Privacy Policy

This Privacy Policy describes how CBM Review Tool at cbm.flexlabsin.cloud handles information when you use the service to manage website content, run reviews, and connect integrations. It covers this application, not the separate websites you connect.

Information the service processes

• Account information: your name, email address, password hash, account status, permissions, and login sessions.
• Website and work data: connected website addresses, content retrieved for review or editing, tasks, settings, review results, generated drafts, and publishing records.
• Integration information: connection identifiers, Google authorization tokens, WordPress application credentials, and an AI API key if you provide one.
• Operational records: action audit records, timestamps, job status, and diagnostic information needed to operate and troubleshoot the service.

Google data we access and why

CBM requests the OAuth scope https://www.googleapis.com/auth/spreadsheets. Google authorization is a connection to the task feature, not a replacement for your CBM account login. This integration does not request your Google profile, contacts, email messages, or a list of all files in Google Drive.

• Spreadsheet and tab metadata: the spreadsheet ID from your chosen URL, tab ID, tab title, and grid size are used to locate and validate the task tab.
• Task cells: CBM reads columns A–F, including their header row, for up to 10,000 task rows. Website and URL identify the page to work on; Depth selects review depth; Person identifies the assigned worker; Status identifies open or completed work; Note contains task context.
• Writes you request: creating a template creates a new spreadsheet with the required headers. Completing a task writes its status and note to columns E–F of the matching row. This workflow does not delete your spreadsheet.
• Authorization data: CBM saves an encrypted refresh token, connection time, spreadsheet ID, and tab ID associated with the website. It exchanges the refresh token for temporary access tokens to make API calls without asking you to approve each request.

Connecting Google is optional. With your approval, CBM uses the Google Sheets API to read your selected task spreadsheet, create a task-template spreadsheet when requested, and update task completion statuses and notes. Task fields include Website, Depth, URL, Person, Status, and Note. Spreadsheet identifiers, connection details, and local task data are stored to support these features.

The current Google Sheets permission can grant access to all spreadsheets accessible to the approving Google account; it is not restricted by Google to one file. CBM's task workflow uses the spreadsheet you select for the website. Connecting Sheets does not grant CBM access to Gmail or Google Contacts.

Google data is used to provide the connected task workflow. We do not sell Google data, use it for personalized advertising, provide it to data brokers, or use it for credit or lending decisions. Data obtained through Google Workspace APIs is not used to develop, improve, or train non-personalized or generalized AI or machine-learning models. CBM's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

WordPress and AI connections

A WordPress connection allows the service to make authenticated API requests within the permissions of the connected WordPress account. Depending on the actions you request and your app permissions, this may include reading, editing, and publishing website content. Application administrators can manage connected websites using the saved connection.

When an AI feature is used, relevant website content, prompts, and review context are sent to the configured AI service, such as Anthropic. AI access may use a personal API key or an administrator-managed server connection. The provider processes submitted information under its own terms and policies. Do not submit secrets or personal information that is unnecessary for the task.

Why information is used and who can access it

Information is used to authenticate accounts, enforce permissions, operate integrations, perform requested content workflows, maintain activity records, and investigate failures or abuse. Administrators can manage accounts, change access, and inspect operational activity and website work. Your workspace should not be treated as private from its administrators.

Hosting and database infrastructure and the external services needed for your requested actions process relevant data. Google receives Sheets API requests, connected WordPress sites receive content requests, and the configured AI provider receives AI inputs. Google-derived data is subject to the Limited Use restrictions above; administrative privileges do not authorize unrestricted human inspection of that data. Human access must be limited to user-approved support, necessary security investigation, or applicable legal requirements.

Google data sharing and transfers

The connected task data is processed on the CBM application server hosted with Hostinger and shown in the authorized website workspace. Google receives authenticated requests to read and update the selected spreadsheet. When you use a task URL to run a review, the target website is fetched and relevant website content and review context are processed by the configured AI service. Google refresh tokens are not sent to WordPress or the AI provider. Connecting Google by itself does not start an AI review or publish content.

Sharing is limited to the services needed to perform the requested features, user-authorized support, security investigations, or legally required disclosures. No unrelated advertising or data-resale service receives your Google task data. If a proposed change introduces a new use or recipient of Google data, we will update this policy and obtain any required consent before that use.

Storage and security

The service stores account and integration information in its server-side database and work artifacts on its server. Saved Google refresh tokens, WordPress credentials, and AI API keys are encrypted server-side. App passwords are stored as hashes. Session cookies support sign-in, and browser storage may retain interface preferences. The hosted app and Google API requests use HTTPS to protect data in transit. Server-side authorization checks bind Google connections to the website owner and enforce app access permissions. OAuth approval uses short-lived, single-use state bound to the login session and PKCE. Temporary authorization state expires after ten minutes. Encryption of credentials does not mean that all task data or generated work files are separately encrypted at the application level. These protections reduce risk but cannot eliminate every security risk.

Google data retention and deletion

The saved refresh token and selected sheet identifiers remain until the connection is disconnected or removed by the operator. Task rows may be cached on the server for the website's task list. Disconnecting Google deletes that website's saved Google connection and clears its task cache; it does not delete files from your Google account.

To stop future Google access, open Integrations, select the website, and disconnect Google. To withdraw the app's Google grant, visit your Google account's third-party connections and remove CBM Review Tool. A Google-side revocation prevents further authorized API access but does not itself remove CBM's already stored records; disconnect in CBM or request deletion as well.

Other retained records and deletion requests

Account information, work artifacts, and activity records may remain while needed to operate the workspace, troubleshoot issues, and meet applicable obligations. The service does not currently promise a fixed automatic deletion period for all records.

You can disconnect Google from Integrations. This removes the saved Google connection for that website and its local task cache; it does not delete your Google spreadsheet or necessarily remove previously created review artifacts. You can also revoke CBM's authorization in Google account connections. Revocation may affect other websites connected through the same Google account.

You can revoke WordPress application credentials in WordPress and revoke personal AI keys with their provider. Revocation prevents future use of those credentials but does not undo published content or erase existing work records. For access, correction, or deletion of account information and retained work, email the CBM Review Tool operator at flexlabsin@gmail.com. Include your CBM account email, the affected website, and whether you want connection data, cached tasks, review artifacts, or the whole account removed. We must verify that you are entitled to request deletion before changing another account or shared workspace records. Do not send passwords or tokens with a request. Backup copies, where maintained, may remain until replaced or expired.

Changes and contact

Updates to this policy will appear here with a revised date. Material changes to Google data use require appropriate notice and any necessary renewed consent. For privacy questions or requests, email flexlabsin@gmail.com. This service is intended for authorized website operators, not for children.