Privacy Policy

TenthAvenue CRM is a business customer-relationship-management platform offered to organizations (“Customers”). Where a Customer uses the Service to process information about their own contacts, clients, and investors, the Customer is the controller of that data and we act as their processor. For account holders who sign in to the Service, including investors who sign in to a Customer’s investor portal, we are the controller of the account information described below.

• Account & profile information, name, work email, organization, role, and authentication details used to create and secure your account.
• Customer (CRM) data, contacts, companies, deals, activities, forms, documents, and related records that you or your organization choose to store in the Service.
• Communications, the email, text messages, calls, and meetings that members send, receive, or record through the Service, including call recordings, voicemails, and meeting transcripts where those features are used (see Section 5); the comments, direct messages, and reviews people leave on the social media accounts a workspace connects in Socialize, with the person’s name and profile picture (see Section 4); and the signing record (time, IP address, and browser) of each document signed electronically.
• Email engagement, when a Customer sends email through the Service, the delivery, open, click, and unsubscribe events for each message, including the IP address and browser behind an open or a click. We derive an approximate location (country, region, and city) from that IP address using an offline copy of MaxMind’s GeoLite2 database, so no address is sent to MaxMind.
• Payment and investment information, payment card details are collected and held by Stripe, and we never see full card numbers. In the TenthYards investor portal, investors and sponsors provide identity, tax, entity, accreditation, and address details for verification; the tax identification numbers, government ID numbers, and distribution bank details investors enter in their profiles are encrypted before storage, and documents such as tax forms are kept with the workspace’s records. Bank accounts linked for bank (ACH) payments are held by Moov, and we keep only the bank name and the last four digits.
• Information from services you connect, when you connect a Google or Microsoft calendar or mailbox, a Zoom account, an import source, a QuickBooks or Xero company, or social media accounts (see Section 4), we receive the data described there and, except for social media accounts (whose connections our provider Zernio holds), a token or key that lets the Service act on your behalf.
• Usage & device data, log data such as IP address, browser type, pages accessed, and timestamps, used to operate, secure, and improve the Service, and a notification token when you allow notifications in our iPhone, iPad, or Android app.
• Advertising measurement, on our public website and sign-up pages only (never inside the Service, and never on the links our Customers send), we use Google’s advertising tag to learn whether a visit that began with one of our Google ads ended in a sign-up. Google may set a cookie for this. We do not use it to build advertising audiences, it sets no advertising cookies for visitors in the European Economic Area, the United Kingdom, or Switzerland, and you can block these cookies in your browser settings.

• Provide, maintain, and secure the Service and its features.
• Calculate availability, show your upcoming meetings, and create, update, or cancel scheduled meetings on your behalf.
• Sync the mailbox you connect, send the email you write from it, and show messages on the records they concern.
• Send the email, text messages, and calls your organization makes through the Service, and record, transcribe, and summarize calls and meetings where your organization uses those features.
• Process payments and investment funding, and verify identities, tax identification numbers, bank accounts, and addresses when a Customer or sponsor requires it.
• Authenticate you and prevent fraud, abuse, and unauthorized access.
• Communicate with you about your account, security, and service changes.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, we do not use Google user data for advertising, and we do not use Google user data to develop, improve, or train AI or machine-learning models.

The Service can connect to your Google, Microsoft, and Zoom accounts for scheduling (“Meridian”), your mailbox (the Inbox), your Google Contacts, events, and raises, to HubSpot and other sources for imports, to QuickBooks or Xero for Collect, and to social media accounts for Socialize. For each, we ask only for the access that feature needs, store the minimum necessary data, and protect the tokens and keys we store using encryption (see Section 7). Disconnecting a calendar, a mailbox, Google Contacts, the Meridian or Events Zoom app, HubSpot, QuickBooks, or Xero from within the Service deletes the tokens we stored for it; what disconnecting does elsewhere is described below.

Google user data

Everything we receive from Google APIs, through any Google connection this policy describes, is Google user data (signing up and signing in with Google, Google Calendar, a Gmail mailbox, and Google Contacts included), and these commitments cover all of it:

TenthAvenue’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use it only to provide and improve the features described in this policy, which you choose to use.
• We never use it for advertising (including retargeting and personalized or interest-based ads), never sell it, and never use it to develop, improve, or train AI or machine-learning models, generalized or personalized.
• We transfer it only to the service providers in Section 6 as needed to run those features (for example, our AI provider for a prep brief you ask for or turn on), for security, to comply with law, or as part of a merger, acquisition, or sale of assets.
• People at TenthAvenue do not read it unless you ask us to (for example, when you ask our support team to look into something in your workspace, they see what you would see there, except the contents of your email), security requires it (such as investigating abuse), the law requires it, or it has been aggregated and anonymized for our internal operations. Email stays closed to support even then: while our support team is signed in to help your workspace, the Service does not open a member’s Inbox or send from it, and shows them no synced email subjects or previews and no meeting prep briefs.

You can revoke our access to your Google account at any time at myaccount.google.com/permissions.

Sign up and sign in with Google

You can create your account with Google on our website, and sign in with Google afterward. Either way, Google tells us which Google account is in use: when you sign up, we check that answer on our own servers and create your account for that email address, and when you sign in, we sign you in to the account that already uses it. It works with Gmail and Google Workspace addresses, and it asks only for:

• openid, to confirm which Google account is signing up or signing in.
• userinfo.email, your Google account’s email address, which becomes the email of your account with us when you sign up, and must match it when you sign in.
• userinfo.profile, your name and profile picture, which Google sends every time; we keep them with your sign-in record and use them for nothing else.

Signing up or signing in with Google gives us no access to your Gmail, contacts, calendar, or files, and it never replaces two-factor sign-in where your account uses it. An account you create with Google has no password until you choose one; you can set one at any time in Settings, Security, sign in with your email and that password instead, and remove our access at the address above.

Google Calendar

• openid & userinfo.email, to identify which Google account is connected.
• calendar.calendarlist.readonly, to list your calendars so you can choose which ones count toward availability and which one receives bookings.
• calendar.freebusy, to read your busy times so we can offer accurate open slots (this permission returns no event titles or details).
• calendar.events, to create, update, and cancel the meetings booked through the Service, and to read the upcoming events on your primary calendar (titles, times, attendees, and the video-meeting link, which we look for in each event’s meeting details, location, and description) so the Service can show your upcoming meetings and, if you use the meeting notetaker (Section 5), find and join the meetings it covers.

AI features and your data

TenthAvenue CRM offers optional AI features (for example, drafting email and social posts, meeting recaps and prep briefs, suggested next steps, and building forms and dashboards) powered by third-party AI providers: Anthropic (Claude) by default, or Google (Gemini) where a Customer chooses it. Images are generated by Google (Imagen), and call recordings and voicemails are transcribed and summarized by Google (Gemini). Each feature works on the business content in your workspace that it needs. Five features include data from connected services, and only when you use them:

• meeting recaps send the meeting’s transcript together with its title and the names of its invited attendees, which come from your connected Google or Microsoft calendar when the notetaker joined a calendar meeting, plus the names of the host and the workspace’s members so they are spelled correctly;
• meeting prep briefs send the host’s name, the workspace’s name, the email addresses of the people invited, the contact’s record, company, deals and their stage, open tasks, notes, and recent activity, including the subject and a short preview of emails exchanged with that contact through a connected mailbox, and the titles and recaps of earlier meetings with them (a title can come from a connected calendar). A brief on a Meridian booking is shown to the booking’s host and teammates, so it includes only email whose owner shares at least its subject with teammates, never a private thread, and only the recaps whose owners share their summary with teammates. A brief on a meeting from your own connected calendar (its title, time and invited attendees come from that calendar) is shown only to you, so it includes your own email and a teammate’s email only as far as that teammate shares it with teammates (never a private thread, never a teammate’s email kept private), your own recaps and a teammate’s only as far as that teammate shares their summary, and is never shared with your teammates or with TenthAvenue support;
• meeting notes you type after a meeting send your notes with the meeting’s title and the names and email addresses of the contacts on it, which can come from your connected calendar, and come back as a summary, action items, and a follow-up email draft;
• suggested next steps send a record’s recent activity and notes, which can include the subject and a short preview of emails from a connected mailbox (a contact’s email, and the subject and preview of the conversations linked to a deal, each only as far as you can see it) and the titles of meetings from a connected calendar;
• drafting an email with Sam in the composer sends your instruction, the email you are answering (its sender, subject, date and text, read from your own mailbox), your draft when you ask for a rewrite, and the contact’s record, company, deals and their stage, open tasks, recent activity, and the subject and a short preview of recent emails with them, including a teammate’s email only as far as that teammate shares it with teammates (never a private thread). The draft comes back into your composer, and nothing is sent until you press Send.

Prep briefs are written only when you ask for one or turn on automatic prep briefs in Meridian, and a recap or your notes become a note on a contact or a deal, tasks, or a follow-up email only when you click to make them. Nothing the AI writes is sent, saved to your mailbox, or shared without that click.

We do not use data obtained from connected services (Google, Microsoft, or Zoom), including any Google Workspace data, to develop, improve, or train generalized or personalized AI/ML models, and we send Google user data to an AI provider only within the features listed above, to produce their results. Where an AI provider processes the inputs we send, it does so only to return a result for that request and does not train its models on that data.

Sign up and sign in with Microsoft

You can create your account with Microsoft on our website, and sign in with Microsoft afterward, on our website and in our iPhone and Android apps. Either way, Microsoft’s own sign-in page tells us which Microsoft account is in use: when you sign up, we check that answer on our own servers and create your account for that email address, and when you sign in, we sign you in to the account that already uses it. It works with Outlook.com, Hotmail, Live and MSN addresses, and with work or school accounts whose organization verified that email domain, and it asks only for:

• openid, to confirm which Microsoft account is signing up or signing in.
• email, your Microsoft account’s email address, which becomes the email of your account with us when you sign up, and must match it when you sign in.
• profile, your name and Microsoft username, which Microsoft sends every time; we keep them with your sign-in record and use them for nothing else.

With them, Microsoft tells us which directory your account belongs to (the tenant ID, which personal Microsoft accounts share), whether your organization verified your email’s domain, and whether you sign in as a member of that directory or as a guest invited from elsewhere. We use those only to decide whether your address can sign in (a guest account cannot), and keep them with your sign-in record. Signing up or signing in with Microsoft goes through a Microsoft app of its own, separate from the one that connects Outlook, and gives us no access to your mail, calendar, contacts, or files (connecting Outlook, below, is separate), and it never replaces two-factor sign-in where your account uses it. An account you create with Microsoft has no password until you choose one; you can set one at any time in Settings, Security, sign in with your email and that password instead, and remove our access at account.microsoft.com; a work or school account may be managed by your administrator.

Microsoft (Outlook calendar)

• openid, email & offline_access, to identify the connected account and keep the connection active.
• User.Read, to read your basic Microsoft profile and confirm which account is connected.
• Calendars.ReadWrite, to read your busy times; to read your upcoming events (titles, times, attendees, and the video-meeting link, which we look for in each event’s meeting details, location, and description) so the Service can show your upcoming meetings and find the meetings the notetaker covers; and to create, update, and cancel the meetings booked through the Service.

You can revoke Microsoft access from within the Service or from your Microsoft account at account.microsoft.com; work or school accounts may be managed by your administrator.

Mailbox (Inbox)

A member can connect their own Gmail or Outlook mailbox in Settings, under Integrations, to read and send email in the Service. It is a separate connection from the calendar, and each member connects only their own mailbox. It asks for:

• Gmail: openid & userinfo.email, to identify the connected mailbox; and gmail.modify, to read the messages in your mailbox so they sync to the Service, and to act on them only at your direction: send the email you write in the Service from your own address, reply and forward, move to Trash, archive, apply labels, mark read or unread, and save drafts. It cannot delete anything permanently.
• Outlook: openid, email, offline_access & User.Read, to identify the connected mailbox and keep the connection active; Mail.ReadWrite, to read the messages in your inbox and sent mail so they sync to the Service, and to act on them only at your direction: move to Deleted Items, archive, mark read or unread, and save drafts (it is never used to delete a message for good); and Mail.Send, to send the email you write in the Service from your own address. A mailbox connected before the Service asked for Mail.ReadWrite, or one connected with read and send only (for a work account whose administrator has not approved more), has Mail.Read in place of Mail.ReadWrite: it syncs and sends, and changes nothing in your mailbox until you reconnect it.

Before either connection starts, the Service shows you what it reads, why, where it is kept, and who sees it. When you connect Gmail you choose how much of your mail history to bring in, the last 12 months or everything; Outlook brings in the last 30 days; both then bring in new mail as it arrives. For each synced message we store the sender, recipients, subject, a short preview, its labels or folder, whether it is read, and the name, size, and type of each attachment (never the attachment itself), so it appears in your Inbox, which only you can open. We store a message’s body only when someone on it is already a contact in your workspace; any other body is read from your provider when you open the message and is not stored (an Outlook contact message’s body is stored when you first open it). Your Inbox follows your Gmail: a message you delete or move to Trash there leaves it, and archiving and read state follow. You can limit syncing to the folders you choose. When a message is exchanged with someone who is, or later becomes, a contact in your workspace, it is also added to that contact’s activity timeline, and to their company’s. What your teammates see of it there is your choice, in Settings under Integrations: no entry at all (the email still counts toward the last activity date of the contact, their company and the deal, the contact’s engagement temperature and a Relay handoff’s first touch, and a relationship stage it moves is still logged), only that an email happened (its date and the people on it), its subject and a short preview (the default), or the whole message, which teammates can then open from the contact’s Email tab (only email with a contact or a company, never the rest of your mailbox; its files open only for you). Your workspace’s owners and admins can set the default, at most the subject and a short preview (only you can let teammates open your whole emails), and a limit nobody can go above. You can list addresses and domains never to sync: their email is then never stored or logged, and adding one also removes what was already synced. You can make any thread private: teammates then see no entry for it, though its email still counts in those same places. A filter on how many emails a contact has counts a teammate’s email only as far as that teammate shares it: never email they keep private, and never a private thread. You can link one of your conversations to a deal: every email of it in your mailbox, those already synced and those still to come, is then also added to the deal’s timeline and Email tab, with the same choice of what teammates see (a private conversation stays yours alone), until you unlink it. Your Inbox can also list the people you email often who are not contacts yet, built only from your own mailbox and shown only to you: you can dismiss someone for good, or add them as a contact, which puts the email your workspace’s connected mailboxes already synced with them on their timeline, each as far as its owner shares it. A contact's reply in your mailbox to email from your workspace can start and steer your workspace's automations, which may use the reply's subject (only the word “Email” if you share only that an email happened), the sender's address and when it arrived; its body is never used, email you keep private never starts one, and a phone notification about it shows only “A contact replied by email”. From a Gmail mailbox, that subject, address and time only decide whether an automation runs and appear in notices to your workspace's own team in the app; they are held in your workspace's automation queue only until the automation has run (through any wait step it has), and are never saved into a contact, deal, task or note, sent to a webhook, put in a text message or given to an AI step. From an Outlook mailbox, an automation may also save them into a record or include them in a webhook or a text message your workspace sets up.

When you write an email in the Service, it is sent through your connected mailbox from your own address and lands in your Sent folder. For Gmail, we read your Gmail send-as addresses and their signatures (Gmail settings the gmail.modify permission covers) so you can choose the From address and include its signature. Of those settings we keep only the addresses, so mail you send from them counts as yours, and we read the signatures from Gmail again each time you write. Your TenthAvenue signature, which you set in Settings under Integrations, is kept with your membership in that workspace, and only you can change it (a workspace admin cannot). A signature you include becomes part of that email: it is sent with it, and it is kept as part of the email's words wherever we keep them: with a scheduled email until it goes out, with a batch email for as long as the batch is kept, in the copy of the sent email we keep from your mailbox when someone on it is already a contact (as for any synced message), and on the timeline when it falls within the first 2,000 characters kept there. Files you attach are sent with the email and never stored by us. The email is added to the activity timeline of the contacts it is addressed to (To and Cc, never Bcc) and of their company, with its subject and the first 2,000 characters of what you wrote.

After a meeting, you can save its follow-up email draft to your Gmail or Outlook Drafts: when you click “Save to Gmail drafts”, the Service creates that one draft in your Gmail (the gmail.modify permission covers it) and sends nothing, and “Save to Outlook drafts” does the same in your Outlook (the Mail.ReadWrite permission covers it); you edit and send it from your mailbox. The Service never saves a draft on its own. An Outlook mailbox connected with read and send only cannot save drafts through the Service; its follow-ups open in the Service’s email composer instead and send from your address when you send them.

From your Inbox you can reply, reply all, or forward. The answer goes out through your connected mailbox from your own address, stays in the same conversation, and quotes the original below what you write; the original is read from your provider when you answer and is not kept with your draft, and the timeline keeps only your own words, never the message you are answering. A Gmail forward reads the original’s attachments from Gmail when it sends and never stores them; an Outlook forward carries them within Microsoft. At your direction you can also move a message to Trash (Deleted Items in Outlook) and undo that, archive it, move an archived Gmail message back to your Inbox, or mark a message read or unread; each change is made in your mailbox at once, and opening an unread message in the Service marks it read, as Gmail and Outlook do. An Outlook message you archive or move to Deleted Items leaves the Service’s Inbox, which shows your Outlook Inbox and Sent Items, and the timeline entries it added stay. An Outlook mailbox connected with read and send only gets these once you reconnect it. An attachment is read from your provider only when you open it and is handed straight to you; we never store it. “Remove from TenthAvenue” takes a message out of the Service only: its synced copy and the timeline entries your mailbox added for it are deleted, your mailbox keeps it untouched, and we keep only its message id from your provider so it is not synced again (disconnecting the mailbox deletes that too). Outlook gives a message a new id when it moves to another folder, so an Outlook message you move to a folder you sync comes back.

You can also send one email to up to 50 of your contacts at a time from your connected mailbox (a batch email). Each person gets their own email from your own address, with their own details filled in, sent a few seconds apart, and nobody sees who else it went to. To protect your mailbox, the Service sends at most 300 emails in any 24 hours from a personal Gmail or Outlook address and at most 1,000 from a Google Workspace or Microsoft 365 address, counting every email it sent from that mailbox, and it refuses a batch larger than what is left. Before a batch goes out, and again right before each email, it leaves out anyone who unsubscribed or opted out of your workspace's email, whose email bounced, or who has no valid address. By default each email ends with an unsubscribe line (your workspace's postal address and a link of that person's own) and carries the headers that let mail programs show an unsubscribe button; someone who unsubscribes is recorded in your workspace's consent records and left out of later batches and campaigns. You can turn the line off for a batch, and that choice is recorded with it. You can also schedule an email to send later. It waits in the Service (its recipients, subject and body as you wrote them, with the signature you included, never files) until its time, then goes out from your mailbox exactly as an email you send yourself, and we delete our copy once it has gone. Until then you can change it, send it now or cancel it; one that could not be sent stays, with the reason, until you send it, change it or cancel it. Disconnecting your mailbox, leaving the workspace or deleting your account cancels and deletes whatever is waiting. Email templates you save (a name, a subject and a body) are kept in your workspace until you delete them: your own only you can see, and a template your workspace shares every member can insert. We keep each batch (its subject and body as you wrote them, with the signature you included, who it went to and the details filled in for each person, and what happened to each email) so you can see its report, which only you can open, until you disconnect the mailbox. When new mail in a batch email's conversation is a reply, the report marks it and we tell you; when it is a delivery failure notice, the report marks the address bounced and it is suppressed the way a campaign bounce is. Each email is added to the timeline of the contact it went to, like any email you send. Disconnecting the mailbox deletes your batches; the count of emails sent, which holds no mail, is kept for the daily limit.

Disconnecting the mailbox deletes the synced copies and the stored tokens, and for Gmail we also ask Google to withdraw our access, unless a Google Contacts sync uses the same Google account (Google withdraws a whole connection at once); our access then goes once no Contacts sync uses it. Removing a member from a workspace does the same for that member’s mailbox there, and deleting your account does it for every mailbox you connected. Timeline entries already added stay with your workspace’s records. Microsoft offers no way for an app to withdraw its own access to one mailbox, so to remove the Outlook permission itself, visit your Microsoft account (a work account may be managed by your administrator). Gmail data is handled under the Google API Services User Data Policy, including the Limited Use requirements described above; we hold Outlook mail to the same rules. People at TenthAvenue do not read your email except as those rules allow, and our support team cannot open your Inbox or see your email’s subjects, previews or prep briefs, even while signed in to help your workspace.

Google Contacts

A member can sync their own Google Contacts with the Service in Settings, under Integrations. It is a separate step from the mailbox, on the same Google app our Gmail mailbox connection uses, and each member syncs only their own Google account. It asks for:

• openid & userinfo.email, to identify the Google account; contacts, to read the contacts in your Google Contacts, and to create contacts inside a “TenthAvenue” label there and keep only those up to date; and contacts.other.readonly, to read the “Other contacts” Gmail saves for people you have emailed, only if you choose to bring them in.

Before the sync starts, the Service shows you what it reads, what it writes, and who sees it. We read each contact’s name, email addresses, phone numbers, company, job title, and address. A contact who is already in your workspace is matched by email, or by phone number only when the name matches too; anyone else becomes a new contact in your workspace, which your teammates can see like any other contact. The sync never removes or empties anything in your workspace: email addresses and phone numbers are only added, and empty details filled in. Only on a contact you own does a detail you change in Google replace the one in the Service; a teammate’s contact only gets its empty details filled in.

We write only to the contacts TenthAvenue itself creates in your Google Contacts, inside a “TenthAvenue” label: each contact you own in the Service that your Google Contacts does not already have is created there with its name, email addresses, phone numbers, company, title, and address, never your notes, and afterwards only the details you change in the Service are updated on it, keeping every other detail, label, and type you add in Google. A contact you already had in Google is only read, never written. Each contact TenthAvenue creates is marked with its workspace, so a Google account connected in two workspaces never brings one workspace’s contacts into the other. Your workspace’s owners or admins can turn writing to Google off. We never delete a Google contact, and deleting a contact on either side only stops syncing it.

Stopping the sync deletes its stored tokens and links; the contacts it added stay with your workspace’s records. We ask Google to withdraw our access unless a Gmail mailbox connection or another Contacts sync uses the same Google account, because Google withdraws a whole connection at once. Removing a member from a workspace, and deleting your account, stop their syncs the same way. Our support team cannot connect, sync, or disconnect your Google account.

Zoom (Meridian scheduling app)

• user:read:user, to read your Zoom account’s name, email, and user ID so we can identify the connected account.
• meeting:write:meeting, to create the Zoom meetings booked through the Service, and, where your connection includes them, meeting:update:meeting and meeting:delete:meeting, to update and cancel those meetings.

Zoom (TenthAvenue Events app)

A separate Zoom app powers the Events module. It requests granular scopes that map one-to-one to its features:

• user:read:user, to identify the connected account (name, email, plan type).
• Meeting and webinar read, read:list, write, update, and delete scopes, to create events with registration enabled, list and link ones you already created, edit them in place, and delete them only when you choose that while cancelling.
• Registrant scopes (write:registrant, read:list_registrants, update:registrant_status for meetings and webinars), to register the people who submit your registration forms so each receives their personal join link, to keep your roster in sync, and to apply your approve or cancel decisions.
• Panelist scopes (webinar:write:panelist, webinar:read:list_panelists, webinar:delete:panelist), to add webinar presenters, show each presenter’s personal link, and remove presenters.
• Past-event report scopes (read:list_past_participants for meetings and webinars, webinar:read:list_absentees), to mark who attended versus missed on your roster after an event ends.

Through the Events app we store event details, registrant names, emails, personal join links, and registration statuses as part of your workspace’s CRM records. The Events app never reads meeting content, recordings, or chat from Zoom, and never stores host start links or ZAK tokens. The meeting notetaker (Section 5) is separate: it joins a meeting only as a visible participant.

You can disconnect Zoom from within the Service or by removing the app from your Zoom account’s Added Apps page at marketplace.zoom.us. When you remove the app, Zoom notifies us and we delete the stored tokens and associated data for that connection.

Zoom (TenthYards raise app)

If you connect Zoom from a raise in TenthYards, a third Zoom app asks for meeting:write:meeting, meeting:read:meeting, meeting:read:list_meetings, webinar:read:webinar, webinar:read:list_webinars, webinar:write:webinar, and user:read:user, to identify the connected account, list your upcoming meetings and webinars, and create a meeting for the raise. Removing the app from your Zoom account’s Added Apps page ends its access; its stored tokens are deleted as Section 7 describes.

Imports and social media accounts

When you import from HubSpot, Mailchimp, MailerLite, or Pipedrive, you connect that account by signing in (HubSpot) or with an API key or access token you provide, and we read the records you choose to import and store them in your workspace. A key or token you provide is kept, encrypted, only until that import finishes, fails, or is canceled. A HubSpot sign-in is kept until an owner or admin disconnects HubSpot in Settings, under Integrations, which deletes it.

QuickBooks and Xero (Collect)

An owner or admin can connect a QuickBooks Online or Xero company in Collect’s settings. We then send it your Collect customers (name and email), invoices with their lines, and payments, and, if you switch it on, the total, date, and period of each TenthYards distribution (never the investors in it), posted to the accounts you choose. Disconnecting deletes the stored tokens and keeps the account choices, so reconnecting the same company picks them up again.

If your workspace uses Socialize, you connect LinkedIn, Facebook, Instagram, Google Business Profile, TikTok, YouTube, and advertising accounts through our provider Zernio, which holds those connections. We send the posts, pictures, and videos you publish, and we receive the accounts’ names, the results of your posts and ads, and the leads people submit through your Facebook lead forms.

Socialize also stores the comments people leave on your posts, the direct messages people send your Instagram account and Facebook Page, and the reviews people leave on your Google Business Profile locations, each with the person’s name, profile picture, and words (and, for a comment or a message, their username and links to any attachments). Your team reads and answers them in the Socialize inbox, and can link the person behind a comment or a message to a contact: that person’s comments and messages then appear on the contact’s record and count toward the contact’s engagement score. Disconnecting an account in Socialize disconnects it at Zernio too.

A member of your workspace can also connect social media accounts of their own in Socialize (a personal LinkedIn profile, an Instagram account, or a Facebook Page they manage). Only that member posts and answers from them, and they choose who in your workspace sees those accounts’ posts, results, comments, messages, and leads: only themselves, themselves and your admins (the default), or everyone in your workspace. Your admins always see which accounts members have connected, because each one counts toward your plan. A lead that reaches a member’s own Page becomes a contact only when that member adds it, unless they share their own accounts with everyone in your workspace.

If your workspace turns on conversion reporting, we send the ad network (Meta, LinkedIn, Google Ads, or TikTok) the bookings, payments, and won deals of people one of your ads brought in, identified by email address and phone number (and, for Meta, name), which are hashed before the network receives them, together with the ad’s click or lead identifier (TikTok receives no click identifier) and the value. If a payment we reported to Google Ads is later refunded, we tell Google Ads the corrected amount. People your workspace withholds from ad networks are never sent.

If an owner or admin of your workspace turns on audiences and accepts their terms, we send Meta a list made from your contacts (a contact list or a saved view of your contacts), identified by email address and phone number, which pass through a service provider (Section 6) that hashes them before Meta receives them, so your ads can reach those people. People your workspace withholds from ad networks, people marked do not contact, and your current customers are always left out. The list is kept up to date every day, and anyone who leaves it, or is withheld later, is taken back out (Meta applies a removal shortly after it is sent). We keep a hashed form of each person sent, and an encrypted copy used only to take them back out of the list, which we delete once they are out: for a contact you delete, normally within minutes, and at the latest when the audience is deleted. An audience is deleted from Meta when your workspace or its ads connection is removed, where Meta can still be reached. Meta keeps an audience while a lookalike audience made from it in Meta Ads Manager exists.

Meeting notetaker. When a member sends the notetaker to a meeting, or turns it on for the meetings on their calendar and the events they run, our provider Recall.ai joins the video meeting (Zoom, Google Meet, or Microsoft Teams) as a participant named for the workspace, posts a message in the meeting chat saying the meeting is being recorded, and records and transcribes the audio. We store the transcript in our own storage, and our AI provider writes a recap and a draft follow-up email from it (see Section 4). The meeting is added to the timelines of attendees who are contacts in the workspace, and the recording and transcript files at Recall.ai are then deleted. The member who sent the notetaker gets its notes by email, unless they turn that off, along with any teammates they pick whose access lets them read the summary. That member also chooses who in the workspace sees its notes: only that the meeting happened, also its summary (the default), or also its transcript, up to a limit the workspace’s owners and admins set, and can keep any one meeting to themselves; the timeline entry carries the summary only while it is shared. A calendar meeting whose title contains [no notes], [no bot], or [no ai] is never joined automatically.

Calls and voicemail. Calls made and received in Ping are carried by our provider Telnyx. Call recording is off until an owner or admin turns it on, either for every call (callers then hear, by default, that the call may be recorded) or for the calls a member chooses to record. Your organization is responsible for any notice or consent the law requires before a call is recorded. Voicemails are recorded whenever a caller leaves one. We copy each recording from Telnyx into our own storage and delete Telnyx’s copy, and Google (Gemini) transcribes it and writes a short summary that is added to the call’s timeline entry.

Text messages. Text messages your workspace sends and receives in Ping are carried by Telnyx and stored with your workspace’s conversations.

Transcripts, recordings, summaries, and messages are part of your workspace’s records and are kept as described in Section 7.

We share information only as needed to run the Service:

• Service providers (subprocessors), the companies listed below, which operate parts of the Service on our behalf and are bound by confidentiality and data-protection obligations.
• Services your workspace directs us to, such as the social networks and ad accounts it connects and its QuickBooks or Xero company (Section 4), and the webhook addresses its automations send to.
• Advertising measurement, Google receives the page address, the referring site, and ad-click details for visits to our public website and sign-up pages, as described in Section 2.
• Within your organization, Customer data is accessible to authorized members of the same organization account.
• Verification marks, when a person proves their email address or a phone number, has their tax identification number matched with the tax authority, or has their identity verified, every workspace whose contacts include their email address sees those marks on its own record of them, each with a date. Only the marks travel: no workspace receives the person’s phone number, tax identification number, or documents from another workspace this way.
• Workspaces you invest with or sign documents for, if you sign in with a text-message code (as a workspace member or as an investor in a TenthYards investor portal), each workspace you invest with or sign a document for through the Service sees the number you sign in with on its contact record of you, read-only, or as a confirmation of the number it already has when it is the same one. No other workspace is shown that number or told whether a number it holds matches it, and turning text-message codes off or deleting your account removes it from each contact record it was added to.
• Legal & safety, where required by law, or to protect the rights, property, or safety of users and the public.
• Business transfers, in connection with a merger, acquisition, or sale of assets, subject to this policy.

Our service providers

• Google Cloud, application hosting, in the United States.
• Supabase, our database, sign-in, and file storage, in the United States.
• Cloudflare, the network edge and security filtering in front of the Service, and the bot checks on sign-up, password reset, and public forms.
• Postmark, account email such as sign-in codes, confirmations, and invitations.
• Resend, the email Customers send from their own domains, including campaigns, and the delivery, open, and click events for it.
• Stripe, subscription and credit billing, and the payments Customers collect through Collect and paid bookings.
• Moov Financial, bank (ACH) payments and distributions for TenthYards offerings, and the verification of issuers and the people who control them.
• Telnyx, text messages, calls, phone verification codes, and the carrier registration of Customers’ texting campaigns.
• Recall.ai, the meeting notetaker (Section 5).
• Anthropic, AI features (Section 4).
• Google, AI features, image generation, and call transcription (Gemini and Imagen), address suggestions as you type (Google Maps), the web fonts our pages load, advertising measurement on our public website, and notifications delivered to our Android app (Firebase Cloud Messaging).
• Zernio, the social media and advertising accounts Customers connect in Socialize, and the posts, results, leads, comments, direct messages, reviews, and audience lists that pass through them.
• QubitOn, identity, tax identification number, address, bank account, business, and sanctions checks on TenthYards investors and their investing entities.
• Apple, notifications delivered to our iPhone and iPad app.
• Bunny.net, delivery of our training videos.

Data we receive from connected services (Google, Microsoft, and Zoom) is never transferred to third parties except to the providers above as necessary to provide the features you use (for example, sending a meeting’s link and its invited attendees’ names to Recall.ai when the notetaker joins it), for security, or to comply with law, and Google user data is handled consistent with the Limited Use requirements above.

• Data is encrypted in transit (TLS) and at rest.
• Tokens and keys for connected accounts are encrypted application-side before storage using AES-256-GCM, as are the tax identification numbers, government ID numbers, and distribution bank details investors enter in their profiles.
• Access is restricted to authorized personnel and scoped by organization through row-level security.
• Our application and database run in the United States.
• We retain account and Customer data for as long as your account is active. The tokens we store for a connected account are deleted when you disconnect it as Section 4 describes; a member’s calendar, mailbox, and Zoom tokens are also deleted when that member’s login is deleted, and every token and key we store for a workspace when the workspace is deleted. Synced mailbox messages are deleted, and our access to a Gmail mailbox withdrawn at Google (unless a Google Contacts sync still uses that Google account), when you disconnect the mailbox, when you are removed from the workspace, when you delete your account, or when the workspace is deleted.
• Meeting recordings and transcripts are deleted from Recall.ai, and call recordings from Telnyx, once they are copied to our storage.

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Account holders can update much of their information in the Service directly. To make a request or to ask us to delete data we hold about you, contact us at privacy@tenthavenue.io. If your data is managed by a Customer organization, we will refer your request to that organization.

To delete your TenthAvenue account, follow the steps on Delete your account, which also says what is deleted and what is kept.

The Service is operated from the United States, and your information may be processed in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers.

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.

Questions about this policy or our data practices? Email privacy@tenthavenue.io.