Skip to content

Privacy Policy

Effective date: October 15, 2026

1. Introduction

This Privacy Policy explains how Digital Vision Code LLC (“we”, “us”), handles personal data in connection with amabledata. You can reach us at any time at hi@amabledata.com.

It covers:

  • the amabledata.com website;
  • the customer portal at app.amabledata.com;
  • the amabledata software and the central services we operate for it (installation, updates, monitoring, integrations and support).

2. The architecture, plainly stated

amabledata is different from most CRMs: each customer’s installation runs in the customer’s own Cloudflare account. The CRM data our customers manage with amabledata (their contacts, companies, orders, emails and analytics) is stored there, not on our servers.

For that data, the customer is the data controller and we provide the software. If you are a contact of one of our customers and want to exercise your rights over that data, please contact that customer directly; we will help them where needed.

From each installation we receive only minimal operational telemetry: the software version, health status and aggregate email counts. This telemetry never contains contact data.

We access a customer’s installation only through assisted access: time-limited access that the customer explicitly grants from their dashboard, can revoke at any time, and that is fully recorded in the audit log.

3. Data we process as controller

We are the data controller for the following data:

  • Portal account data: name, email address, login credentials (stored as salted hashes), two-factor authentication data and account activity logs. We use it to provide your account and keep it secure (performance of a contract, Art. 6(1)(b) GDPR, and our legitimate interest in security, Art. 6(1)(f) GDPR).
  • Billing data: subscription, invoices and payment status, processed through Stripe. We never receive or store full card numbers. We use it to bill the service and meet tax obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
  • Support tickets: the messages and attachments you send us, used only to answer your request (Art. 6(1)(b) GDPR).
  • Website visits: amabledata.com sets no tracking cookies and runs no analytics or advertising scripts, which is why there is no cookie banner. Our hosting provider processes technical data such as IP address and browser type only to deliver the pages and protect them from abuse (legitimate interest, Art. 6(1)(f) GDPR).

4. Google user data

amabledata offers optional integrations with Google services. They are activated only when a user connects their Google account and approves the requested permissions on Google’s consent screen. This section describes, for each permission (scope), exactly what is accessed, why, what is stored and what is not.

Google Calendar — read availability

Scope: https://www.googleapis.com/auth/calendar.readonly

  • What we access: the start and end times of existing events on the calendars the user selects.
  • Why: only to compute availability, so booking calendars offer visitors the times when the user is actually free.
  • What we store: busy/free time intervals only.
  • What we never store: event titles, descriptions, locations and attendees.

Google Calendar — create booked appointments

Scope: https://www.googleapis.com/auth/calendar.events

  • What we do: when a visitor books an appointment, we create the event on the calendar the user selected, and we update or delete that event if the appointment is rescheduled or cancelled.
  • What we store: the identifier of the events we created, so we can update or delete them later.
  • What we never do: modify or delete events that amabledata did not create.

Account email address

Scope: https://www.googleapis.com/auth/userinfo.email

  • Why: the email address of the connected Google account is shown in the dashboard, so the user knows which account is connected.

Google Search Console

Scope: https://www.googleapis.com/auth/webmasters.readonly

  • What we access: search analytics (queries, pages, clicks and impressions) for the sites the user selects.
  • Why: only to display organic search reports inside the user’s own analytics dashboard.
  • What we never do: change Search Console settings, properties or users.

Google Sheets

Scope: https://www.googleapis.com/auth/spreadsheets

  • What we do: when the user connects a form to a spreadsheet, we append each new form submission as a row to that spreadsheet.
  • What we never do: read, change or delete other spreadsheets or other content.

Storage and protection

OAuth tokens are encrypted at rest inside the customer’s own installation, in their Cloudflare account. They are never exposed to the browser and never shared with third parties. Data obtained from Google is used only to provide the user-facing features described above.

Limited Use

amabledata's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is never sold, never used for advertising, and never used to train artificial intelligence or machine-learning models. No human reads it, unless the user gives explicit consent for a specific support request, or it is necessary for security purposes or to comply with the law.

Revocation and deletion

You can disconnect a Google integration at any time from the amabledata dashboard, or from your Google Account underSecurity → Third-party apps with account access(myaccount.google.com/permissions). When an integration is disconnected, its tokens are destroyed and the data imported through it, such as availability intervals, is deleted.

5. Meta integration

With the user’s explicit authorization, amabledata reads ad campaign spend from the connected Meta ad accounts to compute return on ad spend in revenue attribution reports. The authorization can be revoked at any time from the dashboard or from Meta’s settings; the tokens are then destroyed.

6. Email delivery data

On behalf of our customers, we process email delivery events (bounces, spam complaints and unsubscribes) to stop sending to addresses that cannot or do not want to receive email. This protects recipients and the deliverability of every sender. We do this as a processor for our customers.

7. Security

  • All traffic is encrypted with TLS; data and secrets are encrypted at rest.
  • Two-factor authentication is mandatory for every user.
  • Role-based access control limits what each user can see and change.
  • Sensitive actions, including any assisted access by our team, are recorded in an audit log.

In the event of a personal data breach, we will notify the competent supervisory authority and, where required, the affected people, in accordance with Articles 33 and 34 GDPR.

8. Retention

  • Account, billing and support data: for the duration of the contract, and afterwards for as long as required by law (for example, tax rules).
  • Google and Meta tokens: deleted as soon as the integration is disconnected.
  • On termination, the installation and its data remain in the customer’s Cloudflare account, under the customer’s control. We do not keep a copy.

9. Sharing and processors

We do not sell personal data. We share it only with the processors that help us run the service:

  • Cloudflare: infrastructure and hosting;
  • Stripe: subscription payments;
  • Our managed email delivery infrastructure: transactional notifications such as account and billing emails.

We may also disclose data when required by law or by a binding order of a competent authority.

10. International transfers

Some processors may process data outside the European Economic Area. When that happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision, where applicable.

11. Your rights

Under the GDPR you have the right to:

  • access your personal data and receive a copy;
  • rectify inaccurate data;
  • erase your data;
  • restrict processing;
  • data portability;
  • object to processing based on our legitimate interests.

To exercise them, write to hi@amabledata.com. You also have the right to lodge a complaint with a supervisory authority; in Italy, the Garante per la protezione dei dati personali.

12. Children

amabledata is a business service and is not directed at children under 16. We do not knowingly collect their data.

13. Changes and contact

We may update this policy. We will notify registered users of material changes by email or in the portal before they take effect. This version is effective from October 15, 2026. Questions: hi@amabledata.com.