1. Overview & Principle of Least Privilege
Autometa CRM offers optional integrations with Google Workspace services (including Gmail, Google Calendar, Google Drive, and Google Analytics) so that your customer communication history, scheduled sales calls, and files live seamlessly alongside your CRM records.
We strictly adhere to the Principle of Least Privilege: we only request the narrowest OAuth scopes necessary to make each specific feature function. Connecting Gmail does not grant access to Google Drive or Calendar; each integration is authorized independently on an opt-in basis.
2. Requested OAuth Scopes & Data Storage
Below is the complete list of Google OAuth scopes requested by Autometa CRM and the exact data stored:
Gmail Sync
Scopes: https://www.googleapis.com/auth/gmail.readonly, https://www.googleapis.com/auth/gmail.send, https://www.googleapis.com/auth/gmail.modify
Purpose: Allows Autometa CRM to sync customer email threads into your CRM contact timelines, track message opens, and allow your sales reps to compose and reply to emails directly from customer records.
Storage: Sender, recipients, subject, email body (plain text/HTML), timestamp, and message ID references. Attachment files are fetched on-demand directly from Gmail and not stored persistently.
Google Calendar Sync
Scopes: https://www.googleapis.com/auth/calendar.events, https://www.googleapis.com/auth/calendar.readonly
Purpose: Enables two-way synchronization between Google Calendar and Autometa CRM meetings, scheduling demo calls, and logging meeting attendance against deal records.
Storage: Event title, start/end timestamps, meeting description, location URL, and attendee email addresses.
Google Drive Attachments
Scopes: https://www.googleapis.com/auth/drive.metadata.readonly
Purpose: Allows team members to link Google Drive documents, presentations, and spreadsheets to CRM leads and deal files without requiring file re-uploads.
Storage: File metadata only: file name, MIME type, file size, thumbnail URL, and Google view link. Autometa does NOT copy or store the raw file contents of your Drive files.
Google Analytics Reporting
Scopes: https://www.googleapis.com/auth/analytics.readonly
Purpose: Imports aggregated website traffic and campaign conversion metrics into Autometa CRM marketing attribution dashboards.
Storage: Aggregated analytics figures and campaign dimension aggregates.
3. Google Limited Use Disclosure
Specifically:
- We use Google user data solely to provide and improve the user-facing CRM features described on this page.
- We do not sell Google user data to any third party, advertising network, or data broker.
- We do not use Google user data for advertising, ad targeting, or behavioral profiling.
- No Model Training: We do NOT use Google user data to develop, train, or fine-tune generalized artificial intelligence or machine-learning models. Where AI features summarize an email thread, the text is processed in-memory under enterprise zero-data-retention terms solely to generate the output for your immediate review.
4. Human Access Policy
Autometa personnel do not read or inspect your synced Google emails, calendar events, or drive metadata. The only narrow exceptions are:
- You provide explicit, documented consent to investigate a specific customer support issue (e.g., a message sync error).
- It is strictly necessary for security purposes (such as investigating an active abuse or security incident).
- We are compelled to do so by a valid, binding legal court order.
5. How to Revoke Access & Data Deletion
You can revoke Autometa’s access to your Google account at any time through either of two methods:
- Within Autometa CRM: Go to Settings → Integrations → Google and click Disconnect. This immediately revokes the stored OAuth token and schedules synced data for deletion.
- From your Google Account: Visit Google Account Permissions, select Autometa CRM, and click Remove Access.
6. Token Security & Application Encryption
All Google OAuth access and refresh tokens are encrypted at rest using AES-256 with tenant-specific encryption keys. Tokens are never exposed to the client browser and are decrypted only in isolated server-side processes during authenticated background sync jobs.
For more on our security architecture, visit our Trust & Security Center .