Privacy policy

Zeylix PMT is an internal work-management tool operated by Zeylix for its own staff. It is not a public service and accounts are created by an administrator; there is no public sign-up. This page explains what the application stores and why.

Who this covers

People who have been given a Zeylix PMT account by a Zeylix administrator. If you do not have an account, this application holds no data about you.

What we store

• Your account — name, work email address, job designation, role, avatar image and notification preference.
• Your work — projects, tasks, comments, documents, meetings, work logs and file attachments that you or your colleagues create in the application.
• An audit trail — a record of inserts, updates and deletes, written by the database itself, showing who changed what and when. It is readable only by administrators.

All of it is held in a Supabase-hosted PostgreSQL database. Access is enforced in the database with row-level security, so the rules apply to every route into the data rather than to the user interface alone.

Google account data

Connecting Google Calendar is optional. Meetings work without it; connecting simply keeps them in step with your own calendar. If you choose to connect, Zeylix PMT requests these scopes and no others:

• openid and email — to identify which Google account you connected, so the application can show it back to you and refresh access.
• https://www.googleapis.com/auth/calendar.events — to create, update and delete the calendar events for meetings you schedule in Zeylix PMT.

The narrower calendar.events scope is used deliberately in place of the broader calendar scope, because the broader one would also grant control over sharing and permissions on every calendar you can access. Zeylix PMT does not need that and does not ask for it. It does not read your existing calendar entries, and it only touches events it created.

What is stored: the Google account email address you connected, the target calendar identifier, the granted scopes, and the OAuth access and refresh tokens needed to keep the connection working. Tokens are held in a dedicated table whose token columns are not readable by any signed-in client — only server-side code can use them — and each row is restricted by row-level security to the person it belongs to. Supabase encrypts stored data at rest.

Limited use

Zeylix PMT’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the calendar features described above. It is never sold, never used for advertising, never used to train machine-learning models, and never transferred to anyone else except as needed to provide those features, to comply with the law, or as part of a merger or acquisition following notice.

Disconnecting and deletion

• Disconnect Google Calendar at any time from Settings inside the application. The stored tokens are deleted when you do.
• You can also revoke access from your Google account permissions page. The application detects the revocation and stops attempting calendar writes.
• Calendar events already created remain in your calendar after disconnecting; delete them in Google Calendar if you do not want them.
• When an administrator deletes your Zeylix PMT account, the account record and any stored Google tokens are removed. Work you created — tasks, comments, documents — remains, as it belongs to the business rather than to the individual.

Who else sees it

Your work is visible to other Zeylix staff using the application, which is the point of a shared tool. Outside the company, data is handled only by the services needed to run it: Supabase (database, authentication and file storage), Microsoft Azure (application hosting), Brevo (sending transactional email such as invitations and password resets) and Google (only if you connect Calendar). We do not sell data and there is no advertising or third-party tracking in this application.

Email

The application sends transactional email only — invitations, password resets, and notifications about work assigned to or mentioning you. There is no marketing email. You can turn notification email off in Settings; invitation and password-reset messages are sent regardless, because they are needed to access the account.

Changes

If this policy changes materially, the date at the top of this page changes with it.

Contact

Questions about this policy or about data held about you: pmt@zeylix.com.