Esattas
    Back

    Privacy Policy

    Last updated: March 20, 2026

    1. Introduction

    Esattas ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our scheduling, sales, and business management platform ("Service"). By accessing or using Esattas, you agree to the terms of this Privacy Policy.

    2. Information We Collect

    2.1 Information You Provide

    • Account Information: Name, email address, phone number, company name, job role, and password when you register or are invited to join an organization.
    • Organization Data: Organization name, domain, logo, brand colors, and configuration preferences.
    • Booking Information: Meeting details, guest names, email addresses, phone numbers, companies, notes, and scheduling preferences provided during the booking process.
    • Sales Data: Deal names, values, stages, contact information, and notes entered into the deals pipeline.
    • Communications: Email content when you connect your email account via OAuth, including sent and received messages, subject lines, and attachments.
    • Payment Information: Billing details processed through our third-party payment processors. We do not store full credit card numbers on our servers.

    2.2 Information Collected Automatically

    • Usage Data: Pages visited, features used, interactions with the platform, timestamps, and session duration.
    • Device Information: Browser type, operating system, device type, IP address, and language preferences.
    • Cookies and Tracking: We use cookies and similar technologies to maintain sessions, remember preferences, and analyze usage patterns.

    2.3 Information from Third Parties

    • OAuth Providers: When you connect Google or Microsoft accounts, we receive access tokens, email addresses, and profile information as authorized by you.
    • Calendar Integrations: Calendar event data from Google Calendar, Outlook, or other connected calendar services.
    • Video Conferencing: Meeting links and metadata from Zoom, Google Meet, or Microsoft Teams integrations.

    3. Google Integration (Calendar, Meet & Email)

    If you choose to connect your Google account, Esattas may access your Google Calendar data to:

    • Read calendar availability
    • Create and manage calendar events
    • Generate and attach Google Meet conferencing details to events

    This data is used solely to provide scheduling and booking functionality. Users can revoke access at any time through their Google account settings.

    Gmail Integration

    If you connect your Google account for email, Esattas may access Gmail data to allow you to read, send, and manage emails within the platform. Email data is used solely to provide user-requested communication features and is not used for advertising or resale. Users can revoke access at any time via their Google account settings.

    Specifically, Esattas uses Gmail access to:

    • Read incoming emails related to your bookings and client communications
    • Send and reply to emails directly from the Esattas platform
    • Sync email threads to keep booking-related conversations in one place

    Email content is stored securely and encrypted in transit. When you disconnect your Google email account, synced email data is deleted. We do not use email content for AI training, advertising, or any purpose beyond providing the email management features you requested.

    3.1 Google API Services — Limited Use Disclosure

    Esattas's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

    • We do not use Google user data for serving advertisements, including retargeting, personalised, or interest-based advertising.
    • We do not sell Google user data to third parties.
    • We do not use Google user data for purposes unrelated to providing or improving the Esattas scheduling service.
    • We do not allow humans to read Google user data, except with your explicit consent, for security purposes, to comply with applicable law, or when data is aggregated and anonymised for internal operations.
    • Google data is transferred to third parties only as necessary to provide or improve the Service, to comply with applicable laws, or as part of a merger/acquisition with equivalent privacy protections.

    3.2 Data Storage & Retention

    • Google OAuth tokens are stored securely and encrypted at rest. We never store your Google password.
    • Calendar event data is cached temporarily to provide real-time availability checking and is refreshed on each sync.
    • When you disconnect your Google account from Esattas, we immediately revoke the OAuth token and stop accessing your Google data. Cached calendar data is deleted within 24 hours.

    3.3 Revoking Access

    You can disconnect your Google account at any time from the Integrations page in your Esattas dashboard. You can also revoke Esattas's access directly from your Google Account permissions page.

    4. How We Use Your Information

    • To provide, operate, and maintain the Service, including scheduling, booking, sales pipeline management, and email functionality.
    • To process bookings and send confirmation emails, reminders, and notifications to you and your meeting guests.
    • To power AI features including meeting briefs, lead qualification, deal health scoring, follow-up suggestions, and transcript analysis.
    • To personalize your experience and provide relevant recommendations.
    • To send administrative communications including service updates, security alerts, and support messages.
    • To analyze usage trends, monitor platform performance, and improve our Service.
    • To detect, prevent, and address fraud, security issues, and technical problems.
    • To comply with legal obligations and enforce our Terms of Service.

    5. How We Share Your Information

    We do not sell your personal information. We may share your information in the following circumstances:

    • Within Your Organization: Other members of your organization may access shared data such as bookings, deals, contacts, and team schedules as determined by your organization's admin settings.
    • Meeting Guests: When a booking is made, relevant details (host name, meeting time, location) are shared with the guest via email.
    • Service Providers: We use trusted third-party services for email delivery (SendGrid), AI processing (OpenAI), video conferencing (Zoom, Google Meet, Microsoft Teams), and cloud hosting. These providers are bound by confidentiality obligations.
    • Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
    • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

    6. Data Security

    We implement industry-standard security measures to protect your information, including:

    • Encryption of data in transit using TLS/SSL.
    • Hashed passwords using bcrypt — we never store passwords in plain text.
    • OAuth 2.0 for third-party integrations — we never store your Google or Microsoft passwords.
    • API authentication via Sanctum tokens with automatic expiration.
    • Role-based access controls within organizations.

    While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

    7. Data Retention

    We retain your information for as long as your account is active or as needed to provide the Service. When an account or organization is deleted, we remove associated personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., billing records, fraud prevention).

    8. Your Rights

    Depending on your jurisdiction, you may have the following rights:

    • Access: Request a copy of the personal data we hold about you.
    • Correction: Request correction of inaccurate or incomplete data.
    • Deletion: Request deletion of your personal data, subject to legal obligations.
    • Portability: Request a machine-readable copy of your data.
    • Objection: Object to processing of your data for certain purposes.
    • Withdraw Consent: Revoke consent for data processing where consent is the legal basis.

    To exercise any of these rights, please contact us at privacy@esattas.com.

    9. Cookies

    We use essential cookies to maintain your session and authentication state. We may also use analytics cookies to understand how the Service is used. You can control cookie preferences through your browser settings, though disabling essential cookies may affect functionality.

    10. Children's Privacy

    Esattas is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 16, we will take steps to delete that information promptly.

    11. International Data Transfers

    Your information may be transferred to and processed in countries other than your country of residence. We ensure that appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

    12. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

    13. Contact Us

    If you have questions about this Privacy Policy, our data practices, or how we use Google API data, please contact us: