SyncGridSyncGrid

Legal

Boardroom Privacy Policy

Last Updated: October 23, 2026

This is the detailed policy for the Boardroom, where your AI team works. The company-wide policy is at syncgrid.io/privacy.

The SyncGrid Boardroom is operated by SyncGrid LLC ("we," "our," or "us"). This policy explains how we collect, use, disclose and safeguard your information when you use the Boardroom: your business profile, your contacts and pipeline, your conversations and what your team remembers, and the accounts you connect.

1. Information We Collect

Account Information

Your name, email address and Google account profile data obtained through Firebase Authentication when you sign in. Staff you add are recorded with the seat you gave them.

Business Profile

What you tell your Chief of Staff and the directors about your business: who you serve, what you offer, your voice and brand, your goals. You may keep more than one business profile on one account.

What Your Team Remembers

Facts you state in conversation that the team keeps so it does not ask twice, each dated and quoted back to you. You can see and delete every one from your Profile.

CRM and Pipeline Data

Contacts, deal stages, interactions, notes, consent flags and follow-up schedules that you enter, that arrive from forms on your website or offer pages, or that the team records on your instruction.

Conversation History and Drafts

The messages you send and receive in the Boardroom and the drafts, proposals, posts and reports made for you, kept so you can return to them. Conversations are scoped to your account and the business profile they happened under.

Files You Upload

Documents and images you attach in the Boardroom are sent to our AI providers to fulfil that request and are stored as part of the conversation so the team can refer back to them. We do not copy them anywhere else. You are responsible for the files you upload and must not upload content you are not authorised to share.

The Night Shift and Prospecting

Overnight the team searches for local businesses that match your best customers (through the Google Places API), scores them for fit, and drafts follow-ups to contacts who have gone quiet. The search criteria, results and drafts are stored under your business profile until you act on them.

Connected Accounts

Google: when you authorise Gmail, Google Calendar or Google Drive, we store the OAuth tokens so your approved emails can send from your own address, invites can be created and files attached, strictly inside approval-gated workflows. Social accounts: when you connect Facebook, Instagram, LinkedIn, X, YouTube or TikTok for posting, we store those tokens so posts you approve can be scheduled and published. Texting: where enabled for your business, a dedicated number is set up by hand and texts you approve are sent through Twilio to contacts with recorded consent; STOP replies are recorded.

Payment Information

Payment details are processed by Stripe. We never store card numbers.

Device and Usage Data

IP address, browser type, operating system and usage events, for debugging, monitoring and improving the service. The Boardroom carries no analytics or advertising trackers.

2. AI Providers and the No-Training Guarantee

Your data is never used to train AI models. Your team runs on models from Google (Gemini, on Vertex AI), Anthropic and OpenAI, and content tools use image and video generation providers. Each receives only what is needed to fulfil your request, under commercial API terms that do not permit training on customer inputs. Your business profile, contacts, conversations and the content made for you remain yours.

3. Multi-Tenant Data Isolation

Your profile is yours alone. Every read and write of business profile and CRM data passes through a fail-closed ownership guard that checks your user ID against the data's owner. The guard:

  • cannot be bypassed by any tool, agent or director;
  • writes a structured log entry for every blocked cross-tenant access;
  • scopes every query by your user and business profile, so there are no cross-tenant reads.

4. Google Workspace Integration

What we access via OAuth:

  • Gmail (send scope only): used to send email on your behalf. The directors compose each email and present it to you in the app; it is sent only after you explicitly approve it. We do not read your inbox and we never send without your approval.
  • Calendar: used to create meeting invites for booked calls. Approval-gated.
  • Drive (file scope, optional): used to attach files you choose to outreach. Approval-gated.
  • What we never do: read your existing inbox, scan your contacts, or auto-send anything without your click.

You can revoke access at any time from your Google Account permissions or from Settings inside the Boardroom.

Limited Use.SyncGrid's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described above; we do not use it for advertising; we do not sell it; we do not transfer it to others except as necessary to provide the service, comply with applicable law, or with your explicit consent; and no human reads your Google data except where you explicitly approve an action, where necessary for security, or where required by law.

5. How We Use Your Information

  • Provide and maintain the Boardroom
  • Let your team do its work in your voice: read your profile and memory, draft outreach and content, find leads, manage your pipeline
  • Hold every outbound action for your approval and record what you decided
  • Process subscriptions and manage your account
  • Send technical and account notices and respond to support requests
  • Monitor usage to debug issues and improve the product
  • Protect against fraud and abuse, and comply with legal obligations

6. Data Sharing

We may share your information with:

  • Service providers: Google Cloud (Cloud Run, Firestore, Cloud SQL for session storage, Secret Manager, Firebase Authentication), the AI providers in Section 2, Stripe (payments), Google Places (prospecting), Twilio (texting, where enabled), and the social networks you connect
  • Legal requirements: when required by law, court order or government request
  • Business transfers: in connection with a merger, acquisition or asset sale, under this policy

We do NOT sell your personal data, profile data or CRM data to anyone, and we never market to your contacts.

Law Enforcement & Government Data Requests

  • Legal review required: every request is reviewed for validity before any disclosure
  • Right to challenge: we may challenge overly broad, vague or unlawful requests
  • Data minimisation: we disclose only the minimum necessary
  • User notification: unless prohibited by law or court order, we notify affected users so they may seek counsel

7. Data Security

  • Encryption in transit (TLS) and at rest (Google Cloud managed encryption on Firestore, Cloud SQL and Secret Manager)
  • API keys and service credentials kept in Google Secret Manager; OAuth tokens kept in Firestore, scoped to your account, and deleted when you disconnect
  • Fail-closed multi-tenant isolation guard on every read and write, with blocked attempts logged
  • Nightly database backups with point-in-time recovery and delete protection
  • One named operator (the founder) with system access; no outside developers or contractors
  • If a security incident affects your data we tell you within twenty-four hours of confirming it, and regulators within seventy-two hours where required

8. Your Rights

Legal basis for processing (EEA / UK)

  • Consent: when you connect Google or a social account
  • Contract: processing needed to provide the Boardroom you subscribed to
  • Legitimate interests: improving the service, preventing fraud, ensuring security
  • Legal obligation: complying with applicable law

Your data rights

  • Access and portability: download your contacts, notes, drafts, deals, approvals, events and memory any day from Settings → Your data, as one JSON file or a contacts CSV
  • Correction: update your information at any time
  • Deletion: request deletion of your account and data from your Profile. The request starts a thirty-day clock, is confirmed by typing, and is carried out by a person, so a slip can never erase a business by accident
  • Withdraw consent: disconnect Google or a social account from Settings; the tokens are deleted when you do

To exercise any of these rights, contact joey@syncgrid.io. We respond within thirty days.

9. Data Retention

  • Profile, memory and CRM data: until you delete it or your account is deleted
  • Conversation history, drafts and uploaded files: until you delete the conversation or your account
  • Night-shift leads and drafts: until you act on them or delete them
  • OAuth tokens: while the connection is active; deleted when you disconnect
  • Approval and audit records: kept with your account as the record of what you approved
  • Payment records: as required by tax law

10. Cookies

The Boardroom uses essential cookies only: your sign-in session and your Light / Dark / Auto appearance choice. There are no analytics or advertising cookies in the app.

11. Children's Privacy

The Boardroom is for businesses and is not intended for anyone under 18. We do not knowingly collect personal information from minors; if we learn that we have, we delete it and close the account.

12. International Transfers

Your data is processed in the United States on Google Cloud. If you are outside the United States, you consent to that transfer; for EEA and UK users we rely on our providers' standard contractual clauses.

13. Changes to This Policy

We may update this policy. Material changes are communicated by email or in-app notice before they take effect. Continued use after changes constitutes acceptance.

14. Contact Us

Privacy requests and questions: joey@syncgrid.io

SyncGrid LLC, League City, Texas, USA