Privacy Policy

1. Who is responsible

Christian Watts is the data controller for the TEN1 Gmail Invoice Importer and its associated information website. For privacy questions or requests, contact ten1tapas@gmail.com.

The tool supports TEN1’s business administration in Gandía, Spain, including TEN1 Tapas and historical records for Pub TEN1. It is a private operational tool, not a public email service. This notice covers information handled through the tool and this website; it does not replace separate employment or other business privacy notices.

2. Information we process and its sources

Depending on the authorised task, we process:

• Relevant email addresses, sender and recipient details, subject lines, dates, message and thread identifiers, message content and attachments.
• Supplier invoices, credit notes, delivery notes and related correspondence, including names, business contact details, tax identifiers, document references, product details, dates and amounts.
• Business sales, bank-statement and cash-payment records used for reconciliation, and relevant payroll or wage information where authorised.
• Questions sent to the business owner, allocation recommendations, replies and records of decisions and corrections.
• Integration authorisations, processing status, error records and audit information needed to operate and protect the service.

Information comes from the authorised TEN1 Gmail account, suppliers and advisers, the owner and authorised staff, and connected business records such as Square data and supplied bank statements.

The website’s hosting provider may also process technical request information, such as IP addresses, browser details, requested pages and timestamps, to deliver and secure the site. Contacting us by email provides the information included in your message.

3. Gmail permissions and boundaries

The integration requests Gmail read-only access (gmail.readonly) to read relevant messages and attachments, and Gmail sending access (gmail.send) to send authorised operational emails, including owner questions.

Google’s read-only permission technically permits access across the authorised mailbox. Our automatic invoice-import workflow is restricted to messages carrying the “Ten1 Invoices” label. Separately authorised processing can read replies to owner-question threads and relevant correspondence for a specific owner-requested task.

These permissions do not permit the integration to delete messages or change their labels. We do not request Gmail deletion or mailbox-modification permissions for this workflow.

Merely visiting this website does not connect your Google account or grant access to Gmail.

4. Why we use information

We use information to collect and organise business documents, extract invoice details, identify duplicates, support stock records and financial reconciliation, identify missing evidence, prepare reviewable recommendations, communicate operational questions, record authorised decisions and diagnose failures or misuse.

Where applicable, the legal bases are compliance with accounting, tax or employment obligations; performance of a contract with the person concerned or steps requested before that contract; and legitimate interests in accurate business administration, resolving discrepancies and securing the system, balanced against individuals’ rights.

Where processing relies on consent, that consent can be withdrawn. Google account authorisation controls technical access and does not itself establish a legal basis for every item of third-party information in an email.

Information is required only to the extent needed for the relevant task or legal obligation. Without the relevant records or account authorisation, some importing, reconciliation or communication features cannot operate.

5. Providers and authorised access

Automated operational workflow

Google provides Gmail and account authorisation. Supabase provides the operational database, document storage and server-side processing. The current automated Gmail importer, embedded-text extraction and owner-email worker use Google and Supabase without calls to an outside AI service.

Agent-assisted work

Separately from those automated workers, authorised document and reconciliation work can involve ChatGPT/OpenAI. Relevant information may be provided to that service for the specific authorised task.

This is not a claim that all processing uses only Google and Supabase. Access and sharing must be limited to the information needed for the task and compatible with applicable Google data-use restrictions.

Website

Lovable and its hosting infrastructure deliver this information website. Publishing these pages does not make the operational Gmail mailbox or TEN1 financial database public.

Other authorised access

Information may be accessed by authorised people supporting TEN1 and by its accountant or professional advisers where necessary for their work.

Operational question emails disclose the relevant transaction details to the authorised recipient.

Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.

6. Google user-data commitments

TEN1’s use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements, and the applicable Google Workspace API user-data rules.

Google user data is used for the specific business functions described here. It is not sold, used for advertising or transferred to data brokers.

It must not be used to develop, improve or train general-purpose or non-personalised AI or machine-learning models.

Human access to Google-derived content is limited to specific authorised assistance and other access permitted by Google’s policies, such as necessary security investigations or legal compliance. A provider’s involvement does not authorise unrelated use of the data.

7. Storage, security and international processing

Operational documents and records are held separately from the public website. Access to financial records and integration credentials is restricted to authorised operational needs. No online service can guarantee absolute security.

Providers may process information in countries outside the European Economic Area. Where such transfers occur, an applicable lawful transfer mechanism is required, such as an adequacy decision or appropriate contractual safeguards.

Contact us for information about the safeguards relevant to your data. This notice does not assert that every provider processes information exclusively in Spain or the EEA.

8. Retention and deletion

Retention depends on the record’s purpose.

Business documents and reconciliation evidence are kept for the period needed for applicable accounting, tax, employment and legal-claims obligations.

Question threads, decisions and audit records are kept while needed to support the corresponding records and resolve discrepancies.

Technical logs and temporary extraction material should be limited to the period needed for operation, security and troubleshooting.

Information no longer required is to be deleted or anonymised, subject to applicable retention obligations and backup lifecycles.

You can request deletion or details of the applicable retention criteria at ten1tapas@gmail.com.

Revoking Google access stops future access through that authorisation; it does not automatically delete records already imported or override lawful recordkeeping requirements.

9. Your choices and rights

You can review or revoke the application’s Google access through Google Account connections.

Where applicable, you can request access to, correction or erasure of personal data, restriction of processing, data portability, or object to processing based on legitimate interests.

You may withdraw consent without affecting processing lawfully carried out before withdrawal. These rights are subject to the conditions and exceptions in applicable law.

Send requests to ten1tapas@gmail.com. We may need proportionate information to verify your identity and locate the relevant records.

You may complain to the Spanish data-protection authority, Agencia Española de Protección de Datos.

You may also complain to another competent supervisory authority.

10. Automation and changes

The tool uses automated extraction and matching to support business administration. Recommendations can contain errors and remain subject to the business’s approval rules.

The tool is not intended to make solely automated decisions producing legal or similarly significant effects on individuals, and it does not authorise or execute bank payments.

We will update this notice when relevant practices change and revise the date above. Material changes in Gmail access or data use require appropriate notice and, where required, renewed authorisation.