.