Google App Privacy Policy & API Data Disclosure

1. Overview & Applicability

WhatNexis provides an AI-powered business communication and workflow automation platform. This policy specifically applies to users who authenticate with Google, connect Google Workspace applications (such as Google Sheets, Google Drive, or Google Calendar), or install the WhatNexis WhatsApp Google Workspace Add-on.

We are committed to maintaining the highest standards of transparency, data privacy, and security in compliance with the Google API Services User Data Policy, applicable global data protection laws (including GDPR and the Digital Personal Data Protection Act), and industry best practices.

2. Google User Data We Access & Collect

When you interact with our Google integrations or authorize our Google Workspace add-on, we only request the minimum permissions (OAuth scopes) necessary to deliver the functionality you explicitly trigger:

3. How We Use Google User Data

We use Google user data strictly to provide user-facing features that you have explicitly authorized. Specifically:

• Direct Messaging from Google Sheets: To read recipient contact details and template variables from your selected Google Sheet and send corresponding WhatsApp notifications or messages via the official Meta WhatsApp Business Cloud API.
• Real-Time Delivery Reporting: To update your Google Sheet with the live status of each message (e.g., timestamp, status code, delivery confirmation) so you have an immediate audit trail directly inside your spreadsheet.
• Automated Appointment Booking: To schedule or modify Google Calendar events when an end-user confirms a booking via WhatsApp chat workflows.
• Authentication & Account Security: To verify user identity, prevent unauthorized access, and protect your account.

Data processing occurs only in real-time or during scheduled automation tasks explicitly configured by you. We do not process Google user data in the background for any unrelated or secondary purpose.

4. Google API Limited Use Policy Disclosure

WhatNexis strictly adheres to the Google API Services User Data Policy. In compliance with Google's Limited Use requirements:

5. No Selling, Sharing, or AI Model Training

We maintain a strict zero-tolerance policy regarding the misuse of user data:

• We DO NOT sell Google user data: We do not sell, rent, license, monetize, or trade any Google user data, spreadsheet contents, contact information, or Google account data to third parties, data brokers, or advertisers under any circumstances.
• No Advertising: We never use or disclose Google user data to serve targeted advertisements, retargeting campaigns, or personalized promotions.
• No AI / ML Model Training on Private Data: We do NOT use Google user data (including Google Sheets data, Google Drive contents, or Google Calendar data) to train, test, or fine-tune generalized machine learning or artificial intelligence models.
• No Human Inspection: No WhatNexis employee, contractor, or third party reads or inspects your Google user data or spreadsheet contents, except in the following limited situations: (a) with your express written permission for resolving a specific technical support ticket; (b) where required by applicable law, regulation, or legal process; or (c) where necessary for internal system security investigations (e.g., detecting severe security incidents or abuse).
• Third-Party Infrastructure: We share data only with reputable cloud hosting and database providers (such as Amazon Web Services and Google Cloud Platform) solely to host and run our application infrastructure. All service providers are bound by strict confidentiality and data protection agreements and are prohibited from using your data for their own purposes.

6. Data Storage & Security Measures

We employ comprehensive technical, administrative, and physical safeguards to protect Google user data against unauthorized access, disclosure, alteration, or destruction:

• Encryption in Transit: All data transmitted between your browser, Google APIs, and our servers is encrypted using modern Transport Layer Security (TLS 1.2 / TLS 1.3) and HTTPS protocols.
• Encryption at Rest: OAuth tokens, credentials, and sensitive identifiers stored in our databases are encrypted using industry-standard AES-256 encryption.
• Ephemeral Spreadsheet Processing: When sending WhatsApp messages from Google Sheets, sheet data is processed in-memory for the immediate duration of the messaging job. We do not store or mirror the full contents of your spreadsheets on permanent storage.
• Access Controls & Monitoring: System access is strictly limited to authorized personnel based on the principle of least privilege. All system activity and API access are logged and monitored for suspicious activity.

7. Data Retention, Revocation & Deletion

We retain Google user data only for as long as necessary to provide the services you requested or until you choose to revoke access or delete your account.

How to Revoke Google Permissions:

You can revoke WhatNexis' access to your Google Account at any time directly through your Google Account Security settings:

1. Visit your Google Account Permissions page: https://myaccount.google.com/permissions
2. Select WhatNexis or WhatNexis WhatsApp from the list of authorized apps.
3. Click Remove Access or Delete all connections.

Once revoked, our application will immediately lose all ability to interact with your Google Account, Google Sheets, or Google Calendar.

How to Request Data Deletion:

You have the right to request complete and permanent deletion of all data associated with your account, including stored OAuth tokens, logs, and account profiles:

• Submit an automated deletion request via our Data Deletion Portal: https://whatnexis.com/data-deletion
• Or email our Data Protection Officer directly at privacy@whatnexis.com with the subject "Google Data Deletion Request".

Upon receiving your request, all associated Google OAuth tokens, user credentials, and related records will be permanently purged from our active servers and backups within 30 days.

8. User Rights & Controls

Under applicable data protection legislation (such as GDPR, CCPA, and DPDP Act), you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure (deletion) of your personal data.
• Object to or restrict the processing of your data.
• Request data portability in a machine-readable format.
• Withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at privacy@whatnexis.com.

9. Children's Privacy

Our services and Google integrations are designed exclusively for businesses and professionals. We do not knowingly collect or solicit personal data from individuals under 18 years of age. If we become aware that an underage user has provided personal data, we will promptly delete such information.

10. Changes to This Privacy Policy

We may update this Google App Privacy Policy from time to time to reflect operational, legal, or regulatory changes, or updates to Google API policies. Any updates will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

11. Contact & Legal Entity Information

If you have any questions, concerns, or inquiries regarding this Privacy Policy, our compliance with Google API User Data policies, or our data handling practices, please contact us: