Privacy Policy

1. Data controller

Izposodi.si d.o.o., Podbrdo 40, 5243 Podbrdo, Slovenia. Registration number: 7300581000. VAT ID: 87370000.

Website: izposodisi.eu. Product portals: admin.thecompanyos.eu. Email: info@izposodisi.eu.

2. Scope of this policy

This policy covers:

• Marketing website visitors and contact/newsletter forms on izposodisi.eu.
• TheCompany OS platform used by customer organisations (“tenants”), their staff users, end users, and connected integrations (including Google).

Customer organisations may also act as independent controllers for data they process in their own tenant. Where we process data on a customer’s instructions as a processor, that relationship is governed by the customer agreement and applicable data-processing terms.

3. Marketing website — what we collect

On the marketing website we may process:

• Information you send via contact or similar forms (name, email, company, message).
• Technical data such as IP address, browser type, and pages visited (server logs).
• Cookies or similar technologies if we enable analytics or embeds.

4. Marketing website — why we use your data

• To respond to inquiries and provide information about TheCompany OS.
• To operate and secure the website.
• To comply with legal obligations where applicable.

Where GDPR applies, we rely on legitimate interests to operate the site and respond to inquiries, and on your consent when you submit forms that send us email.

5. TheCompany OS platform — categories of data

When an organisation uses TheCompany OS, we may process:

• Account and admin data: names, email addresses, roles, authentication data, and audit logs for tenant users.
• Business content: tasks, messages, knowledge documents, bookings, invoices, contracts, and other content customers create or import.
• Channel and integration data: configuration and message/event data from connected services (for example email, WhatsApp, Telegram, Slack, calendars) as enabled by the tenant.
• Google Workspace data when a tenant admin connects Google (see section 6).
• Technical and security data: logs, IP addresses, device/browser metadata, and diagnostics needed to run and secure the service.

6. Google user data (Gmail, Calendar, Drive, Docs, Sheets)

Tenant administrators may connect a Google account to TheCompany OS using Google OAuth. Depending on the permissions granted, we may access:

• Gmail (gmail.modify): read messages in connected mailboxes, sync them into the tenant inbox replica, send email on behalf of the connected account, and manage related message metadata needed for those features.
• Google Calendar (calendar.events): list, create, update, and delete calendar events for reservation and organisation calendar sync.
• Google Drive, Docs, and Sheets (drive, documents, spreadsheets): list and open files/folders the user grants access to, and create or update documents and spreadsheets when agent or admin tools are used for that purpose.
• Basic profile (openid, email, profile): identify the connected Google account.

Purpose of use: We use Google user data solely to provide and improve the TheCompany OS features the tenant enables—email sync and send, calendar synchronisation, and Drive/Docs/Sheets tools for authorised users and agents—not for advertising.

Storage: OAuth refresh tokens and related secrets are stored encrypted in the tenant’s environment. Synced email, calendar, and file-derived content may be stored in the tenant database and workspace so the product can operate offline from live Google calls where designed to do so.

Sharing: We do not sell Google user data. We do not use Google user data for serving advertisements. We do not allow humans to read Google user data except (a) with the user’s/tenant’s consent or direction, (b) for security, abuse investigation, or legal compliance, or (c) where data is aggregated and anonymised for internal operations and cannot be associated with a user or Google account. We do not transfer Google user data to third parties except to subprocessors strictly necessary to operate the service (for example hosting infrastructure), under contracts that require appropriate protection, or when required by law.

AI / models: Customer and Google user data processed in TheCompany OS is not used to train public foundation models. Where a tenant configures an AI provider, prompts and tool outputs may be sent to that provider under the tenant’s configuration and that provider’s terms.

Limited Use: Our use and transfer to others of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnect / revoke: A tenant admin can disconnect Google under Integrations → Google in the admin portal. Users can also revoke access at any time in their Google Account under Third-party access. After disconnect or revoke, we stop new Google API access; residual copies in the tenant workspace/database are retained or deleted according to the customer’s retention settings and our retention practices below.

7. Sharing and international transfers

We do not sell personal data. We may use processors (hosting, email delivery, error monitoring, AI providers chosen by the tenant) who process data on our or the tenant’s instructions. If personal data is transferred outside the EEA, we use appropriate safeguards where required (for example standard contractual clauses).

8. Retention

Marketing inquiry data is kept only as long as needed to handle your request and for reasonable business record-keeping, unless a longer period is required by law.

Platform data is retained for the life of the customer subscription and according to the customer’s configuration. After contract end or deletion requests, we delete or anonymise data within a reasonable period, subject to legal retention duties and backup cycles. Google OAuth tokens are removed or invalidated when a Google account is disconnected.

9. Security

We apply technical and organisational measures appropriate to the risk, including encryption of secrets (such as OAuth tokens), access controls, tenant isolation of data, and audit logging of administrative actions. No method of transmission or storage is completely secure; please contact us promptly if you suspect unauthorised access.

10. Your rights

Depending on your location, you may have rights to access, rectify, erase, restrict, or object to processing, data portability, and to lodge a complaint with a supervisory authority (in Slovenia, the Information Commissioner). Contact us at info@izposodisi.eu.

If your data is processed in a customer’s TheCompany OS tenant, you may also need to contact that organisation as controller for requests about their business content.

11. Children

TheCompany OS and this marketing website are directed at businesses and adults. We do not knowingly collect personal data from children for these services.

12. Changes

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Material changes affecting Google user data use will be reflected in this policy and, where appropriate, communicated to tenant administrators.

13. Contact

Izposodi.si d.o.o.
Podbrdo 40, 5243 Podbrdo, Slovenia
Email: info@izposodisi.eu
Product: admin.thecompanyos.eu