Privacy Policy

1. Information We Collect

We collect only the essential information necessary to provide, manage, and secure our lead distribution services:

• Email Address: When you execute our Google Workspace™ Add-on, we retrieve your Google Workspace™ email address. This email address is used strictly as an account identifier to generate a unique API access key, assign trial or paid credits, authenticate API requests, and prevent duplicate lead delivery.
• Transaction Data: Payment processing for paid credit tiers is handled entirely by Whop acting as our Merchant of Record. We do not store, process, or have access to your full credit card details or financial credentials.

2. How We Use Your Information

Your email address and assigned API key are used exclusively for:

• Authenticating HTTPS requests issued from Google Apps Script™ directly to our backend server (api.pithos.uk).
• Generating a unique system API key linked to your email address to track credit consumption and balance limits.
• Maintaining accurate lead deduplication logs so you never pay for or receive the same record twice.

We do not require, ask for, or store user passwords. Your system-generated key acts as your sole API authorization token. We maintain a strict Zero-Knowledge architecture: we store only a non-reversible SHA-256 cryptographic hash of your key, along with a non-sensitive identification prefix. Because plain-text keys are never stored within our database architecture, lost keys cannot be recovered or retrieved by our systems under any circumstances.

3. Google API User Data Compliance

Our use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for serving advertisements, selling to third-party data brokers, or training artificial intelligence and machine learning models.

4. Data Protection & Security Mechanisms

We enforce strict technical, architectural, and organizational safeguards to protect user data from unauthorized access, loss, or disclosure:

• Encryption in Transit: All HTTP requests and data transfers between Google Apps Script™ and our backend endpoints (api.pithos.uk) are fully encrypted in transit using mandatory HTTPS (TLS 1.3) protocols routed through Cloudflare™ edge infrastructure.
• Cryptographic Key Hashing (SHA-256): Access keys are never saved in plaintext. We store only cryptographic one-way hashes (SHA-256) and truncated key prefixes (prefix) in PostgreSQL™. Request authentication is performed strictly by comparing incoming key hashes in memory, preventing credential exposure in the event of a database compromise.
• Encryption at Rest & Key Isolation: User email addresses, account balances, and key hashes are stored in a PostgreSQL™ database running on dedicated local hardware. Database volumes are protected with industry-standard AES-256 bit encryption at rest.
• Network & Container Isolation: Our backend architecture is fully containerized inside isolated Docker™ environments behind private network bridges and protected by Cloudflare Tunnels™ and strict firewall configurations. No direct public access to internal database ports is permitted.
• Token Generation Safety: Access keys are generated securely using cryptographically strong token generation mechanisms (secrets.choice and secrets.token_hex) combining a literary word corpus with a randomized hex entropy suffix to produce high-entropy human-readable identifiers, preventing key predictability or enumeration attacks.

5. Data Retention and Removal

Account identifiers and deduplication histories are retained strictly to ensure continuous service delivery and prevent duplicate credit usage across sessions. You may request the permanent deletion of your email address and associated key records at any time by contacting us at inquiry@pithos-intel.com. Upon receipt of your request, your records will be purged from our active databases.

6. Data Sharing and Third Parties

We strictly prohibit the sale, rental, or trade of your personal email address, usage metrics, or account data to third-party data brokers, marketing agencies, or external entities under any circumstances.

7. Contact Us

If you have questions or concerns regarding this Privacy Policy or our security measures, please reach out to us at inquiry@pithos-intel.com.