LEAD INTELLIGENCE

Privacy Policy

Last updated: October 13, 2026.

1. Application and contact

This policy applies to the private Lead Intelligence installation at server.novatg.xyz. The installation owner is responsible for its operation and data handling. For access, correction, or deletion requests, contact toomas.taro@gmail.com.

2. Data we process

• Company, domain, and business contact information and CRM notes entered by the owner.
• Application account information, a protected password hash, sessions, and sign-in events.
• Technical request and error logs, task execution information, reports, and delivery results.
• For Gmail: configured sender and recipient addresses, OAuth tokens, the content of outgoing reports generated by the application, and the sent message identifier returned by Google.
• For Telegram: the owner's account identifier, messages containing bot commands, and report delivery results.

3. Google access and purposes

With the owner's consent, Google OAuth enables the application to send operational reports through the Gmail API. The requested scope is https://www.googleapis.com/auth/gmail.send. The application does not receive the Google password or request permission to read the mailbox, attachments, or contacts. A refresh token maintains authorized sending without requiring sign-in for every report.

Addresses and sent message identifiers are used to deliver reports and track delivery. Google data is not sold or used for advertising, profiling, or training general-purpose artificial intelligence models. Administrator access is limited to configuring and maintaining features authorized by the owner.

4. Sharing and recipients

The application runs on the owner's VPS; the hosting infrastructure processes data to store and operate the service. Google receives the information needed for OAuth and email delivery, including addresses and report content. The configured recipient receives the email.

When Telegram delivery is enabled, the operational report generated by the application and the owner's chat identifier are sent to Telegram. Google mailbox contents are not read or forwarded to Telegram. Recipients and service providers handle the data they receive under their own policies. Other disclosures may occur at the owner's direction or where required by applicable law.

5. Retention and security

Connections to the web application and Google use HTTPS. The workspace requires authentication. OAuth tokens are stored separately from source code with restricted access permissions. Secrets are redacted from application logs.

Technical events and measurements in the database are retained for 30 days; container and maintenance logs are rotated by size. CRM records, reports, change history, and incidents remain until deleted by the owner. Database backups are rotated, retaining the seven most recent copies. OAuth tokens remain until the integration is disconnected and the owner deletes them.

6. Revoking access and deleting data

Google authorization can be revoked through Google Account connections. Revocation prevents the application from continuing authorized sending through that connection; previously sent emails and saved reports are not automatically deleted.

To disconnect the integration, remove locally stored OAuth tokens, or request correction or deletion of data, contact the owner at toomas.taro@gmail.com. The administrator performs deletion after verifying the request. Copies in backup archives expire through backup rotation. Emails in Gmail and messages in Telegram can also be managed using those services.

7. Cookies

The private workspace uses essential cookies for sessions and form security. Advertising trackers and third-party web analytics are not enabled.

8. Limited Use of Google data

The use and transfer of information received through Google APIs adhere to the Google API Services User Data Policy, including its Limited Use requirements. Data is used only for the user-facing features described in this policy.

9. Changes

This page will be updated when features or data handling practices change. Any additional Google permissions will be requested separately before they are used.