Privacy Policy

1. Introduction

Actiproc (“we”, “our”, or “us”) operates the Actiproc productivity platform available at https://www.actiproc.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service, including data we access from your Google Account when you enable the Google Calendar integration.

By using Actiproc, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the service.

2. Information We Collect

Account Information

When you register, we collect your name, email address, and password (stored as a secure hash). If you sign in with Google, we receive your name, email address, and profile picture from Google's standard sign-in scopes (openid, email, profile).

Content You Create

We store the tasks, board columns, notes, checklist content, reminders, and other content you create while using Actiproc. This data is associated with your account and your organization.

Usage Data

We may collect information about how you interact with Actiproc, including pages visited, features used, timestamps, and browser/device information, to improve the service.

Billing Information

Payment processing for new subscriptions is handled by Creem after checkout is activated. We do not store your payment card details. We receive subscription status, plan type, and seat counts from Creem to manage your account entitlements.

3. How We Use Your Information

• To provide, maintain, and improve the Actiproc service
• To authenticate your identity and manage your account
• To sync tasks with Google Calendar when you have enabled this integration
• To process payments and manage subscriptions using Creem
• To send transactional emails (e.g., account verification, password reset, reminders)
• To detect and prevent fraudulent or unauthorized use of the service
• To comply with legal obligations

We do not sell your personal data to third parties. We do not use your content, your Google user data, or any other personal data to train machine learning or AI models, including our own models or third-party models.

4. Google User Data

This section explains how Actiproc accesses, uses, stores, and shares data from your Google Account, in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

4.1 Scopes We Request and Data We Access

Actiproc requests the following Google OAuth scopes only when you explicitly connect Google Calendar:

• openid, email, profile — your Google account's unique identifier, email address, name, and profile picture. Used only to identify your account and personalize the UI.
• https://www.googleapis.com/auth/calendar.readonly — read-only access to the list of calendars in your Google Account, so you can choose which calendar to sync with. We do not read or store the contents of events created outside of Actiproc.
• https://www.googleapis.com/auth/calendar.events — permission to create, update, and delete calendar events on the calendar you selected, strictly for the Actiproc tasks and reminders you have associated with that calendar.

4.2 How We Use Google User Data

We use Google user data exclusively to provide and improve user-facing features:

• Creating, updating, and removing calendar events on your selected Google Calendar so your Actiproc tasks and reminders appear alongside the rest of your schedule
• Letting you pick which calendar to sync to from the list of your available calendars
• Showing your Google name, email, and profile picture inside Actiproc so you can verify which Google Account is connected

Google user data is not used for advertising, profiling, analytics outside the integration itself, or training any AI or machine-learning models.

4.3 How We Store Google User Data

• OAuth refresh token — encrypted at rest with AES-256-GCM and stored in our Supabase (PostgreSQL) database. The token is used server-side to call the Google Calendar API on your behalf.
• Calendar event IDs — for each Actiproc task we sync, we store the Google Calendar event ID that Actiproc created. This lets us update or delete the event when the underlying task changes. We do not store event titles, descriptions, attendees, or any other event content.
• Profile fields — your name, email, and profile picture URL received from Google sign-in are stored on your Actiproc account record.

All data is transmitted over TLS/HTTPS. Calendar event contents themselves remain on Google's servers and are not mirrored to Actiproc.

4.4 How We Share Google User Data

We do not sell, rent, or share your Google user data with any third party. Google user data is processed only:

• By Actiproc servers (hosted on Vercel) and our database provider (Supabase), acting strictly as our data processors
• By Google itself when we make API calls back to your Google Calendar on your instruction

4.5 Data Retention and Revocation

Your refresh token and stored event IDs are retained for as long as the Google Calendar integration is connected. You can revoke Actiproc's access at any time by:

• Using the “Disconnect Google Calendar” button inside Actiproc settings — this deletes the stored refresh token and all event-link records immediately
• Visiting myaccount.google.com/permissions and removing Actiproc from your authorized apps

If you delete your Actiproc account, all Google user data we hold about you is deleted along with it (see Section 8 — Data Retention).

4.6 Limited Use Disclosure

Actiproc's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google user data to provide the user-facing Google Calendar synchronization feature described above
• We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger or acquisition (in which case successor entities will be bound by this policy)
• We do not use Google user data to serve ads of any kind
• We do not allow humans to read your Google user data unless we have your affirmative agreement for specific items, it is necessary for security purposes (e.g., investigating abuse), or to comply with applicable law

5. Data Storage and Security

Your data is stored in Supabase (PostgreSQL), hosted on secure cloud infrastructure. Google Calendar refresh tokens are encrypted at rest using AES-256-GCM before storage. All data in transit is encrypted via TLS/HTTPS.

While we implement industry-standard safeguards, no method of electronic storage is 100% secure. We cannot guarantee absolute security.

6. Third-Party Services

Actiproc integrates with the following third-party services:

• Supabase — database and authentication infrastructure
• Google APIs — Sign-in with Google and Google Calendar integration (see Section 4 for details)
• Creem — subscription billing and payment processing
• Vercel — application hosting and edge infrastructure

Each of these providers has its own privacy policy governing the data they process on our behalf.

7. Cookies

We use session cookies required for authentication (NextAuth.js session token) and short-lived cookies for OAuth state verification (e.g., Google Calendar connection flow). We do not use advertising or tracking cookies.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data — including any stored Google refresh tokens and calendar event-link records — within 30 days, except where retention is required by law or legitimate business purposes (e.g., billing records).

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data in a portable format
• Withdraw consent for optional data processing (e.g., disconnect Google Calendar)

To exercise any of these rights, contact us at yigittilaver2000@gmail.com.

10. Children's Privacy

Actiproc is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a prominent notice on the service. Continued use of Actiproc after changes constitutes your acceptance of the updated policy.

12. Contact

If you have questions or concerns about this Privacy Policy, or wish to exercise any of the rights described above, please contact us at: