Privacy Policy

Last updated: 2026-10-08

AttendeeSync is operated by NorthCoast DevOps LLC (ncdLabs). It processes Zoom (and related host) registration events to create or update person and event participation records in customer-configured CRM systems.

Company-wide notices also appear at ncdlabs.com/privacy and ncdlabs.com/security. This page adds product-specific detail for AttendeeSync.

Who we are

Controller: NorthCoast DevOps LLC (ncdLabs)
Privacy: privacy@ncdlabs.com
Security: security@ncdlabs.com
Outages / service help: help@ncdlabs.com

Information we process

Account data — membership, sessions, billing plan state, and workspace settings.
Connector credentials — Zoom/Google/CRM OAuth tokens and API keys encrypted at rest (AES-GCM); never shown in plaintext in the support UI.
Operational delivery data — delivery ledger keys and CRM record IDs for idempotency. We prefer opaque identifiers over storing full registrant PII at rest.
Job and audit records — execution summaries and audit events without secret material.
Billing — Stripe processes payment details; we receive confirmation and subscription metadata needed to run the account.
Technical metadata — request IPs, User-Agent, and similar edge/log data used for delivery, security, and abuse prevention (often via Cloudflare).

Zoom and host platforms

Hosts authorize AttendeeSync via OAuth. Deauthorization and Zoom data-compliance deletion callbacks revoke tokens and remove connection-scoped data. Registrant payloads are used to fulfill the sync you configured and are typically written to your CRM rather than retained as a long-term PII store.

Google user data

When you use Sign in with Google or connect Google Meet / Google Forms, AttendeeSync requests only the OAuth scopes needed for that feature. We use Google user data solely to provide AttendeeSync (authenticate you, list Meet-linked Calendar events and invitees, list and read Forms you select, and sync those people into your CRM). We do not sell Google user data, use it for advertising, or allow unrelated human access except as needed for security, abuse prevention, or legal compliance.

Sign in with Google — OpenID profile identifiers (openid, email, profile) to create or link your AttendeeSync account.
Google Meet / Calendar — Calendar event metadata and invitee lists (calendar.readonly, meetings.space.readonly) so we can sync invitees for events you choose.
Google Forms — Form structure and responses (forms.body.readonly, forms.responses.readonly) for forms you select.
Storage — OAuth refresh/access tokens are encrypted at rest (AES-GCM). Sync writes registrant fields to your configured CRM; we do not keep a separate long-term warehouse of Google form or Calendar PII.
Revocation — Disconnect Google in Integrations (or revoke AttendeeSync in your Google Account) to stop new access; we clear stored Google tokens for that connection.

Google API Services User Data Policy: AttendeeSync’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share Google user data with

We share Google user data only as needed to provide AttendeeSync:

Your configured CRM — When you set up a sync stream, attendee/contact data from Google Calendar, Meet, or Forms is written to the CRM destination you selected (e.g., Salesforce, HubSpot). This is the core function of AttendeeSync and only happens for streams you explicitly configure.
Cloudflare — Our hosting and edge infrastructure provider. Google user data passes through Cloudflare's network for delivery and is stored in Cloudflare D1 (database) and related services under our data processing agreement.
Stripe — Our billing processor. Stripe receives only account/billing metadata, not Google Calendar, Meet, or Forms content.

We do not sell Google user data. We do not share Google user data for advertising purposes. We do not allow unrelated human access to Google user data except as needed for security, abuse prevention, or legal compliance. We do not transfer Google user data to any other third parties.

How we protect Google user data

Encryption at rest — OAuth tokens and credentials are encrypted with AES-GCM before storage. Database content is encrypted at rest by our infrastructure provider.
Encryption in transit — All API communications use TLS 1.2 or higher. We never transmit Google user data over unencrypted connections.
Access controls — Google user data is scoped to your AttendeeSync workspace. Only members of your workspace can access it through the product UI. Our personnel access is limited to what is necessary for security, abuse prevention, support (with your consent), or legal compliance.
Minimal retention — We do not maintain a separate long-term warehouse of Google Calendar, Meet, or Forms PII. Sync writes registrant data to your CRM; operational copies are subject to age-based retention (see Retention section above) and purged on account cancellation.
Token revocation — Disconnecting a Google connection in AttendeeSync revokes our access and clears stored tokens. You can also revoke AttendeeSync's access at any time from your Google Account permissions page.
No AI training — Google user data is never used to train machine learning or AI models.

Purpose and sharing

We process data to provide AttendeeSync, secure the service, bill accounts, and meet legal obligations. We use processors such as Cloudflare (hosting/edge), Stripe (billing), and email/error tools under appropriate agreements. We do not sell personal information. Customers remain responsible for lawful Zoom/CRM use and registrant consent.

Retention

Age-based retention for operational logs (for example deliveries and job executions about 90 days, audit events about 365 days, notification outbox about 30 days) and offboarding purge after account cancellation are described in our company data retention and protection policy. Encrypted credentials are removed when you delete a connection or cancel the account (subject to scheduled purge jobs).

Your choices

Disconnect Zoom or other connectors from the product UI to stop new syncs and revoke tokens via platform callbacks where applicable.
Cancel or offboard an account to schedule deletion of account-scoped operational data.
Email privacy@ncdlabs.com for access, correction, or deletion requests we can fulfill.