Privacy Policy

GroceryList Compass is an internal workplace collaboration and scheduling platform operated by GroceryList Group. It is intended solely for authorized GroceryList personnel. This Privacy Policy explains how Compass collects, uses, retains, and protects information — including data from connected Google services — when employees use the platform.

Information we access

• Account information: When you sign in, Compass uses your work email address and profile information managed through GroceryList authentication to identify you inside the platform.
• Google Calendar: If you choose to connect your Google Calendar, Compass may access calendar availability, event titles, times, attendees, and organizer information. This is used for conflict detection, meeting creation, rescheduling, cancellation, and two-way synchronization.
• Gmail: If you choose to connect your Gmail account, Compass requests the gmail.send scope only. This allows Compass to send email messages that you explicitly authorize, such as meeting invitations or scheduling notifications. Compass does not request access to read your inbox, search messages, or access email content beyond what is necessary to send the message you initiated.

How we use Google data

• To display your calendar availability inside Compass.
• To detect scheduling conflicts before meetings are booked.
• To create, update, reschedule, and cancel calendar events you initiate in Compass.
• To send email messages that you compose and approve.
• To keep Compass event and email records in sync with the connected provider.

Google user data is used only to provide these features to the employee who connected the account. Compass does not use Google data for advertising, does not sell Google data to third parties, and does not use Google data to train AI or machine-learning models.

Employee control and disconnect

Connecting Google Calendar or Gmail is optional. You can disconnect an integration at any time from your Compass settings. Disconnecting removes the active connection and stops future synchronization. Historical records created inside Compass while the integration was connected may remain in accordance with GroceryList records-retention policies.

Data retention and deletion

Compass retains workspace records such as meetings, tasks, projects, messages, and knowledge-center documents for as long as needed for business operations and in accordance with GroceryList Group records-retention requirements. Connected-provider credentials are encrypted and stored only for active connections. When an integration is disconnected or an account is deactivated, associated credentials are removed. Requests for additional deletion or export should be directed to the contact email below.

Security and access

Access to Compass is restricted to invited and authorized employees. Row-level security, role-based permissions, and organization-scoped access controls are enforced in the database. OAuth tokens and refresh tokens are encrypted server-side and are never exposed in the client application or in logs.

Compliance with Google API Services User Data Policy

Compass use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements. We access only the scopes necessary for the features described above, and we do not transfer, sell, or use that data for purposes outside of operating Compass for authorized employees.

Changes to this policy

We may update this Privacy Policy as Compass evolves. The effective date at the top of this page will reflect the most recent revision. Material changes will be communicated through Compass or by work email.

Contact

Questions about this Privacy Policy or data practices should be sent to privacy@grocerylistgroup.com.