Privacy Policy

This Privacy Policy describes how ALM Corp (“we,” “us,” or “our”) collects, uses, and shares information when you use My DA Hub (the “Service”), our web-based worksuite for CRM, project management, communication, and support operations.

By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

1. Information We Collect

a. Information you provide

• Account data: name, email, password (hashed), phone number, organization name, role, and profile photo.
• Workspace content: leads, contacts, deals, projects, tasks, tickets, documents, messages, time entries, and any files you upload.
• Billing information: handled by our payment processor; we receive only transaction metadata.
• Communications: messages you send to support and content you exchange with our AI assistant.

b. Information from connected services

When you connect a third-party account (such as Google, Microsoft, or a storage provider), we use OAuth tokens to access only the data the integration requires. We never receive your third-party password, and you can revoke access at any time from Settings › Integrations or from the provider directly. For details specific to Google integrations and the OAuth scopes we request, see Section 5 (“Google User Data”).

• Email integrations (Gmail, Outlook): messages, threads, drafts, attachments, labels, and send-as identities, used to power the in-app Mail feature.
• Calendar integrations (Google Calendar, Microsoft): events, attendees, locations, and Meet/Teams links, used for in-app scheduling and event sync.
• Storage integrations (Google Drive, etc.): file metadata and the contents of files you choose to attach or import.

c. Information collected automatically

• Usage data: pages viewed, features used, actions taken, and approximate timestamps.
• Device data: browser type, operating system, IP address, and screen size.
• Cookies: required cookies for sign-in sessions, plus optional analytics cookies.

2. How We Use Information

• Provide, maintain, and improve the Service.
• Authenticate users and enforce role-based access controls.
• Power AI features (lead scoring, drafting suggestions, the chatbot).
• Send transactional emails (account activity, invitations, notifications).
• Detect and prevent abuse, fraud, and security incidents.
• Meet legal, accounting, and compliance obligations.

3. Legal Bases (EEA/UK Users)

We process your personal data on the bases of (a) performance of a contract with you, (b) our legitimate interests in operating and securing the Service, (c) your consent for optional features, and (d) compliance with legal obligations.

4. AI Features

The Service uses large language models (currently Google Gemini, accessed by us under our own developer API key — not your Google account) and vector search (Pinecone) to power features such as the AI assistant, AI-assisted email composition, and content suggestions. Prompts and the specific context you submit may be transmitted to these providers under their data-processing terms. We do not allow your workspace content, your messages, or any Google user data we receive on your behalf to be used to train third-party foundation models, including Gemini.

5. Google User Data

This section describes how My DA Hub accesses, uses, stores, and shares information from Google APIs. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

a. OAuth scopes we request

You only grant the scopes for an integration when you connect it. The Service requests the following Google OAuth scopes:

• Account identity — openid, https://www.googleapis.com/auth/userinfo.email, and https://www.googleapis.com/auth/userinfo.profile. Used to identify your Google account and link it to your My DA Hub account (email address, name, profile picture).
• Gmail — https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/gmail.modify, https://www.googleapis.com/auth/gmail.send, and https://www.googleapis.com/auth/gmail.compose. Used to display your messages and threads inside the in-app Mail feature, send replies and new emails on your behalf, save drafts you create in the app, mark messages as read/unread, archive, label, move between folders, and (where supported) register for Gmail push notifications so the inbox stays in sync.
• Google Calendar — https://www.googleapis.com/auth/calendar and https://www.googleapis.com/auth/calendar.events. Used to read your calendar events (title, description, location, start/end times, attendees, Meet links) so they appear in the in-app calendar, and to create or update events on your behalf when you schedule them from the app.
• Google Drive — https://www.googleapis.com/auth/drive.file and https://www.googleapis.com/auth/drive.readonly. Used to read file metadata and the contents of files you choose to attach, preview, or import into the Service.

b. How we use Google user data

• Display your Gmail messages, Calendar events, and Drive files inside the user-facing features you have opted into.
• Send emails, save drafts, modify message state (read/labels/archive), create calendar events, and upload files at your explicit direction.
• Keep your in-app inbox and calendar in sync by performing incremental syncs and, where available, receiving Gmail push notifications.
• When you click an AI feature inside the Mail composer (for example, “rewrite this email” or “suggest a reply”), the relevant message text you are working on is sent to Google’s Gemini API to generate the suggestion. The generated suggestion is returned to you; we do not retain a separate copy of the prompt content.

c. How we store Google user data

• OAuth tokens (access tokens, refresh tokens, expiry, granted scopes) and the Google account email address are stored encrypted in our database so we can maintain the connection.
• Gmail messages you have access to are synced into our database (subject, sender/recipients, body, headers, attachments) so the Mail feature can search, thread, and display them quickly.
• Calendar events are synced into our database (title, description, location, attendees, times, Meet links) for in-app calendar display.
• Drive file content is fetched on demand when you open or attach a file; we do not bulk-mirror your entire Drive.

d. Sharing of Google user data

We do not sell Google user data and we do not share it with third parties for advertising. We share it only with the infrastructure subprocessors listed in Section 6 that are strictly necessary to operate the Service (for example, our database/hosting provider), and — only when you explicitly trigger an AI feature — with Google’s Gemini API to generate the suggestion you requested. Google user data is never used to train AI models, including Gemini.

e. Limited Use of Google Workspace APIs

My DA Hub’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not (i) use Google user data for serving advertisements, (ii) allow humans to read Google user data unless we have your affirmative consent for specific messages, it is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for the app’s internal operations using only aggregated and anonymized data, and (iii) transfer Google user data to others except as needed to provide or improve user-facing features that are prominent in the app, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.

f. Retention and revocation

You can disconnect a Google integration at any time from Settings › Integrations or by revoking access in your Google Account permissions page. When you disconnect, we delete the OAuth tokens immediately and remove the synced Gmail messages and Calendar events for that account within 30 days, unless we are required to retain them for legal, tax, or security purposes (in which case they are isolated and access-restricted until that retention period ends).

6. Sharing & Subprocessors

We do not sell your personal data. We share data only with:

• Service providers (subprocessors) who host or operate the platform, including: InsForge (database, authentication, storage, functions), Vercel (application hosting), Sentry (error monitoring), Google (Gemini AI), Pinecone (vector database), Meilisearch (search), and our email/SMS delivery providers.
• Other users in your organization, according to the role and permissions assigned to you.
• Authorities when required by law, subpoena, or to protect rights, safety, or property.
• Successors in connection with a merger, acquisition, or sale of assets, subject to this Policy.

7. Data Retention

We retain workspace content for as long as your account is active. When an account is cancelled, we delete or anonymize personal data within 90 days, unless we are required to retain it for legal, tax, or security purposes. Backups are purged on their normal rotation thereafter.

8. Security

We use industry-standard safeguards including TLS in transit, encryption at rest, least-privilege access, audit logging, and regular dependency monitoring. No system is perfectly secure; you are responsible for keeping your password and OAuth tokens confidential.

9. International Transfers

Our subprocessors may process data in regions outside your country, including the United States and the European Union. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal data.
• Export your workspace data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent for optional processing.
• Lodge a complaint with a supervisory authority.

You can exercise most of these rights from within the app under Settings › Privacy, or by emailing us at info@almcorp.com.

11. Children

The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

12. Agency & White-Label Workspaces

If you access the Service through an agency workspace (with custom branding or a custom domain), the agency is the controller of your workspace data and this Policy applies to ALM Corp’s processing as a processor on the agency’s behalf. Direct rights requests should generally be sent to the agency that invited you.

13. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced in the app or via email at least 14 days before they take effect.

14. Contact

ALM Corp — operator of My DA Hub
Email: info@almcorp.com