Privacy Policy
Last updated: October 31, 2026
This policy explains how My Intelligent P.A handles information when you use the app. Your organization may have additional privacy rules for the business records it manages here.
Information we handle
When you sign in, we receive your name, email address and profile photo from Google through Firebase Authentication. We use this information to identify your account and provide access to your organization.
The service stores information that you or your organization enter, such as company and staff details, finance and bank records, tasks, calendar entries, notes and documents. This information may include personal information about employees, customers, suppliers or other people. Only add information you are authorized to provide.
The service also processes account settings, referral and access records, and basic security information such as session and request data needed to operate and protect the service.
How we use information
We use information to authenticate users, enforce organization access, display and update business records, provide the features you request, and maintain service security and reliability.
If an administrator or user enables the AI assistant, the question and relevant workspace context needed to answer it are sent to Google Gemini for processing. Do not include sensitive information in an AI request unless you are authorized to do so.
Google user data
When you connect a Google service, My Intelligent P.A requests the permissions shown on Google's consent screen and accesses that Google account only to provide the Google feature you selected. Google data is used to display or update that feature at your direction; it is not sold or used for advertising.
Google OAuth access and refresh tokens are encrypted before storage and are used to make authorized requests to Google APIs and refresh access. Google API data is shared only as needed with Google to provide the connected feature, with Cloudflare to host and store the app's records, or when required by law. We do not use Google API data to train generalized AI or machine-learning models.
You can disconnect Google services in the app or revoke access through your Google Account settings. Revoking access stops future API access but does not itself remove records already stored in the app.
Other connected services
The app may connect to bank or payment services when an organization configures them. Information needed to perform a connection or payment is sent to that provider. Their own privacy terms apply to their handling of it.
We use Cloudflare to host the app and store application records, and Firebase Authentication for Google sign-in. Google's services process sign-in, Workspace, Calendar and AI requests as described above.
Storage and security
Application records are stored server-side in Cloudflare D1. Session cookies are HttpOnly and use same-site protections. Integration credentials and OAuth tokens are encrypted before they are stored. We use access controls to limit records to authorized organization members.
No online service can guarantee absolute security. Keep your account credentials private and tell your organization administrator promptly if you suspect unauthorized access.
Sharing and retention
We do not sell personal information. Information is shared with service providers only as needed to host the service or perform a feature you or your organization enabled. Organization administrators and members with appropriate roles can access records within their organization.
Records are kept while needed to provide the service and support the organization's business and recordkeeping obligations. Organization administrators manage their organization's data and should handle retention and deletion requests for that data.
Your choices
You can choose whether to connect optional Google or financial services and can disconnect them later. You may ask your organization administrator to review, correct, export or delete information associated with your organization, subject to applicable recordkeeping requirements.
Updates and contact
We may update this policy when the service or its data practices change. The date at the top indicates the latest revision. For privacy questions or requests, contact your organization administrator, who can direct the request to the service operator.