Privacy Policy

CanCG ("we", "us", "our") is a product of DeployPoint.ai. This Privacy Policy describes how we collect, use, store, and protect personal information when you use the CanCG service at cancg.com (the "Service").

1. Information We Collect

When you create an account or sign in with Google, we collect:

• Account information: email address, display name, and profile picture (if signing in with Google).
• Authentication credentials: hashed passwords (for local accounts) or Google OAuth access and refresh tokens (for Google sign-in).
• Service configuration: the Google Drive spreadsheet ID you choose to monitor, the notify email address, your reminder timing preferences, and the language preference.
• Activity data: contact details extracted from your spreadsheet, reminder email send history, classifier results from email replies, and login/logout events.
• Technical data: IP address (logged with activity events), browser session cookies.

2. How We Use Google User Data

If you sign in with Google, we request the following scopes:

• Gmail (read-only): to scan replies on email threads we have sent on your behalf, in order to detect upload confirmations.
• Gmail (send): to send reminder emails from your Gmail account to the contacts and notify address you have configured.
• Google Drive (read-only): to read the contents of the single spreadsheet you explicitly configure for contact monitoring. We do not access any other files in your Drive.
• Profile and email: to identify your account.

We do not use Google user data for advertising, do not transfer it to third parties (except as described under "AI Processing" below for the limited purpose of running the Service), and do not allow humans to read it except (a) with your explicit consent, (b) for security purposes, or (c) to comply with applicable law.

3. AI Processing

We use OpenAI to power features including reply classification, schedule extraction, email translation, and the in-app co-pilot. When these features are used, the relevant snippets (e.g. an individual email reply, an uploaded schedule file, your co-pilot prompt) are sent to OpenAI's API. OpenAI does not use API data to train models. Refer to OpenAI's API data usage policy for details.

4. How We Store and Protect Data

Your data is stored in a managed PostgreSQL database (Neon) hosted on AWS in the United States. All connections to the database use TLS encryption. All connections to the Service use HTTPS / TLS encryption. Passwords are hashed using scrypt. OAuth tokens are stored server-side and are never exposed to client browsers.

5. Data Sharing

We do not sell your data. We do not share your data with third parties except:

• With service providers strictly necessary to operate the Service: our database host (Neon / AWS), OpenAI for AI processing, Google for OAuth and Gmail/Drive access on your behalf.
• If required by law, court order, or to protect our legal rights.

6. Data Retention

We retain your account and configuration data for as long as your account is active. Activity events (login history, send history) are retained indefinitely while your account is active for analytics and audit purposes. You may request deletion of your account at any time by emailing info@deploypoint.ai; upon deletion, all personal data including OAuth tokens, contacts, and activity events are permanently removed within 30 days.

7. Your Rights

You may at any time:

• Access, correct, or export your personal data.
• Disconnect your Google account by visiting Google's third-party access page.
• Delete your account by emailing info@deploypoint.ai.

8. Cookies

We use a single HTTP-only, secure session cookie (ff_session) to keep you signed in. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

9. Children

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be communicated via email to active account holders.

11. Governing Law

This Privacy Policy is governed by the laws of the Province of Ontario, Canada.

12. Contact

For questions, requests, or complaints regarding this Privacy Policy or our handling of your personal data, contact:

DeployPoint.ai
Email: info@deploypoint.ai