Privacy Policy

1. Who this policy covers

This policy explains how Journey Pal handles personal information through the Journey Pal website, mobile applications, content management services, and connected Google Workspace features. Journey Pal is responsible for the processing described here.

Questions or privacy requests can be sent to info@journeypal.app.

2. Information we collect

Information you provide

This may include your name, email address, organisation, account details, support correspondence, exhibit content, translations, audio, and other material you choose to upload or configure.

Service and technical information

We may process login and security records, device and browser information, IP addresses, service events, QR-code usage data, language selections, and diagnostic logs. Payment providers process payment-card details; Journey Pal does not need to store full card numbers.

Google Workspace and Gmail information

When an authorised user connects Gmail, Journey Pal receives the Gmail address, the OAuth permissions granted, and an OAuth refresh token. The refresh token is encrypted before storage. Journey Pal also stores identifiers for messages and threads it sends, the configured message content, delivery status, limited sender metadata from relevant messages, and short excerpts from matched outreach replies so it can detect and report an inbound response.

Journey Pal requests Gmail send access to send user-configured messages and Gmail read-only access to check associated threads and match inbound messages to outreach recipients. It reads reply content only after the message has been matched to an outreach prospect. It does not use this permission to read unrelated inbox message bodies or build a copy of a mailbox.

3. How we use information

We use information to provide and secure the service; authenticate users; host and deliver museum content; generate requested translations and audio; process payments; provide support; monitor reliability; prevent abuse; comply with law; and improve Journey Pal using service information that is appropriately protected.

Google Workspace data is used only to provide the connected email functionality requested by the authorised account holder: account connection, sending configured messages, maintaining the correct conversation thread, detecting replies, applying suppression controls, and diagnosing delivery failures. Journey Pal does not use Gmail API access to send unsolicited commercial email.

4. Sharing and service providers

Journey Pal does not sell personal information or Google user data. We may disclose information to infrastructure, storage, payment, email, artificial-intelligence, and speech providers only where needed to provide features requested through Journey Pal. These providers process data under their own contractual and security obligations. Museum content may be provided to translation or speech services when an authorised user requests those features.

Data received through Gmail API access is not provided to advertising platforms, data brokers, or artificial-intelligence providers. We may also disclose information where required by law, to protect users or the service, or as part of a business transaction subject to appropriate confidentiality and notice.

5. Google API Limited Use

The use of information received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Journey Pal does not transfer Google user data for advertising, retargeting, credit decisions, sale, surveillance, or training or improving a general-purpose AI or machine-learning model. Human access is limited to cases where the account holder gives permission, it is necessary for security or legal compliance, or the data has been aggregated and anonymised for permitted internal operations.

6. Retention, disconnection, and deletion

We retain information only for as long as reasonably necessary to provide the service, maintain security and audit records, resolve disputes, and meet legal obligations. Connected Google credentials are retained while the connection is needed or until the account holder requests deletion. Operational message and thread metadata may be retained for delivery, suppression, security, and audit purposes.

You can revoke Journey Pal's Google access through your Google Account connections. Revocation stops new access but does not automatically erase information already stored by Journey Pal. To request access, correction, export, or deletion, email info@journeypal.app or use the account deletion page. We aim to complete verified deletion requests within 30 days, except where limited retention is required by law, security, fraud prevention, or backup-recovery processes.

7. Security and international processing

Journey Pal uses access controls, HTTPS encryption, encrypted Google refresh-token storage, monitoring, and other technical and organisational safeguards appropriate to the service. No method of transmission or storage is completely secure.

Journey Pal's APAC infrastructure is hosted in Australia. Some service providers may process information in other countries. Where information is transferred, we use appropriate contractual, technical, and organisational protections.

8. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, or to request a portable copy. You may also withdraw consent where processing is based on consent. Contact us to make a request. We may need to verify your identity before acting.

9. Changes and contact

We may update this policy when our services or legal obligations change. We will update the effective date and provide additional notice where a material change affects how authorised Google user data is used.

Privacy questions and requests: info@journeypal.app