Privacy policy

Who operates Delight

Delight is a client relationship monitoring application operated by Mersudin Forbes Digital. Contact mersudin@mersudinforbes.com about this policy, your account or a data request. Agencies use Delight to review communication, client health signals and upcoming meetings within their own workspace.

Information we access

We process your account name and email address, workspace membership, client and contact details, service information and monthly values that you provide. Connecting Google lets Delight read the account information, Gmail messages and Google Calendar information that you authorise. These permissions are read-only: Delight does not use them to send email, change your inbox or create, edit or delete Google Calendar events.

How Gmail API information is used

When you connect Gmail through Google's permission screen, Delight uses the Gmail API to look for communication involving your configured client contacts and domains. Message text is processed in memory to identify sentiment, requests, response times and other relationship signals. For these API imports, Delight stores message identifiers, sender and recipient details, timestamps, selected keywords, analysis results and, when email summaries are enabled, a short paraphrased summary. These imports do not retain a full copy of the email body. Workspace filtering can exclude domains and messages containing specified words.

Emails you forward to Delight

The separate email-forwarding feature receives messages you choose to send to your workspace's intake address. It stores the forwarded message's text and HTML bodies, subject, sender and recipient details, message identifiers and received time, and can link them to a client record. These stored forwarded messages remain subject to the access controls and deletion-request process described below. Forwarding does not grant Delight access to your Google account.

How Calendar information is used

Delight reads your accessible calendars and matches meeting attendees to client contacts or configured client domains. It stores matched meeting details, including title, description, dates, times, attendees, calendar identifiers, source links and status, so your workspace can show upcoming meetings and changes. You can choose how far ahead upcoming events appear.

Service providers and AI processing

Supabase provides account authentication and database storage, and Vercel hosts the application. The database and application functions are configured in London. Where AI features are enabled, only the relevant message text or derived client signals needed for the feature are sent to Anthropic to generate summaries or analysis. Processing by these providers may involve infrastructure outside the UK. AI results can be inaccurate and should be checked against the original communication.

Google data is used to provide Delight's visible client monitoring features. We do not sell Google user data, use it for advertising, or use it to develop, improve or train general-purpose or non-personalised AI or machine-learning models. We restrict its use and sharing in accordance with the Google API Services User Data Policy, including its Limited Use requirements. Access for support or troubleshooting requires your permission, except where needed for security or legal obligations.

Account emails

Resend delivers account confirmation, sign-in, password reset and team invitation emails on our behalf. It receives the destination email address, the authentication email content and delivery information. These emails do not include your imported Gmail messages, client summaries or Calendar events. For help with an account email, contact mersudin@mersudinforbes.com.

Who can see workspace information

Authorised members of your agency workspace can see the client records, signals, summaries and meetings stored there. Your workspace administrator controls invitations and membership. Connect only accounts you are authorised to use and inform relevant colleagues and clients about your agency's processing of their information.

Retention, disconnection and deletion

Stored workspace information remains available while needed to provide the service or until it is deleted. You can save a retention preference in Integrations, but automatic deletion based on that preference is not currently enabled. Disconnecting Google does not erase imported records or forwarded messages. You can stop further Google access in your Google account connections. Contact us to request access, correction, export or deletion of your stored information, including previously imported Google data and forwarded messages. We may need to verify the request and retain limited information where required by law. Copies in provider backups may remain for their backup retention period.

How we protect sensitive data

Delight uses HTTPS and TLS to encrypt data while it travels between your browser, the application and its service providers. Supabase encrypts stored database data at rest, and Vercel encrypts customer data held on its platform at rest.

Supabase Auth verifies sign-in. Protected workspace requests check your membership and role, and application queries are limited to the relevant workspace. Supabase Row Level Security separates workspace records for direct database access. Server-side jobs keep service credentials within the application infrastructure and process records within the relevant workspace.

Google OAuth access and refresh tokens are stored in Supabase's encrypted database. Database permissions restrict access to these connection records to server-side functions. The workspace interface shows connection status and the connected email address; it does not expose Google tokens or service credentials.

Delight uses authentication cookies to keep you signed in and browser storage for preferences such as appearance. Keep your sign-in details secure and tell us promptly if you suspect unauthorised access.

Changes and contact

We will update this page when our practices change. Material changes to how connected Google data is used will be explained before that use begins, with renewed permission where required. Send privacy questions or requests to mersudin@mersudinforbes.com.