Privacy Policy

1. Information the workspace handles

101Dash handles the identity and email address used to sign in, assigned permissions, records entered by authorised users, uploaded supporting files and approval or activity history. Business records may include closing reports, sales and financial summaries, supplier information, personnel and compliance records, and training information.

Hosting and identity providers may also process technical information needed to deliver and protect the service, such as connection details, session information and service logs. Staff should only enter personal information needed for an authorised business task.

2. Why we use this information

We use workspace information to run daily operations, maintain and review records, manage staff access and approvals, support users, and protect the service. Authorised users can view or change information according to their assigned permissions. Where required, company records may also be retained to meet applicable recordkeeping obligations.

When a user invokes a configured AI feature, relevant business records or uploaded evidence may be submitted to the OpenAI API to extract information or produce analysis. People must review the results before relying on them. The Gmail connection described below is separate from these AI features.

3. Google and Gmail access

An authorised administrator may connect the designated sending account through Google’s consent process. We request basic account identity and email information to confirm the correct account, plus Gmail permission to send email on that account’s behalf.

This connection does not request permission to read the Gmail inbox, delete existing email, or access Google Contacts, Drive or Calendar. We do not import a Gmail mailbox.

If email delivery is enabled by the company, 101Dash uses the connection to send closing-report content and any included evidence attachments to the company recipients configured in the application. Those recipients and their email providers receive that message content. At the effective date of this policy, closing email delivery is paused. Connecting Gmail saves authorisation; it does not by itself send a message or turn on notifications.

4. Google connection data and security

101Dash stores the connected account’s email address, connection time and the credentials needed to maintain its authorisation. The saved client secret and refresh token are encrypted. Temporary authorisation state is used during the connection process. If a message is sent, delivery records may include its report reference, status, time and Gmail message identifier.

Access to email configuration is restricted to the application’s designated owner. Authentication, permissions and encryption help protect information; no online system can guarantee absolute security.

5. How we limit use of Google data

Google account and authorisation data is used for the disclosed connection and report-delivery functions. We do not sell it, use it for advertising or credit decisions, or use it to train general-purpose AI models. The Gmail authorisation data is not sent to the application’s AI analysis features.

Our handling of information obtained through Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google data is shared only as needed for the authorised feature, permitted security purposes or applicable legal requirements. Any new use requiring additional permission will be explained before that permission is requested.

6. Providers and authorised recipients

The workspace uses OpenAI’s Sites service for hosting and identity integration, Cloudflare services for application infrastructure and storage, Google for account authorisation and optional Gmail delivery, and the OpenAI API when configured AI features are used. Information is processed by the relevant provider to perform its part of the service.

Company users receive access according to their roles. Report recipients receive information included in emails when delivery is enabled. We may disclose information where necessary to meet applicable legal obligations or investigate a security incident. Service providers operate internationally; information may be processed outside the country in which a user works.

7. Retention and removing Google access

Business records are retained according to operational needs and applicable recordkeeping obligations. Retention can differ by record type. Google connection data remains stored until the connection is replaced or an administrator removes its saved data; delivery history is retained with the relevant operational records.

You can revoke Google access through your Google Account connections. Revocation prevents continued authorised use of that Google connection, but does not automatically erase stored company reports, past emails or the saved connection record. Contact admin@101dash.com to request removal of stored connection data or to ask about a particular record. Information may need to be retained where a legal obligation or a legitimate recordkeeping need applies.

8. Your requests and choices

You can ask us about personal information concerning you and request access, correction or deletion. You may also have rights to restrict or object to processing, obtain a portable copy, or raise a concern with a competent data protection authority, depending on applicable law and the processing involved. We may need to confirm your identity and consider any obligations affecting the request.

Authorising the Gmail connection is optional. A person’s staff access and department permissions are managed separately from Google’s email-sending permission.

9. Cookies and policy updates

The staff workspace and its identity providers use session or similar technologies to support sign-in and secure access. These public information pages do not add advertising trackers or analytics scripts.

We will update this page when our practices change and identify the effective date. Material changes to Google data use will be disclosed before requesting any additional authorisation.