Privacy policy

Staff sign in with Google. We request only the two standard sign-in scopes, email and profile, and we use them for these purposes only:

• Email address — to match the person signing in to the staff account an administrator created in advance, and to send them notifications about their own work.
• Name and profile picture — shown to colleagues inside the application so it is clear who owns an enquiry, attended a site visit or approved a design.

We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts or any other Google service. We never send email from a staff member's Google account, and we never write anything back to their Google account.

Star Gardens CRM's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, use it for advertising, or transfer it to third parties except as described below.

The application stores the records a landscaping business needs to run: customer enquiries and their contact details, notes on calls, scheduled follow-ups, site visit details, design drawings, garden build progress and account balances. These records are entered by staff in the course of their work; they are not collected from visitors to this website.

Access is enforced by the database itself, not only by the interface. A staff member sees the enquiries assigned to them, plus the design or build work they are part of. Administrators see everything. When an administrator deactivates an account, access stops immediately.

Application data is stored in Supabase (PostgreSQL). Uploaded files — design drawings and site photographs — are stored in a private Tigris bucket and are reachable only through short-lived signed links. The application is hosted on Vercel. Transactional email is sent through Brevo. Each of these providers processes data on our behalf as a sub-processor.

Business records are retained for as long as they are needed to run the business and to meet legal and accounting obligations. A staff member's Google profile data is retained for as long as their account is active; when an account is removed, the profile data associated with it is deleted, while the business records they created remain, as those belong to the business.

Staff can revoke this application's access to their Google account at any time from their Google account permissions page. Doing so ends the ability to sign in.

To request access to, correction of, or deletion of personal data held in this application, contact us at the address below.

Questions about this policy or about data held in Star Gardens CRM can be sent to abhi@stargardens.in.