Privacy Policy

Specifically, data obtained through Google APIs is subject to the following restrictions:

• We only use Google user data to provide or improve the user-facing features of Centri that are described in this Privacy Policy.
• We do not use Google user data for advertising, to create advertising profiles, or to show targeted ads to any user.
• We do not sell, rent, or transfer Google user data to any third party, except as strictly necessary to operate the service (e.g. sending an email via Gmail requires transmitting the message content to Gmail's servers).
• We do not allow humans to read Google user data unless you have given explicit consent, it is necessary for security purposes (e.g. investigating a reported abuse), or we are required to do so by law.
• Access to Google user data is limited to the minimum permissions necessary to provide the requested functionality.

Centri requests the following Google OAuth scopes. We request only what is strictly necessary for the features you enable:

You will be shown Google's standard OAuth consent screen before any permissions are granted. You can grant or deny each permission individually. Denying a permission will disable the corresponding Centri feature but will not prevent you from using other parts of the platform.

We use the information we collect to:

• Provide and operate the Centri platform and all its features
• Read incoming emails and create support tickets from new client inquiries
• Send emails on your behalf when you compose a reply through the Centri inbox
• Sync your Google Calendar availability and create booking events when appointments are confirmed
• Power the AI secretary and chatbot using your business context (business name, services, FAQ content)
• Display your call history, inbox, and CRM data in your dashboard
• Send digest emails and routine notifications you configure
• Diagnose bugs, improve performance, and develop new features
• Communicate with you about your account, updates, and support requests

Centri integrates with the following services. Each processes data only as necessary to fulfil its function and is subject to its own privacy policy:

We retain your personal data for as long as your account is active. If you request account deletion, we will permanently delete your data within 30 days, except where retention is required by applicable law.

Google-sourced data: Email content fetched from Gmail is retained only as long as necessary to populate your inbox tickets. You can delete individual tickets from your dashboard at any time, which removes the associated email content from our systems. Calendar event data is not stored beyond what appears in your bookings dashboard.

Call recordings processed by Retell AI are subject to Retell AI's own retention policy. Transcripts stored in Centri are deleted when you delete the associated call record or when your account is deleted.

We implement the following measures to protect your data:

• All data is transmitted over encrypted connections (TLS 1.2+)
• Google OAuth tokens are stored encrypted at rest and are never logged
• We never store your Google account password
• Our database is hosted in an isolated, access-controlled environment with encryption at rest
• Access to production systems is restricted to authorized personnel only
• We do not allow Centri employees or contractors to read your Google data unless required for security investigations or legal compliance

No system is 100% secure. We recommend enabling two-factor authentication on your Google account and using a strong, unique password for Centri. If you believe your account has been compromised, please contact us immediately at paul@centriai.com.

Depending on your location, you may have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — request that we correct inaccurate or incomplete data
• Deletion — request that we delete your account and all associated personal data
• Portability — request an export of your data in a machine-readable format (JSON or CSV)
• Objection — object to specific types of data processing
• Restriction — request that we limit how we process your data
• Withdraw consent — disconnect Google and other integrations at any time without closing your account

To exercise any of these rights, email paul@centriai.com with your request. We will respond within 30 days. For verified deletion requests, we will confirm completion once your data has been removed.

California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of your personal information. We do not sell personal information.

EEA / UK residents (GDPR / UK GDPR): Our lawful basis for processing your personal data is performance of a contract (to provide the Centri service you signed up for). For Google-sourced data, the lawful basis is your explicit consent given during the OAuth authorization flow. You may withdraw that consent at any time by revoking access (see Section 10).

You can disconnect your Google account from Centri at any time. There are two ways to do this:

• Within Centri: go to Settings → Connectors → Google, and click Disconnect.
• Directly via Google: visit myaccount.google.com/permissions, find Centri in the list, and click Remove Access.

Revoking access will immediately prevent Centri from reading your Gmail or Calendar. Existing tickets and bookings already created from your emails will remain in your dashboard until you manually delete them. Any Google OAuth tokens we hold will be invalidated and removed from our systems within 24 hours of disconnection.

To request deletion of all data derived from your Google account (email content in tickets, calendar-sourced bookings), email us at paul@centriai.com.

Centri uses cookies solely for session management — to keep you securely logged in between page loads. We set one first-party session cookie when you log in and clear it when you log out or the session expires.

We do not use third-party advertising cookies, tracking pixels, or analytics cookies that report to external services. You can clear cookies at any time through your browser settings, which will log you out of the platform.

Centri is designed for business owners and professionals aged 16 and over. We do not knowingly collect personal information from anyone under the age of 16. If you believe a minor has created an account, please contact us at paul@centriai.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and notify you via email at least 14 days before the changes take effect. For minor changes (correcting typos, clarifying language), we will update the date without direct notice.

Continued use of Centri after changes take effect constitutes your acceptance of the updated policy. If you disagree with a change, you may close your account by emailing us before the effective date.

If you have questions about this Privacy Policy, want to exercise your data rights, or need to report a privacy concern, please contact us: