Privacy Policy

Last updated: September 7, 2026

1. Introduction

This Privacy Policy explains how Octaave ("Octaave", "we", "us", or "our") collects, uses, stores, and shares personal information when you use our website and application. Octaave is a CRM built to help beatmakers and music creators track outreach, contacts, and follow-ups.

We are based in France and process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable French law. This notice is written in English for our international users.

2. Data controller

The data controller responsible for your personal data is Jeremy Deveney.

Contact: jdeveney.pro@gmail.com

3. Data we collect

Depending on how you use Octaave, we may process:

Account and profile data — such as your name, email address, and profile details associated with your sign-in (for example via Google authentication).
CRM data you add or import — contacts, notes, tags, lists, templates, ideas, and related outreach information you store in Octaave.
Google user data — if you connect Google, we access only the data needed for the features you enable, within the scopes you authorize:
- Google account identity — your Google email address and basic profile information used to authenticate you and associate the connection with your Octaave account.
- Gmail (read-only) — message metadata needed to match emails to your CRM contacts, including From/To/Cc/Bcc headers, subject, date, Gmail message and thread IDs, and a short snippet. We do not request send, modify, or delete access, and we do not store full email bodies.
- Google Contacts — names, email addresses, and related contact fields so we can import contacts into Octaave and, when you add or update a contact in Octaave, optionally write that contact back to Google Contacts.
Usage and technical data — such as device/browser information, IP address, approximate location derived from IP, log data, and how you interact with the service, to operate, secure, and improve Octaave.
Communications — messages you send us (for example support requests).

4. Purposes of processing

We use personal data to:

Provide, maintain, and improve the Octaave service
Authenticate you and manage your account
Sync and organize outreach-related contacts and email context you choose to connect
Respond to support requests and communicate about the service
Monitor security, prevent abuse, and troubleshoot issues
Comply with legal obligations

5. Legal bases (GDPR)

Where GDPR applies, we rely on one or more of the following bases:

Performance of a contract — to provide Octaave when you create an account and use the service
Legitimate interests — such as securing the service, preventing fraud/abuse, and improving product quality, balanced against your rights
Consent — where required (for example certain optional integrations or non-essential cookies), which you may withdraw at any time
Legal obligation — when we must retain or disclose data to comply with applicable law

6. Sharing, transfer, and disclosure of Google user data

We do not sell, rent, or trade Google user data. We do not transfer or disclose Google user data to third parties for purposes other than providing and improving Octaave's user-facing features, except as described below.

We share Google user data only with the following parties:

Google LLC — to authenticate your account, obtain and refresh OAuth tokens, and call the Gmail API and People API according to the permissions you grant. Google processes this data under its own terms and privacy policy.
Supabase, Inc. — our authentication and database provider. We store OAuth tokens, your Google account email, synced contact details, and Gmail message metadata (headers, subject, snippet, and identifiers) associated with your CRM contacts on infrastructure operated by Supabase.
Vercel Inc. — our application hosting and compute provider. Requests to Google APIs and processing of Google user data needed to run Octaave occur on servers hosted by Vercel.

These providers process Google user data only as needed to operate Octaave on our behalf, under contractual safeguards, and not for their own independent purposes such as advertising.

We may also disclose Google user data if:

Required by law, regulation, legal process, or governmental request
Necessary to protect the rights, safety, or security of Octaave, our users, or others
You give us explicit consent to do so

We do not use Google user data for advertising, retargeting, or data brokerage. We do not use Google user data, including Gmail or Contacts data, to develop, improve, or train generalized or non-personalized AI or machine-learning models. Use of Google user data is limited to providing or improving user-facing features of Octaave, in accordance with Google's API Services User Data Policy, including the Limited Use requirements.

7. Service providers

In addition to the Google-data recipients listed above, we use trusted third-party providers to operate Octaave (for example hosting, authentication, and databases). These providers process data only as needed to perform services on our behalf and under appropriate contractual safeguards.

8. Data protection and security mechanisms for sensitive data

Security procedures are in place to protect the confidentiality of your data, including Google user data such as Gmail metadata, Google Contacts, and OAuth tokens. We use encryption and access controls to protect this information.

Encryption in transit — all traffic between your browser, our application, Google APIs, and our database is protected with HTTPS/TLS.
Encryption at rest — Google user data stored in our database (including OAuth tokens and Gmail metadata) is encrypted at rest by our infrastructure providers.
Access control — OAuth tokens are stored in a restricted table accessible only through our server-side service role, not from the client. Application data is isolated per account with row-level security so you can access only your own records.
Least privilege — we request only the Google scopes required for the product: Gmail read-only and Google Contacts. Gmail sync uses metadata (not full message bodies).
Human access — we do not read your Gmail or Contacts data except as needed to operate, secure, or troubleshoot the service, to comply with law, or with your request and consent.
Revocation and deletion — you can disconnect Google in Octaave and revoke access in your Google Account permissions. Disconnecting deletes stored Google tokens. You may request deletion of remaining personal data as described in the retention and rights sections below.

9. Retention

We retain personal data for as long as your account is active and as needed to provide the service. After account deletion or upon request, we delete or anonymize personal data within a reasonable period, unless we must retain it longer for legal, security, or dispute-resolution reasons.

10. International transfers

Octaave is offered internationally. Your data may be processed in countries other than your country of residence, including outside the European Economic Area (EEA). Where required, we use appropriate safeguards (such as Standard Contractual Clauses) or rely on other lawful transfer mechanisms.

11. Your rights

Subject to applicable law (including GDPR), you may have the right to:

Access your personal data
Rectify inaccurate data
Request erasure
Restrict or object to certain processing
Receive a portable copy of data you provided
Withdraw consent where processing is based on consent
Lodge a complaint with a supervisory authority (in France, the CNIL —www.cnil.fr)

To exercise these rights, email jdeveney.pro@gmail.com. We may need to verify your identity before responding.

12. Cookies and similar technologies

We use cookies and similar technologies that are necessary to operate the service (for example authentication/session). We may also use technologies that help us understand usage and improve Octaave. You can control cookies through your browser settings; disabling some cookies may affect how the service works.

13. Children's privacy

Octaave is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Continued use of Octaave after changes become effective constitutes acceptance of the updated policy, except where applicable law requires additional notice or consent.

15. Contact

Questions about privacy or this policy: jdeveney.pro@gmail.com