Privacy Policy

Last updated: 12 August 2026

This policy explains what data is collected by this website and by AgentFlow, the AI agent platform operated by Vishal Kale, and what is done with it. Section 3 covers data obtained from Google accounts and is the section relevant to Google OAuth.

1. Who is responsible

Vishal Kale, Abu Dhabi, United Arab Emirates, is the data controller for this website and for AgentFlow. Contact for any privacy question or request: kalevishal96@gmail.com.

2. This website

This site is a personal portfolio. It has no accounts, no sign-in and no forms, and it does not ask you for any personal information.

Analytics. Google Analytics is used to count visits and see which pages are read. It sets cookies and records a truncated IP address, approximate location, browser and referring page. It is used only to understand traffic in aggregate.
Fonts. Typefaces are loaded from Google Fonts, which means Google receives the request for the font file, including your IP address.
Contact. If you email me, I keep that correspondence so I can reply to it.

You can block analytics with any content blocker or your browser's do-not-track setting; the site works normally without it.

3. AgentFlow and Google user data

AgentFlow can connect to a Google account so that an AI agent can check availability and book appointments. This connection is optional and is initiated by the account owner. If it is never connected, AgentFlow never receives any Google data.

3.1 What is requested, and why

Scope	Why it is needed
`openid` `email` `profile`	To let you sign in to AgentFlow with Google. We receive your name, email address and profile picture, and use them only to create and identify your account.
`https://www.googleapis.com/auth/calendar` `https://www.googleapis.com/auth/calendar.events`	To read free/busy information so the agent offers only genuinely open slots, and to create, reschedule and cancel the appointments the agent agrees with a caller, including generating a meeting link. Offline access is requested so a booking made during a call still succeeds if you are not present.
`https://www.googleapis.com/auth/gmail.send`	To send booking confirmations and reminders from your own address to the person who booked. This scope only sends mail. It does not permit reading, searching or deleting anything in your mailbox.

3.2 What is stored

OAuth tokens. The access token and refresh token, encrypted with AES-256-GCM before they are written to the database. Tokens are decrypted only inside server-side code, are never sent to the browser, and are redacted from every log line and audit record.
Appointment records. The booking the agent made — time, duration, and the attendee's name, email address and phone number where they gave them — so that the appointment can be shown, rescheduled or cancelled.
Free/busy results. Read at the moment a caller asks about availability and used to compute the slots offered. Calendar event contents are not copied into AgentFlow beyond the appointments it created itself.

3.3 Limited use

AgentFlow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, Google user data is never:

used for advertising, or sold or transferred for advertising purposes;
used to train, fine-tune or improve any generalised artificial intelligence or machine-learning model;
sold to anyone, or shared with data brokers or information resellers;
read by a human, except with your explicit consent for a support request you raised, where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised.

3.4 How to disconnect and delete

You can disconnect Google from AgentFlow at any time in Integrations → Google Calendar. Disconnecting revokes the tokens with Google and deletes the stored credentials. You can also revoke access directly at myaccount.google.com/permissions.

To delete your AgentFlow account and everything associated with it, email kalevishal96@gmail.com and it will be erased within 30 days, except where a record must be retained by law.

4. Other data AgentFlow processes

Account data — name, email address, organisation and password hash, to run your account.
Knowledge base content — the documents and pages you upload for your agent to search.
Conversations — chat transcripts, call recordings and transcripts where consent was recorded, along with the tools the agent used, so you can review what your agent did.
Operational logs — request identifiers, IP address, user agent and audit entries. Secrets and personal data are masked before anything is written to a log.

Conversation data is retained for a period each organisation configures, after which a background worker purges it automatically.

5. Sub-processors

AgentFlow passes data to these services only as far as delivering the product requires:

Model providers (OpenAI, Anthropic or a compatible provider) — to generate replies.
ElevenLabs — speech synthesis and recognition for voice agents.
Google — calendar availability, booking and confirmation email, as described above.
Hosting, database and object storage providers — to run the service.
Stripe — payment processing, where billing is enabled.

Your data is never sold, and it is not shared for any purpose beyond operating the service.

6. Security

Credentials and OAuth tokens encrypted at rest with AES-256-GCM, with key rotation supported.
Every request is authenticated, authorised by role, CSRF-checked, rate-limited and schema-validated.
Tenant isolation enforced both in application code and by database row-level security.
Secrets and personal data redacted from logs; an audit log records who did what, when and from where.

No system is perfectly secure, but if a breach affects your data you will be told promptly and told what to do about it.

7. Your rights

You may request access to your data, correction, deletion, a portable copy, or restriction of processing, and you may object to processing. Email kalevishal96@gmail.com and I will respond within 30 days. If you are in the EEA or UK you also have the right to complain to your data protection authority.

8. Children

Neither this website nor AgentFlow is directed at children under 16, and neither knowingly collects their data. If you believe a child has provided data, contact me and it will be deleted.

9. Changes

This policy may be updated. The date at the top always reflects the current version, and any material change affecting how Google user data is handled will be notified to affected account holders by email before it takes effect.