1. Who is responsible
The Makers, trading as Tersum, is responsible for the processing described in this policy. Registered office: Vennestraat 329, 3600 Genk, Belgium. Enterprise number: BE 0828.856.585.
Privacy questions can be sent to [email protected].
2. Data we process
Depending on the features you use, Tersum processes:
- account, company and contact information;
- business documents such as invoices, receipts and credit notes;
- document metadata, extracted fields, categorizations and audit events;
- connector configuration, encrypted credentials and synchronization state;
- support communications and basic security and operational logs.
Tersum processes this information to provide, secure, support and improve the administration features requested by the customer and to comply with applicable legal obligations.
3. Google user data
What Tersum accesses
Connecting Gmail is optional. When you connect a mailbox, Tersum
requests only
https://www.googleapis.com/auth/gmail.readonly. This
allows Tersum to read message identifiers, headers, sender and
recipient information, dates, message bodies, attachment metadata,
attachment files and document links found in messages.
Tersum uses this access to identify and import invoices, receipts and related business documents, avoid duplicate imports, maintain synchronization progress and show the source of imported records.
What Tersum does not do
Tersum does not use Gmail access to send, compose, modify, label or delete messages. It does not sell Google user data, use it for advertising, or use it to train generalized or cross-customer AI models. Human access is prohibited except when you explicitly ask for support involving specific data, when required for security, or when required by law.
Limited Use
Tersum’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide or improve the user-facing administration features you choose to use.
4. Storage and retention
Production data is intended to be stored in the European Union. OAuth tokens are encrypted and retained only while the Mailbox Connection remains active or as briefly as needed to complete its secure disconnection.
Gmail content that does not become a business record is processed only to identify relevant documents and should not be retained as a standalone mailbox archive. Imported originals, normalized business documents and their audit trail may be retained for at least ten years where this is required for the customer’s Belgian accounting and evidentiary obligations. Other account and operational data is kept only for as long as needed for the service, security, dispute resolution and applicable law.
6. Security
Tersum applies tenant isolation, access controls, encryption for connector credentials, audit records and restricted operational access. No internet service is completely secure; suspected security issues should be reported through the contact details below.
7. Your choices and rights
You can:
- choose not to connect Gmail and use another intake channel;
- disconnect the Mailbox Connection from Tersum;
- revoke Tersum through your Google Account permissions;
- request access, correction, export, restriction or deletion of personal data;
- object to processing where applicable; and
- complain to the competent data protection authority.
Disconnecting Gmail stops future mailbox access. A deletion request does not require Tersum to erase business records that must be kept to comply with law or establish legal claims; such records will be restricted to those purposes for the required period.
You can also revoke access directly in your Google Account connections.
8. Contact
Send privacy, deletion or security requests to [email protected]. We may need to verify your identity before fulfilling a request.