HQFlow is an internal operations platform used by Datori Systems and its authorized staff to manage field-service work: job scheduling, customer records, technician assignments, fleet tracking, email communications, and reporting.

This policy explains what information HQFlow collects, how it is used, and the choices available. HQFlow is a business tool: accounts are created and managed by the organization, and access is limited to authorized personnel.

• Account information: name, work email address, role, and staff level for each authorized user.
• Business records: customer and site contact details, job and quote records, scheduling information, notes, and internal communications created in the course of operations.
• Email and calendar data: when a user connects an email or calendar account, HQFlow may read and send messages and events on that user's behalf, as described in the connection consent screens.
• Vehicle and location data: GPS positions reported by company-owned vehicle tracking devices, used for dispatch and fleet visibility. This covers company vehicles only.
• Technical logs: security and audit logs such as sign-in events and administrative actions.

• Operating the service: scheduling, dispatch, customer management, and reporting.
• Authentication and account administration for authorized staff.
• Sending operational notifications and emails on behalf of the organization.
• Security monitoring, audit trails, and abuse prevention.

HQFlow does not sell personal information and does not use it for advertising.

Information is shared only with: service providers that host and operate the platform (cloud hosting, database, email delivery, and calendar/email API providers); authorized staff within the organization according to their role; and law enforcement or regulators when legally required.

Business records are retained while the organization uses the service and may be exported or deleted by administrators. Technical telemetry (such as raw vehicle position history) is automatically purged on a rolling schedule. We protect data with access controls, encrypted connections, and role-based permissions.

Authorized users may access and correct their account information through the platform or by contacting their administrator. Organization administrators control user accounts, exports, and deletions. You may also contact us using the details below.

HQFlow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7.1 Google data we access

When a user chooses to sign in with Google or connect a Google Calendar, HQFlow requests only the following permissions (OAuth scopes):

• Basic profile (userinfo.profile): your name and profile picture, used to display who is signed in and to label calendar bookings with the correct staff member.
• Email address (userinfo.email): your Google account email, used to identify your HQFlow account, match you to your organization, and show which calendar is connected.
• Google Calendar (calendar): event titles, dates, times, locations, and descriptions on calendars you connect. HQFlow reads events to show your availability (busy/free blocks) when office staff book site visits, and creates, updates, or deletes events that HQFlow itself scheduled (for example, a customer site visit assigned to you).

7.2 How we use Google data

• Displaying your availability inside HQFlow's scheduling calendar.
• Adding, rescheduling, and cancelling appointments that were booked through HQFlow.
• Identifying you at sign-in and associating your calendar with your staff profile.

Google data is used only to provide these user-facing features. We do not use it for advertising, do not sell it, do not use it to build user profiles for unrelated purposes, and do not use it to train generalized or third-party AI/ML models. Humans do not read your Google data except with your explicit consent, for security investigations, to comply with law, or when aggregated and anonymized for internal operations.

7.3 Storage and protection

OAuth access and refresh tokens are stored encrypted on our servers and are never exposed to the browser or other users. Calendar event details are fetched on demand for display; HQFlow stores only the identifiers and times of events it created so it can update or remove them later. All data is transmitted over HTTPS (TLS) and access is restricted by role-based permissions within your organization.

7.4 Sharing

Google user data is not shared with third parties, except (a) with infrastructure providers that host HQFlow under confidentiality obligations, solely to operate the service; (b) with other authorized staff in your own organization as part of scheduling (for example, showing that a time slot is busy); or (c) when required by law. It is never transferred to data brokers or advertising platforms.

7.5 Retention and deletion

Google tokens and stored event references are kept only while your Google account remains connected. When you disconnect Google in HQFlow, or revoke access at myaccount.google.com/permissions, HQFlow stops all access and deletes your stored tokens and Google-derived data within 30 days. You can also request deletion at any time by emailing contact@hqflow.app.