HCME Desk is a private business-management application operated by HCME Services Ltd. This policy explains how the application handles personal information, including information obtained through Google APIs. The application is intended for an authorised HCME business user, rather than for public customer accounts.
Information handled
HCME Desk may hold customer names, email addresses, telephone numbers, service and property details, addresses, enquiry text, booking dates, internal staffing notes, agreed prices, invoice and payment records, and company documents uploaded by the authorised user. It also stores the account identifier needed to keep each workspace separate, links between jobs and Google Calendar events, and identifiers and status records used to prevent duplicate invoice emails.
Gmail information
With the user's permission, HCME Desk reads recent inbox threads to identify possible cleaning enquiries and show message content for review. Gmail content is used only to support enquiry handling, customer records, bookings, invoice preparation and related customer communication. A relevant extract becomes part of the HCME workspace only when the authorised user saves it as an enquiry or job.
If the optional Gmail compose permission is granted, HCME Desk can create or update a Gmail draft containing the reviewed English message and matching invoice PDF. Issuing or saving an invoice does not send email. Sending requires a separate, explicit approval. The application stores related Gmail draft, message or thread identifiers and a delivery status or fingerprint so it can show the relationship and help prevent accidental duplicate sends.
Google Calendar information
With permission, HCME Desk reads a limited upcoming window of events from the connected primary calendar so the authorised user can review availability and clashes. It can create an event for a saved booking after an explicit action. Customer invitations are optional and are included only when separately approved. Internal cleaner and staffing notes are not placed in customer invitations. The application stores the event identifier, link, timing and relationship to the HCME job to help prevent duplicate events; the event itself remains in Google Calendar.
Purpose
Information is used to respond to enquiries, arrange and deliver cleaning services, maintain customer and booking records, prepare and send approved invoices and messages, record payments, produce business reports, prevent duplicate actions, secure the application, and meet legal, tax and accounting obligations.
Storage and security
Workspace records and document metadata are stored in the application's account-scoped hosted database. Uploaded company documents are stored in private object storage. The browser may keep a recovery copy on the authorised user's device, and the user can export a backup. Access to business APIs requires the HCME Desk sign-in identity, and records are queried using that owner identifier. Cross-origin write requests are blocked where the application performs sensitive changes.
The Google OAuth client secret and access and refresh tokens are stored in encrypted server-side configuration using AES-GCM with the owner identifier bound to the encrypted data. OAuth connection requests use PKCE, single-use state records and a ten-minute expiry. Data is sent over HTTPS. No method of storage or transmission can be guaranteed to be completely risk free.
Retention and deletion
HCME Desk does not currently apply one automatic deletion period to all business records. Records are kept for as long as HCME Services Ltd reasonably needs them for customer service and legal, tax, accounting or dispute purposes. The authorised user can remove ordinary working records and export a backup. Issued invoice snapshots and payment history are protected from silent alteration because they are business records.
To request access, correction or deletion, contact team@hcme.co.uk. HCME Services Ltd will verify the request and delete or restrict information when appropriate, subject to records it must retain. Revoking HCME Desk in the Google Account security settings stops future Google API access. A deletion request can also cover stored Google connection data and saved copies derived from Gmail. Calendar events or Gmail drafts that already exist in Google may also need to be deleted in the relevant Google service.
Service providers and sharing
HCME Desk uses OpenAI's Sites and sign-in infrastructure and its underlying hosting and storage services to run the application. It uses Google APIs when the authorised user connects Gmail or Calendar. Data may also be disclosed where required by law, to protect the service, or to professional advisers and processors supporting HCME Services Ltd under appropriate obligations. HCME Services Ltd does not sell Google user data or use it for advertising. A PDF or message is shared with a customer or another application only when the authorised user chooses that action.
Google API Services User Data Policy
HCME Desk's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the enquiry, booking, scheduling, invoice-preparation and explicitly approved communication features described in this policy. HCME Services Ltd does not use that data for advertising, sell it, or use it to train a general-purpose artificial-intelligence model.
Contact
HCME Services Ltd
Company registration number: 15008767
Email: team@hcme.co.uk