Privacy Policy
Last updated: May 2026
Overview
Actura is a personal productivity tool for managing tasks, notes, and calendar events through WhatsApp and the web. This policy describes the data we access, how we use it, with whom we share it, how we protect it, and how long we keep it. A dedicated section below covers our use of Google APIs.
Account & Messaging Data
When you sign up we collect your email address and password (stored hashed by Supabase Auth) and, if you choose to connect WhatsApp, the phone number you verify. We process WhatsApp messages received from your verified phone number to convert them into tasks, notes, and calendar events on your behalf. We never read messages from numbers you have not verified to your account. Your tasks, notes, messages, and account data are stored in a private Postgres database with row-level security so each account can only access its own rows. We do not sell your data, share it with advertisers, or use it to train AI models on your behalf.
Google API Services User Data Policy
Actura's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to others except as necessary to provide or improve user-facing features that are prominent in our application's user interface, do not use Google user data for serving advertisements, do not allow humans to read Google user data (except where required for security, with your explicit consent, or to comply with applicable law), and do not use Google user data to develop, improve, or train generalized or non-personalized AI/ML models.
Data Accessed (Google APIs)
Actura connects to a single Google API — Google Calendar — only after you click "Connect Google" in Settings or during onboarding. We request the following OAuth scopes:
https://www.googleapis.com/auth/calendar— read access to the list of calendars you own or are subscribed to and to the events on those calendars.https://www.googleapis.com/auth/calendar.events— permission to create, update, and delete events on your primary calendar in response to your explicit requests.
From those scopes we read the following event fields when fetching: event ID, summary (title), description, start and end times, location, attendees (email and response status), and conference data (e.g. Google Meet links). We do not request and do not access Gmail, Google Drive, Google Contacts, Google Tasks, or any other Google API.
Data Usage (Google APIs)
Calendar data is used only for the following user-facing features:
- Forecast view: we read events from your calendars to display them alongside your tasks in Actura's Forecast page so you can see your schedule and your work in one place. Event content is rendered for the current view and discarded after rendering.
- Event creation from natural language: when a WhatsApp message or web input contains a time reference (for example "lunch tomorrow at 1pm" or "meeting Tuesday 3pm"), Actura parses it and creates a corresponding event on your primary Google Calendar.
- Event updates and attendee invites: when you explicitly ask Actura to modify an existing event (reschedule, change title, add a participant), Actura updates that event on your primary calendar.
We do not use Google user data for any other purpose. We do not use it to serve advertising, profile users, or train AI models.
Data Sharing (Google APIs and other personal data)
We do not sell, rent, or share your Google user data with third parties for their own purposes. We rely on the following sub-processors strictly to operate Actura:
- Vercel — hosts the Actura web application and serverless functions. Calendar API responses pass through Vercel's infrastructure during a request but are not stored there.
- Supabase — provides the Postgres database and authentication. Stores your account, tasks, notes, encrypted Google OAuth refresh tokens, and connection metadata. Does not store calendar event content.
- Anthropic (Claude API) and OpenAI — receive the text of WhatsApp messages or web inputs you send to Actura, for natural-language parsing, summarisation, and transcription. They do not receive Google Calendar event content. Both vendors operate under no-training-on-customer-data terms.
- Meta (WhatsApp Cloud API) — delivers messages between you and Actura. Meta does not receive Google user data from us.
We will disclose data only if required by law, to protect user safety, or to comply with a valid legal process. We do not transfer Google user data to any other party.
Data Storage & Protection
Account, tasks, and notes are stored in a private Postgres database (Supabase, hosted in the EU-West-1 region) protected by per-user row-level security policies. All connections use TLS in transit. Google OAuth refresh tokens are stored encrypted at rest using pgcrypto AES, with the encryption key held outside the database. Google Calendar event content is not persisted — events are fetched live from the Google Calendar API on each request and discarded after the response is rendered. Connection metadata we do retain for an active Google connection: your Actura user ID, your Google account email, the granted scopes, and the timestamp the connection was created. Access to production systems is restricted to the developer with two-factor authentication, and changes are audited via Git history and platform logs.
Data Retention & Deletion
You can remove your data at any time:
- Disconnect Google from Settings: revokes Actura's OAuth grant via Google's revoke endpoint, deletes the connection row from our database, and immediately stops all calendar fetches. You can also revoke access at any time from myaccount.google.com/permissions.
- Delete your account entirely: email er.admin.manager@gmail.com and we will purge your account, all tasks and notes, all WhatsApp message history, and any cached metadata within 30 days.
- Default retention: active accounts retain tasks and notes you create until you delete them. Refresh tokens are kept only while the Google connection is active. No Google Calendar event content is ever persisted, regardless of action.
Contact
For questions about this privacy policy or to request data deletion, contact er.admin.manager@gmail.com.