THE AGREEMENTS Version 2026-10-14
Privacy policy
This policy explains the personal data used to operate GoodCompany and the choices available to you. Leveloper Informatikai és Szolgáltató Korlátolt Felelősségű Társaság (Leveloper Kft), registered office: Gárdony, Berzsenyi u. 73, 2483 . Hungarian tax number: 29164341-2-07. Contact: info@leveloper.io.
Who this is with Leveloper Informatikai és Szolgáltató Korlátolt Felelősségű Társaság
Gárdony, Berzsenyi u. 73, 2483
Tax number: 29164341-2-07 · info@leveloper.io
On this page
Who is responsible
Leveloper is the controller for account administration, service security, its own billing and optional product analytics. For personal data a customer business puts into its workspace, that business normally determines the purposes and acts as controller; Leveloper acts as processor under the DPA. Connected providers may separately act as controllers under their own terms. If your employer, supplier or another business uses GoodCompany to process your data, contact that business about its purposes and retention; we assist it with requests.
Data, sources and purposes
| Data and source | Use | Basis for our own processing / customer instruction |
|---|---|---|
| Account details you provide: name, email, password hash, avatar; sign-in provider identifier and profile where used | Register, authenticate, manage membership and send service messages | Contract with the account holder; legitimate interests in administering business customer accounts |
| Session identifiers, IP address, browser/user agent, login attempts and security/audit events | Session management, abuse prevention, support and accountability | Legitimate interests in protecting the service and users; legal obligations where applicable |
| Company contacts, client/project/task/milestone details, comments, uploaded files, document text, stored credentials and other workspace records | Store, search, share and manage your business information | Customer instructions under the DPA; customer determines its lawful basis |
| Connected email: addresses, headers, subjects, bodies, folders/labels, attachments and sending status | Mailbox history and ongoing sync, reading/replying/sending, search, classification and linked business records | Customer instructions and the connecting user's permissions |
| Calendar accounts, calendars, events, descriptions, dates, locations and attendees | Schedule display, sync, event changes and, when enabled, calendar management | Customer instructions and the connecting user's permissions |
| Bank imports/feeds, transactions, counterparties, balances, invoice and receipt details | Financial records, reconciliation and bookkeeping exports; no payment initiation through bank feeds | Customer instructions; our own subscription invoices also meet billing/legal obligations |
| Sidekick messages, uploaded images, retrieved context, outputs, tool activity and search embeddings | Answers, search, extraction and requested or configured assistance | Customer instructions; AI can run automatically during import and background work |
| Subscription contact/address/tax details, invoice records, payment status and processor IDs | Collect fees, maintain subscriptions and fulfil accounting duties | Contract and applicable accounting/tax obligations |
| Optional analytics events, pseudonymous account/company IDs, plan and technical browser/device information | Understand signup and subscription usage | Consent, only when analytics is configured and you allow it |
Information may come from you, other authorised workspace members, connected providers, uploaded files or optional prospect-enrichment services. Required account fields are needed to supply the account; optional integrations can be skipped. Support messages and technical error reports may also contain information you provide or details of an error. The website contact form sends your name, email, optional company, selected enquiry topic and message through Resend to our contact inbox so we can respond. This includes career introductions. The form does not create a workspace record or subscribe you to marketing. Do not include passwords or confidential message contents in support requests unless needed and agreed.
Google account, Gmail, Calendar and Drive data
Google sign-in requests basic identity information (OpenID, email and profile). Signing in alone does not connect Gmail, Calendar or Drive.
A separate Gmail connection imports message history and continues background syncing. We access message content and attachments, senders and recipients, labels and mailbox identity, and we store copies to provide the inbox, sending and replying, read-state and trash actions, search, and the AI features below. Gmail access uses gmail.modify. We do not request unrestricted permanent-deletion access (mail.google.com).
A separate Google Calendar connection reads your calendar list and event details, and can create, edit and delete events through the app. We request calendar.calendarlist.readonly and calendar.events. Stored data includes event titles, descriptions, attendees, locations and times. Changes made in GoodCompany can change the connected calendar.
When calendar management is enabled, we also request calendar.calendars. After you grant this permission, you can create additional Google calendars and change the name, description and time zone of calendars your Google account owns. You can also delete a secondary calendar you own after confirming the action. Deleting a calendar removes that calendar and its events from Google Calendar; deleting an individual event removes only that event. GoodCompany does not allow deletion of your primary Google calendar. These actions are separate from stopping synchronization or disconnecting the account, which do not delete the original calendars or events at Google.
A Google Drive connection requests https://www.googleapis.com/auth/drive. That permission can see and change Drive files the Google account can open, and Google records it for the whole account. GoodCompany only works inside the one Drive folder you pick (syncing all of My Drive is not allowed). It copies the files in that folder, including subfolders, into Documents and keeps both sides in step in the background. GoodCompany changes files in your Google Drive only to reflect changes you make to synced documents in GoodCompany: it uploads new or edited documents, renames or moves files and folders you renamed or moved, and moves files to the Drive trash when you delete them. It never permanently deletes Drive files, and never renames, moves or trashes them on its own. Google Docs, Sheets and Slides are stored here as Office files (DOCX, XLSX, PPTX) and drawings as PDF; those originals stay in Google Drive and are edited there.
OAuth tokens for these connections are encrypted at rest (AES-256-GCM) so syncing can continue while you are away. Message, event and file copies sit in the company workspace and are served only through access-controlled routes. This is not end-to-end encryption: the service reads the content to provide the features above.
Relevant Google content, and information derived from it, can be sent through OpenRouter to the AI model providers named on the provider page: currently OpenAI, Meta and Google models (and Anthropic models when you choose one in Sidekick). Every request is restricted to zero-data-retention endpoints that may not store the content or use it for training. For mail, that covers classification, extraction, task and event detection, and search. For calendars, relevant event details can be used as Sidekick context. For Drive files, readable text is extracted and indexed; sparse scans can be read from page images; audio and video can be sent for a searchable analysis. Authorised workspace members may see shared mail, calendars, documents and derived company records according to their access. Connecting an account is not permission to disclose its data for unrelated purposes. This processing is described in the app before you continue to Google, and your agreement is recorded with the date and the version of that notice.
GoodCompany's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google API Services User Data Policy and Limited Use requirements
We use Google user data only to provide or improve user-facing features that are prominent in GoodCompany's interface: the inbox, calendar, Documents, search, Sidekick and the records created from your mail. Data from Google Workspace APIs is also handled under the Google Workspace API User Data and Developer Policy.
We do not sell Google user data or share it with data brokers or information resellers. We do not use it for advertising, including targeted, personalised, retargeted or interest-based ads. We do not use it to assess creditworthiness or for lending. We store copies only so those features can run. We do not build a separate database of Google user data to sell, advertise or reuse outside the service. We do not transfer Google user data to third parties for any of those purposes. Data received from Gmail, Google Calendar or Google Drive, and information derived from it, is never sent to Apollo or any other prospect-enrichment provider.
Google Workspace APIs are not used to develop, improve or train non-personalized AI or machine-learning models. That limit also applies to derived information and to transfers. The AI processing section explains the routing we request from inference providers, and what that routing does not cover. Optional product analytics does not receive Google message, event or file content.
Google Workspace API User Data and Developer Policy
Our staff may access specific Google content with your documented affirmative permission, or where necessary for security investigation or legal compliance. We do not permit routine human review of mailbox content for general product improvement. Access by providers, contractors and successors must follow the same restrictions. A transfer in a business sale involving this data requires the user's prior explicit consent where Google's policy requires it.
AI processing and human control
AI receives the information needed for the feature: for example email text and attachments, document pages, transaction descriptions, calendar context, chat history and images you attach to Sidekick. Background analysis may run without a separate click for each record. Relevant text is also converted into search embeddings and stored with workspace search data. A private source can produce company-level records, so review access and extracted results. Prompts and replies form part of saved chat history; the separate AI usage ledger records model, provider, usage, cost, timing, references and errors rather than a dedicated full prompt/response log.
Inference requests go through OpenRouter to OpenAI, Meta and Google models (and Anthropic models when you choose one in Sidekick), and require non-collection and zero-retention provider routing. The provider page lists which model is used for which feature. A model can be unavailable if no eligible endpoint exists. Provider request metadata can still be retained. These technical settings do not themselves establish a data processing agreement or a lawful international transfer. Web search stays disabled until its separate recipients and privacy safeguards are approved. If Sidekick uses approved web search, its generated query can be sent to a search service through OpenRouter; search tools have separate data policies and are not covered by inference zero-retention routing. Avoid including confidential or personal information in web-search requests.
We do not use workspace content, including data from Google Workspace APIs, to develop, improve or train non-personalized or general-purpose AI models. AI results can be inaccurate. Review the source and proposed action, especially before sending a message, relying on a financial figure or changing a schedule. The app is not designed to make legally significant decisions about people, such as employment or credit decisions, without human involvement.
Storage, recipients and international processing
The core application, database, uploaded files and backups are hosted in Hungary on hardware owned and operated by Leveloper. Leveloper operates this infrastructure itself, rather than appointing an external hosting or file-storage sub-processor. Backups are made nightly, encrypted and deleted after 7 days. AI, email delivery, payment and the other services listed on the provider page may process data outside Hungary.
Workspace records are stored in our application database. Uploaded files, email attachments, chat images, avatars and exports use private file storage, served through access-controlled routes. This is not end-to-end encryption: the service must read relevant content to deliver its features. Integration credentials are encrypted separately; account passwords are hashed. Recovery copies are separate from live storage.
The provider page distinguishes operational service providers from services you connect. Recipients can include hosting, AI inference and search services, service-email delivery, payment/invoicing providers and, if enabled, error reporting. Optional PostHog analytics only starts with your consent. Processing outside the EEA requires an applicable transfer mechanism and assessment, such as a relevant adequacy decision or signed standard contractual clauses and necessary supplementary measures. Contact us for the applicable safeguards and copies where available.
Retention and deletion
| Record | Current application behaviour |
|---|---|
| Account | Deletion can be scheduled in Settings → Privacy, with a 30-day cancellation period. The daily purge processes due accounts. Sole workspace owners must first transfer ownership or delete the company. Other members' company records are not erased by deleting one account. |
| Workspace records and files | Remain for the workspace until deleted. Company deletion removes live company database records and requests deletion of company files. Cleanup failures require operational follow-up; recovery copies are not erased by the live delete operation. |
| Imported mail | Disconnecting removes the connection and its stored credentials and, for Google, revokes GoodCompany's Google access when no other connection uses the same Google account. When you disconnect a mailbox you can choose to also delete the emails imported from it (off by default): emails that came only from that mailbox, their attachments and their search data are then deleted in the background. Emails that also arrived in another connected mailbox, and tasks, events, documents and chat copies already created from them, are kept. If you do not choose deletion, imported emails remain. When an account is deleted, its private mailboxes and the emails imported only through them are deleted. Mailboxes that the user shared with the company are company resources: they stay connected and keep syncing under the company until a company owner disconnects them. Optional mail-body retention in Settings → Privacy clears body text/HTML after the chosen period (minimum 30 days). Headers, attachments, extracted tasks/events/documents, search data and chat copies are separate and are not all removed by this setting. |
| Calendar connection | Disconnecting stops synchronization and removes stored credentials. Imported calendars and events remain as a read-only archive unless you choose to remove imported copies. Unsent locally created events move to your local calendar. For Google, access is revoked when no other connection uses the same Google account. It does not remove originals at the provider or independently created tasks, messages or other derived records. Calendars that a deleted user shared with the company stay connected under the company until a company owner disconnects them. |
| Google Drive connection | Disconnecting removes the connection and stored tokens and revokes GoodCompany's Drive access at Google when no Gmail or Google Calendar connection uses the same Google account (Google keeps one grant per account for GoodCompany). The Drive access is also revoked at Google, on the same condition, when the account that connected it is deleted, when that person is removed from the company and when the company is deleted. Files already copied into Documents remain until deleted there; owners and admins can delete all copied files and their search data at once with Clear library in Documents, which also stops syncing until a folder is chosen again. Disconnecting does not delete files in Google Drive. If a synced file is trashed in Drive and the local copy has not changed since the last sync, GoodCompany deletes that local copy and its search data. |
| AI usage ledger | Scheduled cleanup after 180 days by default. Saved chat history and search embeddings are separate workspace data, not subject to this ledger limit. |
| Company and platform audit logs | Scheduled cleanup after 730 days by default. The account-purge ledger is exempt from that job and retains an internal deleted-user identifier; it is not a fully anonymous record. |
| Workspace export downloads | Expire after 7 days by default; the cleanup job removes expired export records and requests file deletion. Downloaded copies are controlled by the recipient. |
| Sessions and login protection | Session expiry is 30 days; signing out/revoking a session ends its access. Login-attempt counters use a 24-hour window. |
| Backups and technical reports | Backups of the database and uploaded files are made every night (03:30 Hungarian time). They are encrypted with AES-256, digitally signed and stored on the same Leveloper-operated hardware in Hungary. Each backup is deleted automatically after 7 days, so data you delete leaves our backups within 8 days. Backups are used only to restore the service; if one is restored, outstanding deletions are applied again. External error reporting is not enabled; technical logs stay on our own servers. |
| Subscription invoices and accounting evidence | Retained for applicable statutory accounting/tax periods, even if an account is closed. Retention for Hungarian accounting documents is generally at least 8 years; a legal hold may require longer. |
| Optional analytics | Consent choice is remembered for up to 180 days in this browser. You can withdraw it at any time. Existing provider event records follow the separately configured analytics retention; contact us to request deletion of identifiable records. |
For removal of imported and derived copies, contact info@leveloper.io or your workspace owner. Specify the account, mailbox or record involved without sending passwords. Disconnecting a Google mailbox or calendar also revokes GoodCompany's Google access unless another GoodCompany connection still uses the same Google account; you can always revoke access in your provider's security settings as well. Revocation prevents future API access but does not erase previously processed records. We respond to deletion requests within one month of receipt; for complex requests we may extend this by up to two further months and will tell you why within the first month. We will explain any records we must retain and the reason. Deletion is not the same as cancelling a subscription.
Security and access
The application uses tenant-scoped access controls and database row-level security, role and sharing checks, encrypted integration secrets, Argon2id password hashing, session controls and upload validation. Privileged system jobs have additional access for defined operational purposes. Ordinary human support access requires an owner’s explicit permission for their own account, lasts at most one hour, is recorded and can be withdrawn in Settings → Privacy. Direct server/database access requires separate staff controls and a permitted purpose; tenant isolation is not a claim that administrators can never access data. Connections to the service use HTTPS. Backups are encrypted (AES-256) and digitally signed. Server and database access is limited to authorised Leveloper staff. We notify affected customer controllers of personal data breaches without undue delay and fulfil controller notification duties where applicable.
Your choices and rights
- You can request access, correction, deletion, restriction or portability where applicable by contacting info@leveloper.io. We may verify identity proportionately. We normally respond within one month and explain a lawful extension if necessary.
- You can object to processing based on legitimate interests and withdraw optional analytics consent through Privacy choices or the Cookies page. Withdrawal does not affect the lawfulness of earlier processing.
- Owners can request a workspace export in Settings → Privacy. Private content remains subject to the exporter's permissions. Individual rights requests are not limited to the workspace export feature.
- You may complain directly to Hungary's National Authority for Data Protection and Freedom of Information (NAIH), or the supervisory authority where you live or work. You do not have to contact us first.
- This is a professional service, not a service directed at children. Tell us if you believe a child has provided personal data without appropriate authority.
Policy changes
We will communicate material changes through the service or account contact details. Where a new data use requires permission, including changes to Google data use, we will obtain it before starting that use. The date above identifies this policy version.