Who operates this application
WELLKAI-CRM is operated by Wellkai Trading Company Limited for a fixed company team of no more than 15 users. This policy covers the CRM and its Google Gmail integration. This public information website is separate from the CRM. For support, privacy questions or data requests, contact honina0101@gmail.com.
Google data we access
After a user authorizes a connection, the CRM accesses the connected Gmail address, message and thread identifiers, sender and recipient information, subjects, timestamps, message bodies and attachments needed for its email features. OAuth access and refresh tokens enable the connection and background synchronization.
The requested scopes are:
https://www.googleapis.com/auth/gmail.readonly— permits reading Gmail messages and settings. This permission has mailbox-wide capability; the CRM uses it to find and archive business messages associated with customer contacts, synchronize email history and display reply status.https://www.googleapis.com/auth/gmail.send— permits sending email on the user’s behalf. The CRM uses it for messages that the user explicitly prepares and submits.
The CRM does not request permission to modify or permanently delete Gmail messages. Message matching limits what is archived; it does not narrow the permission granted by Google. Messages matching multiple customers may require the mailbox owner to confirm the association.
Why we use the data
Google data is used only for visible company CRM functions: matching correspondence to customer records, showing business email history and attachments, tracking replies and allowing authorized users to send business email. Background synchronization can continue while a connection is active. The public information website does not connect to Gmail or receive CRM records or OAuth credentials.
Storage, access and security
The CRM stores archived business email bodies, metadata and attachments in the company-managed CRM database and file storage. These records can be included in backups. OAuth credentials are encrypted by the application; generated CRM backup archives are encrypted. Access to records is controlled by CRM roles and customer responsibilities. Private email has additional access restrictions.
Business email can be visible to authorized company colleagues under these access rules. Users must be informed of and agree to this company access when connecting a mailbox. We do not claim that all production storage has been independently assessed, or that Google has verified the application.
Sharing, service providers and prohibited uses
We do not sell Google user data, use it for advertising, or provide it to external AI services for processing, model training or improvement. We do not provide it to third parties for unrelated purposes.
Infrastructure providers used to operate the CRM or its backups may process data only as needed to provide those services under company instructions. Disclosures may also be necessary for security or legal obligations. The public website is hosted through Sites and its hosting infrastructure; it carries public application information, not Gmail or CRM business data. Hosting providers may process ordinary request information such as IP addresses and access logs to deliver and secure this website. We do not add advertising trackers, analytics scripts or contact forms.
Retention and deletion
Archived business records are retained while needed for company CRM activities or applicable retention obligations. Retention needs are reviewed when a verified deletion request is received. Disconnecting a mailbox stops synchronization and clears the credentials held by the CRM; it does not erase previously archived correspondence. Deleting a message in Gmail does not automatically delete its CRM copy.
Deletion requests are reviewed for identity, the requested records and any required retention. We explain the outcome and any records that must be retained. Backup copies may remain until their configured rotation expires; immediate removal from every backup is not promised. The current default backup policy retains recent daily copies for 30 days and selected monthly copies for up to approximately one year when verified offsite copies are available. Copies may remain longer if safe backup cleanup cannot run. Actual storage and backup retention must be checked when processing a request.
See Data controls & deletion for the separate steps to disconnect, revoke access and request removal.
Google API Limited Use
WELLKAI-CRM’s use and transfer of information received from Google APIs will adhere to the Google Workspace user data and developer policy and the Google API Services User Data Policy, including the Limited Use requirements. This includes restrictions on human access, transfers and uses of Google data.
Your choices and policy updates
You may decline to connect Gmail and use other available CRM functions. You may disconnect a mailbox, revoke Google access, or ask questions and request deletion through honina0101@gmail.com. Send requests without passwords, OAuth tokens or unnecessary message contents. We will update this page when our practices change; the effective date appears above.