Origen Agency CRM | Legal

Privacy policy

Last updated: 27 October 2026

At Origen Agency («we», «our») we take seriously the privacy of the personal data we process when providing our B2B lead generation services and our CRM. This policy describes how we collect, use, store and protect information when you use Origen Agency CRM, the platform hosted at app.origensales.com, including its booking and calendar connection pages, and the origensales.com website.

1. Data we collect

1.1 Data you provide to us

Name, corporate email, phone and company when you register or contact us.
B2B lead information that you enter or import into the CRM (name, email, company, sector, website, notes).
Content that you write in email templates, internal notes and campaigns.

1.2 Data we obtain when connecting Google

If you authorize the integration with your Google account, we access:

Google Calendar to check your availability (only whether a time slot is busy or free) and to create, modify and cancel the events of meetings scheduled through the CRM. We do not read the content of your other events (scopes: calendar.events, calendar.events.freebusy).
Gmail exclusively to send scheduled emails from the CRM as if they were yours (scope: gmail.send). We do not read, store or access other emails in your inbox.
Basic email, name and profile picture (scopes: openid email profile).

1.3 Data we obtain when connecting Microsoft (Outlook)

If you authorize the integration with your Microsoft account, we access:

Your Outlook calendar, to check your availability and to create, modify and cancel the events of meetings scheduled through the CRM, with their Microsoft Teams link (permissions: Calendars.ReadWrite, OnlineMeetings.ReadWrite).
Basic email, name and profile picture, and keeping the connection active without asking you again (permissions: openid, email, profile, User.Read, offline_access).

We do not request access to your Outlook mail: we do not read, send or store emails from your Microsoft account.

1.4 Technical data

Usage logs (action timestamps, errors) for diagnostics.
IP address and user-agent for security.

2. How we use the data

To provide the CRM service and all of its features.
To schedule meetings in your calendar and send confirmation, reminder and follow-up emails to your leads.
To generate the client's internal reports and statistics.
To communicate important service changes, technical support and news to you (you can unsubscribe at any time).

3. Limited Use: Google API Services

Origen Agency CRM's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We do not sell the data obtained from Google APIs.
We do not use the data to serve advertisements.
We do not share it with third parties beyond what is strictly necessary to operate the service (providers listed below).
It is not read by humans except: a) with your express consent, b) for security, c) to comply with applicable law, or d) when the data is anonymized and aggregated to improve the service.
We do not use data obtained from Google APIs to develop, improve or train generalized artificial intelligence or machine learning models, and we do not send it to third-party AI tools.

Origen Agency's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What Google data we store and how we protect it. We only store what is strictly necessary for the integration to work:

Your Google access tokens, encrypted at rest and in transit, so we can act on your calendar and send the emails you schedule.
The email address of the connected Google account.
The identifier, date and time of the events created by the CRM, so they can be changed or cancelled.

We do not store the content of your other events or any email from your inbox. When you disconnect your calendar from the CRM, we delete the stored tokens.

4. Storage and providers

The data is stored in secure infrastructure, encrypted at rest and in transit:

Supabase (Frankfurt, EU): PostgreSQL database and authentication.
Resend: email delivery provider (fallback when you do not use your own Gmail).
Anthropic Claude API: AI processing when you use features such as «Personalize with AI». The content sent to Claude is not used for training. We never send data obtained from Google APIs (calendar or Gmail) to Claude.

5. Security and protection of sensitive data

We treat as sensitive data the Google access tokens, the email address of the connected Google account, the content of the emails you schedule and your leads' contact details. We protect them with these measures:

Encryption in transit: all communication between your browser, the CRM, our database and Google APIs is encrypted with HTTPS (TLS).
Encryption at rest: the database and its backups are encrypted with AES-256 on Supabase servers in Frankfurt (European Union).
Google and Microsoft tokens stay on the server: tokens are stored in the server database and are only used by our server functions to send the emails you schedule and to manage your meeting events. The CRM application never requests or displays them.
Access control: each user signs in with their own credentials and passwords are stored hashed, never in plain text. Row-level security policies in the database ensure that each user can only access their own account's data; within Origen, only the authorised staff who manage your account can access it.
Least privilege: from Gmail we only request permission to send emails (gmail.send). We cannot read your inbox and we do not store any email from your Google account. From Google Calendar we only check whether a time slot is free or busy and manage the events created by the CRM.
No secondary use: data obtained from Google APIs is not sold, not used for advertising, not sent to artificial intelligence services and not shared with third parties.
Deletion: when you disconnect Google or Microsoft from the CRM or delete your account, we delete the stored tokens.
Security incidents: if a breach affecting your data ever occurred, we would notify you and the supervisory authority within 72 hours, as required by the GDPR.

6. Retention and deletion

We retain your data for as long as your account is active. When you request the deletion of your account:

We delete all of your personal data and that of the leads you imported.
We revoke the Google and Microsoft OAuth tokens associated with your account.
Anonymized logs may be retained for up to 90 days for security auditing.

You can request deletion by writing to us at d.garcia@origenagency.com.

7. Revoking Google and Microsoft access

You can revoke Origen Agency CRM's access to your Google account at any time from myaccount.google.com/permissions. When you do so, we will no longer be able to create events in your calendar or send emails on your behalf.

You can revoke access to your Microsoft account from the CRM itself (Disconnect) or at account.live.com/consent/Manage (personal accounts) and myapps.microsoft.com (work accounts).

8. Your rights (GDPR)

As a user in the EEA you have the right to:

Access the data we hold about you.
Rectify incorrect data.
Request erasure («right to be forgotten»).
Portability of your data in a structured format.
Object to the processing.
Lodge a complaint with the Spanish Data Protection Agency (aepd.es).

9. Cookies

We use strictly necessary cookies to keep your session logged in. We do not use advertising tracking cookies.

10. Third-party links

Our website may contain links to other sites. Once you leave our website we have no control over the destination. Those sites have their own policies, and we recommend that you review them.

11. Changes to this policy

We may update this policy. If there are substantial changes, we will notify you by email at least 30 days in advance. The current version will always be at this URL.

12. Contact

For any privacy inquiries: