AUTOMATION PORTAL · PRIVACY

Automation Privacy Notice

This notice describes the Mokadem Group automation portal and the integrations a business customer chooses to enable. The separate website privacy policy applies to ordinary visits and direct inquiries on our corporate website.

1. Who operates the service

We manage operator accounts, support and the operation of the platform. A business customer normally determines why its own customer information is used and instructs us to process that information. Its customer-facing notices and our service agreement define those instructions and the respective responsibilities. The applicable legal roles depend on the actual processing, not only on labels in a contract.

2. Information we process and why

• Operator identity: Google sign-in identity, name, email address, assigned role and authorized workspace, to sign in and restrict access. The portal does not collect your Google password.
• Conversations: phone numbers or email addresses, incoming and outgoing messages, supported media, conversation summaries, delivery events and handoff information, to provide the enabled messaging service.
• Consent and preferences: records of choices, the source of a request, timestamps and opt-outs, to apply channel rules and stop disallowed notifications.
• CRM: authorized contact properties, notes, tasks and associations needed for the customer's chosen HubSpot functions.
• Appointments: availability, event identifiers, dates, time zones and relevant event details, to display, reserve, change, cancel and synchronize appointments on the selected calendar.
• Business knowledge: documents and extracts supplied by the customer, to answer questions using its approved information.
• Operational records: identifiers, action status, timing, errors and security/audit records, to prevent duplicates, investigate incidents and manage usage.
• Integration credentials: API keys and OAuth refresh tokens, to access authorized providers. They are kept in Google Secret Manager rather than ordinary conversation exports.

For our own account administration and support, the applicable basis may include performing the service agreement and our legitimate interests in providing and protecting the service. We may retain information to comply with legal obligations. Where consent is required for a specific optional use, that use requires the appropriate choice. Each business customer must determine and document the basis for its own customer communications under applicable law. Supplying a phone number for a purchase does not automatically authorize every marketing use or override a channel's rules.

3. Google account and Calendar data

Basic Google sign-in requests identity scopes only. Connecting Calendar is a separate authorization: availability access (calendar.freebusy) and access to events on calendars you own (calendar.events.owned). The selected calendar is used for the appointment features you enable, including synchronization and appointment notifications. Relevant appointment information may appear in the portal and messages, or be processed by the AI workflow when needed for that user-facing function. We do not request access to your Gmail inbox through this integration.

Use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including its Limited Use requirements. Google API data is not sold, used for advertising, or used to train generalized AI models. Access by people is limited to authorized user-facing operations, expressly permitted support, security or legal needs.

You may disconnect an integration and revoke access through your Google account. Revocation stops future authorized access but does not itself erase information already stored for your workspace. Use the deletion procedure for that information.

4. AI and human oversight

Enabled AI features send relevant messages, authorized business knowledge and necessary workflow context to Google Vertex AI to propose a response or action. We do not send integration credentials to the conversational model. Deterministic checks enforce the customer's enabled services, permissions, confirmations, channel restrictions, costs and human handoffs.

Draft mode requires an operator's approval for the applicable automated actions. Active mode still applies those checks; it is not unrestricted execution. An appointment or CRM change is considered successful only after the provider result, not because the AI proposed it. Authorized operators can take over a conversation. This service is not intended to determine eligibility for employment, lending, housing or other high-impact outcomes.

5. Providers and international processing

The current primary application and database hosting are in the United States. Using the service from Europe or another country does not mean your data stays in that country. Provider processing locations may differ. Relevant service agreements must specify the applicable providers and transfer safeguards where required. We may disclose information when legally required or to protect the service from abuse; we do not sell workspace data or use it for cross-context behavioral advertising.

6. Retention, backups and deletion

The platform defaults are 30 days for raw events, 365 days for conversations and 730 days for audit records. Authorized configuration may change them; the applicable customer's policy, legal holds and provider retention also matter. These defaults are technical settings, not mandatory statutory retention periods.

Encrypted database backups have separate retention. Removing active records does not immediately remove every older backup. An independent deletion register is used to reapply completed deletions before a restoration is returned to service. Deletion actions at connected providers require their own processing; a request is not reported as fully completed merely because local records were removed. Some providers may require an additional manual retention review.

Unsubscribing from messages and deleting all personal information are different requests. See data deletion instructions.

7. Choices, rights and contact

Contact contact@mokademgroup.com for data we control. For another business's customer data, identify that business; we may refer the request to it or assist under its instructions. Applicable rights may include access, correction, objection, restriction, deletion and portability, as well as a complaint to the relevant authority. We may need proportionate identity verification.

Do not send passwords, API keys, OAuth tokens, payment details or unnecessary identity documents with a request. The response and any legally necessary retention depend on the applicable law and the scope of the request.

8. Access controls, cookies and updates

The service uses authenticated sessions, workspace-scoped roles, database isolation, webhook signatures and protected integration secrets. Authorized administrators may access information needed for their assigned functions. These controls do not constitute an absolute security guarantee.

The portal uses a secure session cookie for authentication and authorized actions. This is not marketing consent. The corporate site's cookie notice describes its separate practices. The service is intended for businesses, not directed to children. Material changes to processing will require updating the relevant notices.