Privacy Policy

1. Who this policy covers

Staff HQ is operated by Borrego Business Systems. This policy applies when you visit staffhqos.com, request a private beta, sign in to the Staff HQ hosted application, or intentionally connect a supported service. A business customer may also control a Staff HQ workspace for its team. In that case, the customer is responsible for deciding who may access the workspace and its data.

2. Information we collect

Information you provide

We collect information you submit, such as your name, email address, organization, beta request, account preferences, chats, projects, saved Knowledge, feedback, and files you intentionally add when a supported upload feature is active.

Account and workspace information

We collect the identifiers and authorization records needed to keep users, organizations, rooms, agents, conversations, and connected accounts separated. We also process security, usage, error, and audit metadata needed to operate and protect the service.

Website information

Our infrastructure may process ordinary request information such as IP address, browser type, device type, referring page, timestamps, and security signals. We use it to deliver, troubleshoot, and secure the site. We do not use this information for behavioral advertising.

3. Google user data

Google connections are optional and account-specific. Staff HQ requests only the scopes needed for the feature you choose. The first Gmail integration is designed to use standard OpenID only to verify the signed Google account identity and the read-only Gmail scope for mailbox access. It does not request the OpenID email or profile scopes.

An optional later action feature may request the Gmail compose scope to create, update, delete, and send only Staff HQ-governed drafts, and the owned Calendar events scope to view and change events on calendars the connected account owns. Staff HQ will request that incremental authority only when you choose to upgrade an exact connected account. Broader Gmail modification and broad Calendar scopes are not part of this first action contract.

Data accessed

If you connect Gmail and explicitly ask Staff HQ to review mail, we may access the connected Google account identifier, mailbox labels, message and thread identifiers, sender and recipient headers, subject lines, timestamps, snippets, message bodies, and bounded attachment declarations needed to identify attachments. A bounded full-message response from Gmail may transiently carry inline MIME attachment data through Vercel request memory. Staff HQ does not decode that data as message content, return it to the browser, retain it, or send it to an AI model. Staff HQ does not call Gmail's attachment-download endpoint. A later attachment feature requires separate disclosure and approval.

How Google data is used

We use Google data only to provide features you request. The current owner-acceptance path is limited to on-demand search and review. Summaries, review queues, reply proposals, and spam feedback remain unavailable until separately reviewed and activated. Staff HQ does not send Gmail messages, create Gmail drafts, delete messages, move messages, change labels, or create filters through the initial read-only integration.

If the optional action feature is later activated, Staff HQ may create and update a reply draft only after showing the exact connected account, recipients, subject, source thread, and body. Deleting or sending is a separate confirmed human action bound to the latest governed Gmail draft. Staff HQ cannot delete the source message or thread. Calendar actions similarly show the exact account, owned calendar, event, time zone, attendees, guest-notification policy, and change before a confirmed human Create, Update, Move, or Cancel action. A schedule may not send email or change a Calendar event under this first action contract.

While an optional action is being approved or completed, Staff HQ keeps the exact bounded action payload under forced database access controls so it can prove that the approved request and provider request match. An active governed Gmail draft keeps its recipients, subject, body, source message and thread, connected-account lineage, provider identifiers, and current revision. An active governed Calendar event keeps its exact event fields, calendar and account lineage, provider identifiers, and revision. These records restore the reviewed controls after a reload or uncertain response. The first owner release allows no more than 25 active governed drafts and 25 active governed Calendar events.

We do not sell Google user data, use it for advertising, or use it to build advertising profiles. We do not use Google user data to create, train, or improve any AI or machine-learning model, including a generalized, shared, cross-user, cross-tenant, or personalized model. The initial Gmail feature will use selected data only to complete the immediate feature requested by the requesting user.

Staff HQ personnel do not read Google user data unless you provide documented, affirmative permission for us to view specific messages, files, or other data for support; access is necessary to investigate a security incident; access is required by law; or the information has been aggregated and anonymized for internal operations.

4. AI processing

If the reply-proposal feature is later activated, choosing Prepare reply will send the bounded selected message excerpt and your request to the configured OpenAI model. Staff HQ will save that excerpt, request, and proposed reply in the governed Communications Assistant conversation so you can review and edit it. Requests will disable API application storage when the API supports that control. OpenAI may retain content in abuse-monitoring logs for up to 30 days unless an approved Zero Data Retention control applies. Staff HQ will verify and document the enabled provider controls before activating this feature.

AI output can be incomplete or wrong. Staff HQ labels external content as untrusted, keeps consequential actions behind approval, and requires you to review proposed email replies. A proposed reply is Staff HQ content. It is not sent to Gmail automatically, and the AI provider does not receive Google credentials or authority to send it.

5. How we use information

• Provide, personalize, and maintain Staff HQ.
• Authenticate users and enforce organization and role boundaries.
• Complete requests you intentionally make.
• Measure reliability, manage limits, and prevent abuse.
• Investigate errors, protect accounts, and maintain audit records.
• Communicate about beta access, security, support, and policy changes.

6. Sharing and subprocessors

We share information only as needed to provide the service, follow your instructions, protect Staff HQ, or comply with law. Service providers may include our hosting, authentication, database, email, and AI processing providers. They receive only the information needed for their assigned function and are subject to contractual or technical restrictions.

We may disclose information if required by law or when reasonably necessary to protect users, the public, Staff HQ, or our legal rights. If Staff HQ is involved in a business transaction, information may be transferred subject to this policy and applicable law.

Current service providers

• Vercel provides website and application hosting and request transport.
• Clerk provides Staff HQ authentication and organization boundaries.
• Supabase provides encrypted database and workspace infrastructure.
• OpenAI provides AI model processing and voice transcription for explicit user requests.

Google data will be sent only to the providers needed for the feature the user requests. Staff HQ reviewed this list and the providers' controls before the bounded owner connection and mailbox-review tests. It will reverify them before AI processing or customer access and will update this policy when a material provider changes.

7. Retention and deletion

We retain account and workspace information only for as long as needed to provide the service, meet documented security and audit needs, resolve disputes, or comply with law. Retention periods vary by data type and are bounded before a feature is activated.

During the bounded owner mailbox-review test, content fetched for the current search or review operation will stay in transient Vercel request memory and will not be sent to OpenAI or stored by Staff HQ as a copy of your mailbox.

If the optional action feature is activated, an active or settling permit keeps the exact bounded action payload behind forced access controls. The permit expires after five minutes. Staff HQ clears the payload when the action completes or enters owner review, and bounded hourly cleanup clears abandoned expired payloads while turning stale consumed outcomes into durable owner review. Payload-cleared terminal permit evidence retains bounded provider receipt metadata and becomes eligible for bounded deletion one day after permit expiry. An uncertain outcome remains blocked behind a durable owner-review notice until you acknowledge the exact revision.

Active governed Gmail drafts and Calendar events retain the exact working fields and provider revision described above while their review controls remain available. Sending or deleting a draft, canceling an event, or disconnecting the account clears the sensitive working payload. The remaining payload-cleared terminal lineage retains bounded provider receipt metadata and becomes eligible for bounded deletion after 30 days.

If you choose a later Prepare reply action, Staff HQ saves the bounded selected message excerpt, your request, and the proposed reply in the governed Communications Assistant conversation until Staff HQ fulfills a verified deletion request or another documented workspace-retention action removes it. OpenAI may retain API abuse-monitoring logs for up to 30 days as described above. Other intentionally saved summaries, proposed replies, or artifacts likewise remain until Staff HQ fulfills a verified deletion request or another documented workspace-retention action removes them.

Connection metadata and encrypted authorization credentials will be retained while a connection is active. Disconnecting or revoking a Google connection will stop new access immediately. Staff HQ will make the active authorization credential eligible for bounded deletion after 24 hours, with cleanup potentially completing later, and an encrypted backup copy, if present, will age out within 35 days. These limits govern the current non-production owner connections and must be reverified before customer access is activated.

If Google connection controls are available to you, you may disconnect it from Staff HQ or revoke it from your Google Account at any time. You may also request deletion of your Staff HQ account and associated personal information through the contact method below. We will verify the request and explain any information we must retain for legal or security reasons.

8. Security

Staff HQ uses layered safeguards such as encrypted transport, encrypted storage for sensitive credentials, tenant isolation, least-privilege access, server-held credentials, short-lived access leases, audit records, and approval gates. No system can guarantee absolute security. Please contact us promptly if you believe your account or information may be at risk.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete personal information. You can also withdraw consent where consent is the basis for processing. We will not discriminate against you for making a privacy request.

Organization administrators may control workspace access and records. If your account is managed by an organization, direct workspace-data requests to that organization first. You may still contact Staff HQ for help.

10. Children

Staff HQ is a business productivity service and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information.

11. Changes to this policy

We may update this policy as Staff HQ changes. We will post the new effective date here and provide additional notice when a change is material. A changed Google-data use will require a new review of the applicable consent, scope, and policy requirements before activation.

12. Contact us

Borrego Business Systems operates Staff HQ and is the contact for privacy questions and requests. Use the Staff HQ contact form, include the email address associated with your account, and do not include passwords, access tokens, or other credentials.