Google-brugerdata

This page explains how Herodesk ApS (“Herodesk”, “we”) handles data we receive from Google when you connect a Gmail or Google Workspace inbox to Herodesk. It supplements our Privacy Policy. If the two conflict, this page applies to Google user data.

What Google user data we access

When you connect an inbox, you approve access on Google’s consent screen. Herodesk requests these Google permissions (scopes):

• openid and email: to identify the Google account you signed in with and its email address.
• https://mail.google.com/: to read and send email in the connected inbox over IMAP and SMTP, and to read the inbox’s verified “Send mail as” addresses.

With these permissions we access:

• Email messages in the inbox: sender, recipients, subject, date and other headers, the message body and attachments. We import new mail that arrives after you connect, and older mail only if you ask us to import it.
• Your replies in the Sent folder: we check the Sent folder for replies written outside Herodesk to conversations that are already in Herodesk, so those conversations stay complete. Other sent mail is not imported.
• Account details: the email address of the connected Google account and its verified “Send mail as” addresses, so we can identify the inbox and send replies from the right address.
• OAuth tokens: the access and refresh tokens Google issues, so the connection keeps working without you signing in again.

We do not access your Google Contacts, Drive, Calendar or any other Google service.

Aggregated data: Herodesk shows you statistics about your own support work, such as the number of tickets, response times and resolution times. These statistics do not contain email content.

How we use Google user data

We use Google user data only to provide and improve the user-facing Herodesk features you use:

• Importing incoming emails into Herodesk as tickets.
• Marking imported messages as read in Gmail, so the same message is not imported twice.
• Sending replies and new messages from your connected address.
• AI-assisted features for your own account, such as drafting replies, translating and categorising tickets, detecting spam, and AI agents that answer on your behalf when you turn them on.
• Security, preventing abuse, and complying with the law.

We do not:

• Use Google user data for advertising, including personalised, retargeted or interest-based ads.
• Sell Google user data.
• Use Google user data to market our own or other products.
• Use Google user data to determine credit-worthiness or for lending purposes.

AI and machine learning: our AI features run on Herodesk’s own servers in the EU. OpenAI Ireland Ltd is used only as a fallback when our own AI servers are unavailable. You can ask us to opt your account out of OpenAI by emailing support@herodesk.com. Data received from Google Workspace APIs is not used to develop, improve, or train non-personalized AI and/or ML models.

Human access: Herodesk employees do not read your Google user data unless (a) you give us explicit permission for specific messages, for example in a support request, (b) it is necessary for security purposes, such as investigating abuse or a security incident, or (c) it is required by law. Users in your own Herodesk account can see the data as part of using the service.

How we share Google user data

We do not sell Google user data or share it with advertising or marketing platforms, including HubSpot.

We share Google user data only:

• With sub-processors that host and run the service on our behalf, under data processing agreements:
  • Hetzner Online GmbH (Germany): hosting and data centre services.
  • ScanNet A/S (Denmark): hosting, data centre services and Herodesk’s own AI servers.
  • OpenAI Ireland Ltd (Ireland): only as a fallback when our own AI servers are unavailable, and not if your account is opted out of OpenAI.
• When required by law or a court order, or to protect the rights and safety of Herodesk, our users or others.
• As part of a merger, acquisition or sale of assets, where the receiving party is bound by the same commitments as this page.

How we protect Google user data

• Google user data is stored on servers in the EU.
• Data is encrypted in transit: we connect to Gmail over TLS, and Herodesk is only served over HTTPS.
• OAuth refresh tokens are stored encrypted, and short-lived access tokens are only cached in encrypted form.
• Sensitive data stored in our databases is encrypted, and we run regular backups, as described in our Privacy Policy.

Retention and deletion

• While an inbox is connected and your Herodesk account is active, we keep imported emails and tickets so you can work with them in Herodesk.
• You can disconnect a Gmail inbox at any time by deleting the email channel in Herodesk’s channel settings, or revoke Herodesk’s access at myaccount.google.com/permissions. When you delete the channel, we stop syncing, delete the stored OAuth tokens and revoke our access at Google. If another inbox in your account uses the same Google account, access stays in place for that inbox.
• Emails already imported as tickets remain in your Herodesk account until you delete them or your account is closed.
• If your account is cancelled, it is suspended at the end of the billing period, and all data, including Google user data, is irreversibly deleted 30 days later, as described in our Terms of Service.
• You can ask us to delete your Google user data at any time by emailing support@herodesk.com. We keep data only where the law requires it.

Limited Use

Herodesk’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Contact

Questions about how we handle Google user data: support@herodesk.com

Herodesk ApS, CVR DK-44196972, Aarhus, Denmark