Privacy Policy

This is the Privacy Policy for Excellence AI, a governed enterprise AI coworker platform operated by Excellence Pay Kft. (“Excellence Pay”, “we”, “us”) at https://ai.excellencepay.com. It is a dedicated privacy policy page, not a homepage summary. Terms of service: https://ai.excellencepay.com/gtc.

Privacy contact: privacy@excellencepay.com.

This notice is written for Google OAuth / Google API Services verification and for GDPR. It discloses how the application accesses, uses, stores, and shares Google user data.

1. Who we are

Data controller: Excellence Pay Kft., operator of the Excellence AI service at https://ai.excellencepay.com. Excellence AI is an invitation-only signed-in workspace. It is not a public consumer chatbot and is not directed at children.

Privacy inquiries, access requests, and deletion requests: privacy@excellencepay.com.

2. Personal data we collect (other than Google APIs)

When you use or interact with Excellence AI, we may collect or process:

• Account and identity: name, email address, organization (tenant) membership, role, and sign-in events. Authentication is performed by Clerk.
• Contact inquiries: the name, phone number, email address, and message you submit through our public form. We use these details to respond; authorized platform administrators can review the messages.
• Workspace content: conversations with AI agents, tickets, uploaded files, approvals, playbooks, knowledge-base documents, cost budgets, and audit logs. These belong to the customer organization and are isolated per tenant.
• Device and security data: IP address, user-agent, timestamps, and similar technical logs used for authentication, abuse prevention, and incident investigation. We do not use advertising identifiers.
• Cookies: essential session cookies for sign-in (Clerk) and application security. We do not use advertising cookies, retargeting pixels, or independent analytics SDKs on this service.

3. What Google user data is accessed by this application

Connecting a Google account is optional. Excellence AI does not require Google Sign-In to enter the workspace. We request Google OAuth access only when a signed-in user (or a function enabled for that user by their tenant administrator) wants Gmail or Google Drive features.

With the user's OAuth consent, and only for the scopes the user grants, Excellence AI may access the following Google user data:

• Google account profile identifiers: email address and basic profile identifiers (for example via openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile) so we can label the connected account and bind the token to the signed-in user.
• Gmail: message content, headers, labels, drafts, and send/modify actions as granted. Typical scopes include https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/gmail.compose, https://www.googleapis.com/auth/gmail.send, and https://www.googleapis.com/auth/gmail.modify. We use these only to search, read, draft, send, or label email that the user asked an agent to handle.
• Google Drive: file and folder metadata and content as granted. Typical scopes include https://www.googleapis.com/auth/drive.readonly, https://www.googleapis.com/auth/drive.file, and — only if a tenant administrator enables it — https://www.googleapis.com/auth/drive. We use these to list, search, read, create, update, move, copy, trash, restore, or share files that the user requested.

We do not request Domain-wide Delegation. We do not access a Google account without the user's OAuth consent. We request only the scopes needed for the feature the user is connecting.

4. How this application uses Google user data

We will use Google user data solely to provide the user-facing services the user requested in Excellence AI. Examples:

• summarize or search Gmail threads the user asked an agent to work on;
• draft or send a reply from the connected Gmail account after the configured approval;
• read a Google Drive document so the agent can answer a question or prepare a draft;
• create or update a Drive file the user asked the agent to write.

Google user data is also used, where necessary, to:

• enforce access control, tenant isolation, and human-approval gates;
• keep an audit trail of agent runs for the customer organization;
• operate, secure, debug, and support the service.

We will not sell Google user data. We will not use Google user data for targeted advertising, personalized ads, retargeting, interest-based advertising, credit-worthiness, lending, or independent user profiling. We will not use Google Workspace API data to develop, improve, or train generalized or non-personalized AI / ML models.

5. How this application stores Google user data

OAuth access tokens and refresh tokens are stored encrypted in a server-side token vault (Google Cloud Secret Manager in production), bound to the user, tenant, and connector grant. Tokens are not stored in the browser, in prompts, or in application logs.

Gmail message bodies and Drive file contents are processed to perform the requested task. They may appear in that tenant's conversation, ticket, or audit trail so the organization can review the agent's work. We do not keep a wholesale secondary archive of the user's Gmail mailbox or Google Drive.

Account and workspace data are stored in the European Union or on infrastructure that is contractually protected by the operator. Data in transit uses TLS. Data at rest on our hosting and database processors is encrypted by those processors' standard controls.

6. How we share, transfer, or disclose Google user data

We do not transfer or disclose Google user data to third parties for purposes other than providing or improving the user-facing features of Excellence AI, except as required by law or for security investigations.

Recipients that may receive relevant data to complete a requested task:

• Large-language-model providers configured for the tenant (for example OpenAI, Anthropic, Google, or xAI): the prompt text and attached content needed for that run. A privacy gateway can tokenize or block sensitive fields (for example names, emails, phone numbers, secrets) before egress, according to tenant policy.
• Clerk — authentication and session management for the Excellence AI account (not the Google mailbox itself).
• Google Cloud / Firebase App Hosting and database processors — hosting, encrypted storage, and operational infrastructure acting as subprocessors.
• The customer organization — tenant administrators and authorized coworkers can see workspace conversations, approvals, and audit logs for their own tenant. Other tenants cannot.

We do not sell Google user data to data brokers or information resellers. We do not transfer Google user data to advertising platforms. Human access to Google user data by Excellence Pay staff is limited to security, abuse investigation, legal obligation, or support the user or tenant administrator requested.

7. Data protection mechanisms

Security procedures are in place to protect the confidentiality of your data:

• TLS encryption in transit for the application and Google API calls;
• encrypted storage of OAuth access and refresh tokens in a server-side vault;
• tenant isolation so one organization cannot read another organization's data;
• access control, role-based permissions, and human approval gates before sensitive outbound actions (for example sending email or sharing a Drive file);
• a privacy gateway that can pseudonymize or block sensitive fields before content is sent to an external model;
• audit logging of agent runs, connector use, and administrative changes;
• no Domain-wide Delegation and no service-account impersonation of end users.

8. Data retention and deletion

We retain personal information for the length of time needed to fulfill the purposes in this Privacy Policy, unless a longer period is required or permitted by law. When the retention period expires for a given type of data, we delete or anonymize it.

• Google OAuth tokens: retained only while the Google connection is active. If you disconnect Google in Excellence AI account settings, we delete the stored tokens and stop further Google API calls.
• Revoke at Google: you may also revoke Excellence AI at https://myaccount.google.com/permissions.
• Workspace content: retained for the life of the customer contract, then deleted or anonymized according to the contract and legal retention duties.
• Contact inquiries: retained for as long as needed to respond and follow up on your request.
• Audit logs: may be kept for the contractual security-retention period, then deleted or aggregated.

You may request that your data be deleted by writing to privacy@excellencepay.com or by asking your tenant administrator. We will honor deletion requests subject to legal and security-retention limits.

9. Limited Use of Google user data

Excellence AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace API data is used only to provide or improve user-facing features that are prominent in Excellence AI. We do not transfer Google user data except to provide those features with the user's consent, for security, to comply with law, or as part of a merger or sale after obtaining explicit prior consent. We do not use Google Workspace APIs to develop, improve, or train non-personalized AI and/or ML models.

10. Legal basis and your rights

Depending on the processing, our legal bases are performance of a contract (providing the service), legitimate interests (security, audit, abuse prevention), and — for Google API access — your consent, which you may withdraw at any time by disconnecting the Google account.

You may request access, rectification, erasure, restriction, portability, and you may object to processing based on legitimate interests. You may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH). Contact: privacy@excellencepay.com.

11. Children

Excellence AI is a business workspace for invited adult members of customer organizations. It is not directed at children under 16, and we do not knowingly collect Google user data from children.

12. Changes

If we change how Excellence AI uses Google user data, we will update this Privacy Policy and notify users as required, including prompting for consent before we use Google user data in a new way.