Privacy Policy
Last updated: 2026-09-27
AttendeeSync is operated by NorthCoast DevOps LLC (ncdLabs). It processes Zoom (and related host) registration events to create or update person and event participation records in customer-configured CRM systems.
Company-wide notices also appear at ncdlabs.com/privacy and ncdlabs.com/security. This page adds product-specific detail for AttendeeSync.
Who we are
- Controller: NorthCoast DevOps LLC (ncdLabs)
- Privacy: privacy@ncdlabs.com
- Security: security@ncdlabs.com
- Outages / service help: help@ncdlabs.com
Information we process
- Account data — membership, sessions, billing plan state, and workspace settings.
- Connector credentials — Zoom/Google/CRM OAuth tokens and API keys encrypted at rest (AES-GCM); never shown in plaintext in the support UI.
- Operational delivery data — delivery ledger keys and CRM record IDs for idempotency. We prefer opaque identifiers over storing full registrant PII at rest.
- Job and audit records — execution summaries and audit events without secret material.
- Billing — Stripe processes payment details; we receive confirmation and subscription metadata needed to run the account.
- Technical metadata — request IPs, User-Agent, and similar edge/log data used for delivery, security, and abuse prevention (often via Cloudflare).
Zoom and host platforms
Hosts authorize AttendeeSync via OAuth. Deauthorization and Zoom data-compliance deletion callbacks revoke tokens and remove connection-scoped data. Registrant payloads are used to fulfill the sync you configured and are typically written to your CRM rather than retained as a long-term PII store.
Google user data
When you use Sign in with Google or connect Google Meet / Google Forms, AttendeeSync requests only the OAuth scopes needed for that feature. We use Google user data solely to provide AttendeeSync (authenticate you, list Meet-linked Calendar events and invitees, list and read Forms you select, and sync those people into your CRM). We do not sell Google user data, use it for advertising, or allow unrelated human access except as needed for security, abuse prevention, or legal compliance.
- Sign in with Google — OpenID profile identifiers (openid, email, profile) to create or link your AttendeeSync account.
-
Google Meet / Calendar — Calendar event metadata and
invitee lists (
calendar.readonly,meetings.space.readonly) so we can sync invitees for events you choose. -
Google Forms — Form structure and responses
(
forms.body.readonly,forms.responses.readonly) for forms you select. - Storage — OAuth refresh/access tokens are encrypted at rest (AES-GCM). Sync writes registrant fields to your configured CRM; we do not keep a separate long-term warehouse of Google form or Calendar PII.
- Revocation — Disconnect Google in Integrations (or revoke AttendeeSync in your Google Account) to stop new access; we clear stored Google tokens for that connection.
Google API Services User Data Policy: AttendeeSync’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Purpose and sharing
We process data to provide AttendeeSync, secure the service, bill accounts, and meet legal obligations. We use processors such as Cloudflare (hosting/edge), Stripe (billing), and email/error tools under appropriate agreements. We do not sell personal information. Customers remain responsible for lawful Zoom/CRM use and registrant consent.
Retention
Age-based retention for operational logs (for example deliveries and job executions about 90 days, audit events about 365 days, notification outbox about 30 days) and offboarding purge after account cancellation are described in our company data retention and protection policy. Encrypted credentials are removed when you delete a connection or cancel the account (subject to scheduled purge jobs).
Your choices
- Disconnect Zoom or other connectors from the product UI to stop new syncs and revoke tokens via platform callbacks where applicable.
- Cancel or offboard an account to schedule deletion of account-scoped operational data.
- Email privacy@ncdlabs.com for access, correction, or deletion requests we can fulfill.