Privacy Policy

Last updated: July 29, 2026.

This Privacy Policy explains the data collection, use, disclosure, retention, and protection practices of Goxee Corp for Goxee websites, subscription and password-protected services, the Goxee CRM, and related mobile application services where this policy is displayed (collectively, the "Services"). By accessing or using the Services, you acknowledge the practices described in this policy.

Information we collect and how we use it
We collect information that you or your organization provides to us, including account and profile information, employer or dealership information, contact information, CRM customer and lead information, communications, uploaded content, and support requests. We use this information to provide, secure, maintain, support, and improve the Services; authenticate users; apply dealership and user permissions; process user-requested communications; prevent fraud and abuse; and comply with applicable legal obligations.

We also collect service usage, device, browser, cookie, log, and diagnostic information. This may include IP address, browser type and language, pages or features used, request details, and the date and time of activity. We use this information to operate and secure the Services, remember preferences, diagnose problems, and understand service performance.

Google API Services and Gmail data
Goxee allows an authorized user to connect a Gmail or Google Workspace mailbox to the Goxee CRM using Google OAuth. Connecting a mailbox is optional and requires the Google account holder's authorization.

When a user connects Google, Goxee may receive the user's primary Google Account email address and Google account identifier, OAuth authorization and refresh tokens, and the Gmail data authorized by the user. For the current Gmail CRM functionality, this data may include message and thread identifiers, sender and recipient headers, subject lines, timestamps, labels, message bodies, snippets, and related message content needed to send email, synchronize replies, match messages to CRM customers or conversations, and display those conversations to authorized users.

Goxee uses the gmail.send permission only to send messages that an authorized user initiates through the CRM. Goxee uses the gmail.readonly permission to read and synchronize mailbox messages so customer replies and email threads can be matched to and displayed in the CRM. Read-only access is not used to modify or delete messages in the connected Gmail mailbox.

Google user data is used only to provide and improve these visible, user-facing email and CRM features; maintain security; provide support requested by the user; and comply with applicable law. Goxee does not sell Google user data, use it for targeted advertising, transfer it to data brokers, or use it to train generalized artificial intelligence or machine-learning models.

Goxee's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing and access to Google user data
Connected Gmail data is available only to authenticated users who have been granted access to the applicable mailbox and dealership within Goxee. A mailbox owner or authorized administrator may grant or remove access for other dealership users. Goxee may disclose data to service providers that process it on our behalf as necessary to host, secure, maintain, or support the Services, subject to appropriate confidentiality and security obligations. We may also disclose information when required by law, to protect users or the Services, or as part of a corporate transaction subject to applicable safeguards. We do not allow these parties to use Google user data for their own advertising or unrelated purposes.

Goxee personnel do not access Gmail message content except when necessary to provide user-requested support, investigate a security or abuse incident, comply with applicable law, or maintain the Services where access is strictly necessary. Access is limited to authorized personnel and is subject to confidentiality and security controls.

Security
We use administrative, technical, and organizational safeguards designed to protect personal and Google user data against unauthorized access, alteration, disclosure, or destruction. Google OAuth tokens are encrypted when stored by Goxee, and access to connected mailbox data is controlled by authenticated user and dealership permissions. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Data retention
We retain personal data only for as long as needed to provide the Services and for legitimate business, security, or legal purposes. In general:
- Account and profile data is retained while the account is active.
- Connected Gmail authorization data and synchronized CRM email data are retained while needed to provide the Gmail CRM feature or until an eligible deletion request is completed.
- Disconnecting a mailbox stops future authorized Gmail access but does not automatically remove CRM records that were previously synchronized.
- Eligible account and Gmail data is deleted or anonymized within 30 days after we verify and complete a deletion request.
- Security and fraud-prevention logs may be retained for up to 12 months.
- Backup archives may retain limited copies for up to 90 days before automatic overwrite.
- Records required for tax, accounting, dispute resolution, security, or other legal obligations may be retained for up to 7 years or for the period required by law.

Disconnecting Google and requesting deletion
You may disconnect a mailbox using the Gmail settings available in Goxee. You may also revoke Goxee's Google access from your Google Account permissions. Revoking or disconnecting access prevents future access to the mailbox but does not by itself delete data previously synchronized into the CRM.

To request deletion of your account, connected Gmail data, OAuth credentials, or other eligible personal data, email privacypolicy@goxee.com from the email address associated with your account. Please identify the Goxee account, dealership, and connected mailbox involved. After verifying the request and the requester's authority, we will delete or anonymize eligible data within 30 days, except for limited information that must be retained for legal, security, fraud-prevention, backup, or compliance purposes described above.

Third-party sites and services
The Services may contain links to third-party websites or integrations. Those third parties maintain their own privacy practices, and this policy does not govern information you provide directly to them outside the Goxee Services.

Changes and contact information
We may update this Privacy Policy periodically. When we do, we will publish the revised date at the top of this page. For questions about our collection, use, sharing, retention, or deletion practices, contact privacypolicy@goxee.com.