How Ivy handles your data

1. Scope and application owner

Ivy Sales and Marketing (“Ivy”) is an internal business application operated by Thompson Electric, Inc. It is built for authorized Thompson Electric personnel and is not offered as a public or third-party marketing platform. This policy applies to information processed through Ivy, including data an authorized user permits Ivy to access through Google API Services.

Thompson Electric, Inc. is responsible for Ivy. Privacy questions and deletion requests may be sent to office@thompsonelectricinc.com.

2. Google user data Ivy accesses

Google access begins only after an authorized Google account holder chooses to connect an account and approves the permissions shown by Google. Ivy's initial release is read-only. Depending on which feature the user connects, Ivy may access the following categories:

Ivy requests only the permission required for an enabled feature. A broad Google permission does not expand Ivy's server-side routes or authorize an undisclosed use.

3. How Google user data is used

Ivy uses Google user data only to provide the user-facing features described above, including:

• verifying that a connection belongs to the configured Thompson Electric account, property, location, or channel;
• returning bounded reports requested by an authorized user;
• creating internal summaries, comparisons, and evidence-based recommendations; and
• preparing drafts for human review without publishing, sending, or changing Google data in the initial release.

Gmail and other Google Workspace data is not used to target or personalize advertising, create remarketing audiences, determine creditworthiness, perform surveillance, build a data-broker product, or train a general-purpose artificial intelligence model. It is not sold.

Ivy's use of information received from Google Workspace APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

4. Storage and retention

• OAuth refresh credentials are encrypted in a managed secret store and kept only while the connection remains authorized and needed.
• Short-lived access tokens are held only as needed to complete authorized requests.
• The initial release does not create a persistent raw Gmail-message store, Business Profile review corpus, YouTube audiovisual-content store, or raw Local Services conversation store.
• Business Profile content is not pre-fetched or indexed. Any policy-permitted temporary cache is secure, limited, and removed within 30 calendar days; the current design disables content persistence.
• YouTube API data is deleted or refreshed within 30 calendar days unless YouTube policy permits longer retention, and authorization is rechecked at least every 30 days when retained authorized statistics are used.
• Redacted operational and security logs may be retained for up to 30 days. Tokens and Gmail content are excluded from logs.
• If an authorized user deliberately saves or exports an internal report, that user-controlled copy is handled under Thompson Electric's business-record and source-service requirements.

5. Sharing and human access

Google user data is not sold or shared with advertisers, data brokers, or information resellers. Thompson Electric may use contracted infrastructure and application service providers, including Microsoft-hosted services, solely to operate, secure, and deliver the feature an authorized user requested. Those providers are not permitted to use the data for their own advertising or unrelated purposes.

Human access is limited to the authorized user, to personnel the user expressly asks to involve, to aggregated and anonymized internal operations, or when access is necessary for security, legal compliance, or support with the user's documented consent.

6. Security

Ivy uses transport encryption, encrypted secret storage, identity and account allowlists, least-privilege access, bounded requests, and redacted logging. Google connections are separated by purpose and mailbox so that Ivy does not infer which identity it should use. No method can eliminate every risk, but Thompson Electric maintains administrative and technical safeguards appropriate to the data processed.

7. Your choices, revocation, and deletion

An authorized user may stop Ivy's Google access at any time by:

1. revoking Ivy Sales and Marketing in the Google Account's third-party connections page; and
2. emailing office@thompsonelectricinc.com to request disconnection or deletion of Ivy-controlled Google user data.

Thompson Electric will remove the application's stored OAuth credentials and delete Ivy-controlled Google user data associated with the request within 30 days, unless a shorter source-service rule applies or retention is legally required. Revocation may prevent connected features from working.

8. Children's data

Ivy is a business application for authorized Thompson Electric personnel. It is not directed to children and is not designed to collect children's personal information.

9. Changes to this policy

Thompson Electric will update this page before using Google user data for a new purpose. When required, affected users will be notified and asked to consent again. The effective date at the top of this page identifies the current version.

10. Contact