Privacy policy

Rules that apply to every integration

• Purpose. We use the data solely to provide and improve the user-facing features that the userconnected the application in order to receive, and which are visible and prominent in theTraineryHCM™ interface. We do not use it for any other purpose.
• Never for advertising or profiling. We do not use it for advertising of any kind, including retargetingand interest-based advertising, nor for creating or enriching marketing databases, nor for credit-worthiness or lending decisions, nor for sale to data brokers or information resellers.
• Artificial intelligence and machine learning. We do not use data obtained from a connectedapplication to develop, improve or train generalized or non-personalized artificial intelligence ormachine learning models, and we do not retain it for that purpose. We do not co-mingle it with the dataof other users or organizations for the purpose of any model. At present, no data obtained from aconnected application is sent to any artificial intelligence or machine learning service; our AI featuresoperate exclusively on data that customers enter directly into TraineryHCM™.
• Never sold or transferred. We do not sell, rent or trade this data. We transfer it only to provide thefeatures the user requested, for security purposes such as investigating abuse, to comply withapplicable law, or in connection with a merger, acquisition or sale of assets with prior notice to theuser. It is otherwise handled only by a limited set of infrastructure providers acting strictly asprocessors on our instructions — our cloud hosting provider, and the authorization service thatsecurely stores the connection credential on our behalf. Those providers may not use it for their ownpurposes.
• Least access. We request the narrowest set of permissions that supports the feature, and no more.
• Human access. No member of our staff reads this data except with the user's affirmative agreement toview that specific data, or where necessary to investigate abuse or a security incident, or to comply withapplicable law. Such access is restricted and logged.
• Protection. Connection credentials are stored encrypted and are never exposed to any clientapplication or to any other customer. All data received from a connected application is encrypted intransit (TLS) and encrypted at rest.
• Retention and deletion. We retain the data only for as long as the connection remains active and thedata is needed to provide the feature. We do not create permanent copies of it. A user may disconnectat any time from My Profile → Connections inside TraineryHCM™. Disconnecting immediatelyrevokes our stored credential, stops all further access, and deletes the data we synced from thatapplication. A user may also request deletion at any time by contacting support@trainery.one; we willaction such requests promptly and in any event within 30 days.

Integrations you can currently connect

The applications below are the integrations available today. We will update this list as further integrationsare released.

• Google Calendar — we access your calendar events, and your basic Google account information. Weuse this to calculate your availability before a training session is scheduled, and to add, update andcancel the training sessions TraineryHCM™ schedules for you. See the Google Workspace subsectionbelow for full details.

Google Workspace

This subsection describes specifically how TraineryHCM™ accesses, uses, stores, shares and protects dataobtained from Google APIs. The rules above apply in full; the following adds the detail specific to Google.

What Google user data we access. When a user chooses to connect their Google Calendar toTraineryHCM™, and only after that user grants consent on Google's own consent screen, we access:

• Google Calendar events (https://www.googleapis.com/auth/calendar.events) — the events on theuser's calendar, including their start and end times, titles and free/busy status.
• Basic Google account information (openid, email, profile) — the user's Google account identifier,email address and display name.

We do not request access to Gmail, Google Drive, Google Contacts, the Google Workspace AdminDirectory, or any other Google service. Each connection is made by an individual user for their ownaccount. We do not use domain-wide delegation and we do not request administrator-level access to anyGoogle Workspace domain. We do not request the broader calendar scope.

How we use Google user data. We use it solely to provide and improve the user-facing features that theuser connected their calendar in order to receive. Specifically: to read existing calendar events so thatTraineryHCM™ can calculate genuine availability before a training session is scheduled; to create, updateand cancel the training-session events that TraineryHCM™ schedules on the user's calendar and keepthem in sync; and to identify which Google account is linked, so that reconnecting updates the existingconnection rather than creating a duplicate.

Google user data and artificial intelligence. We do not use data obtained from Google Workspace APIs todevelop, improve or train non-personalized artificial intelligence or machine learning models, and we donot retain it for that purpose.

Revoking access. In addition to disconnecting from My Profile → Connections inside TraineryHCM™,users may revoke our access directly at https://myaccount.google.com/permissions.

Limited Use. TraineryHCM™'s use and transfer of information received from Google APIs to any other appwill adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The use of raw or derived user datareceived from Google Workspace APIs will adhere to the Google User Data Policy, including the LimitedUse requirements.