سياسة الخصوصية

GhostAgent's integration with Google APIs (specifically the Google Calendar API) is designed to synchronize booking schedules and prevent double-booking. We take user privacy and data security extremely seriously.

1. Data Sharing, Transfer, and Disclosure

GhostAgent does not sell, trade, or rent user data obtained from Google APIs to third parties. Google user data (such as calendar event titles, durations, and free/busy times) is strictly processed to execute calendar synchronization requested by the workspace owner.

When extracting appointment parameters, Google user data may be securely processed using compliance-vetted third-party AI services: **OpenAI API** and **Google Gemini API**. These models are integrated strictly in their API capacity—meaning that they do not use, store, or train on any submitted customer or Google user data. No Google user data is shared, disclosed, or transferred to any other entities or used for training generalized AI models.

2. Data Protection and Security Mechanisms

We employ industry-standard security controls to protect sensitive information, including Google user data.

• Encryption in Transit: All data transferred between our servers, database, and client devices is encrypted using Transport Layer Security (TLS/HTTPS).
• Encryption at Rest: All database storage, credentials, and access tokens (including OAuth refresh tokens) are encrypted at rest using AES-256 standard encryption.
• Access Isolation: Access tokens are restricted to dedicated server-side environments and are only used for the authenticated workspace. Strict database row-level security (RLS) guarantees data isolation.
• Vulnerability Management: We perform regular audits and dependency updates to prevent security risks or unauthorized access.