Privacy Policy
1. Who we are
Future Assistant ("Future Assistant," "the Service," "we," "us," "our") is a product of Sulus.ai, a company registered in the State of Tennessee, United States.
The Service is provided at https://futureassistant.ai. Sulus.ai also operates other products, including at sulus.ai. This policy governs Future Assistant only.
Registered address: Sulus.ai, 4935 Main Street Suite 7-351, Spring Hill, TN 37174, United States
Phone: +1 (949) 480-0016
Privacy and data-rights contact: support@sulus.ai
General contact: info@sulus.ai
2. What Future Assistant does
Future Assistant is an AI-assisted business operations tool. It connects to the Google accounts you authorize and helps you run day-to-day operational work: triaging, searching, drafting and sending email; viewing and managing your calendar and booking appointments without conflicts; keeping your Google Business Profile listings and reviews current; and reviewing advertising, analytics, and search performance.
Future Assistant is built on the Sulus.ai customer relationship management (CRM) platform. Email and calendar data you authorize us to access is brought into your CRM workspace and linked to the contacts, conversations, and appointments in that workspace, so you can see a single view of each customer relationship.
To do this, and only with your explicit authorization through Google's standard OAuth consent screen, the Service reads and — where you have granted write permission — modifies data in your Gmail, Google Calendar, Google Business Profile, Google Ads, Google Analytics, and Google Search Console accounts.
3. Categories of information we collect
3.1 Information you give us directly
- Account registration details: your name, business name, and email address.
- The customer, contact, deal, appointment, and communication records you create or import into your workspace.
- Support correspondence you send us.
3.2 Information collected automatically
- Log and device data: IP address, browser type, operating system, timestamps, and actions taken in the Service.
- First-party session cookies used to keep you signed in.
3.3 Information we obtain from your Google account
Described scope-by-scope in Section 4.
4. Google user data: what we access, why, and whether we store it
Future Assistant only accesses Google user data after you grant permission through Google's OAuth consent screen. You choose which Google account to connect, and you can revoke that permission at any time — please read Section 9.3 before doing so, since revoking access alone does not delete data already synced.
The Service offers three separate connection flows. Each requests a different set of permissions, and you can use one without the others.
4.0 Who connects Google, and whose account it is
Future Assistant is operated by Sulus.ai. The same Future Assistant Google Cloud application is used for every workspace that uses the Service (including workspaces that Agencies operate for their own clients). There is not a separate Google app per customer, and this connection is not Sulus.ai's own Google Ads spending account.
When a workspace admin chooses Location Settings → Integrations → Google (on the CRM site they use, such as crm.sulus.ai), they connect their own Google account — or their organization's Google account — so that workspace can show that account's Google Analytics, Search Console, Business Profile, and Ads data.
Sulus.ai / Future Assistant does not take ownership of those Google accounts. The Google account, the Ads account, the Analytics property, the Search Console property, and the Business Profile remain the customer's (or their organization's). We only access them after that person clicks through Google's consent screen and grants permission.
Google's Connect screen shows the application name Future Assistant, because that is the name of this one Google Cloud app. Inside the CRM, a workspace that sits under an Agency may instead see that Agency's company name on menus and pages. Those are two different labels for the same underlying Service.
Connecting a Google account is not consent for us (or for an Agency) to send marketing texts or emails to that person's customers. Having a Google account, a phone number, or an imported contact is not marketing opt-in.
4.1 "Connect Gmail" (includes Calendar)
| Scope | What it grants |
|---|---|
gmail.readonly | View your email messages and settings |
gmail.send | Send email on your behalf |
gmail.modify | Read, compose, and send email; manage labels |
calendar, calendar.events | View and manage your calendars and events |
userinfo.email | See your primary Google account email address |
What we access: the content of email messages in the connected mailbox (subject lines, bodies, and attachment metadata), message headers, labels, threads, and drafts; your calendars, event details, attendees, and free/busy availability.
What we do with it: bring your email into your workspace so messages appear on the timeline of the matching contact; let you search across synced email; summarize and prioritize incoming mail and draft replies for your review; send email at your direction, threaded correctly into the original Gmail conversation; show your schedule, check for conflicts before booking, and link events to the matching contact; create, update, reschedule, or cancel events at your direction.
Where this data is stored. Future Assistant stores synced Gmail message content — including bodies and headers — in our database, and indexes that content so it can be searched. We also store a cached copy of your calendar events. This is what makes the unified contact timeline, conflict-checking, and search work. Section 8 describes how it is protected and Section 9 describes exactly how and when it is deleted.
What we do not do with it: we do not use Gmail or Calendar content for advertising of any kind, to build audiences, to target or measure advertising, or to train generalized AI models; we do not sell it; and we do not transfer it to third parties except as described in Section 6.
4.2 "Connect Calendar only"
For users who want scheduling without connecting a mailbox: calendar, calendar.events, userinfo.email. Same handling as described for Calendar above.
4.3 "Connect Business Profile, Ads & Analytics" (Location Google connection)
This is the Location-level connection. It is separate from "Connect Gmail" / "Connect Calendar only." A workspace can use this connection without connecting Gmail.
Permissions we request (only after you click Connect)
| Permission | What it lets Future Assistant do |
|---|---|
Sign-in (openid, email, profile) | See which Google account you connected (name and email) so we can show "connected as …" and keep the connection attached to the right workspace. |
Business Profile (business.manage) | Read your Business Profile locations, listing details, reviews, posts, and listing performance. When you take an action in the Service (for example, approve and send a review reply or a listing update), publish that change to your Business Profile. |
Google Ads (adwords) | Read the Google Ads accounts you can access — account list, campaign/performance metrics, and conversion-action names — so we can show Ads reporting in that Location and let you pick a conversion action. |
Analytics (analytics.readonly) | Read reporting data from the Google Analytics 4 properties you select, to show traffic and conversion reports in that Location. |
Data Manager (datamanager) | When you turn conversion upload on, send conversion events (and, where that feature is on, hashed contact identifiers) into your Google Ads account so offline outcomes can be matched to the ads that produced them. |
Search Console (webmasters.readonly) | Read search performance (queries, clicks, impressions, average position) for the Search Console property you select, and show it on that Location's SEO views. |
We do not request Search Console write on the default Connect. Write is only requested if someone in that Location later chooses the optional sitemap reconnect.
What we access. The Google account email used to connect; the Business Profile locations you select; reviews and your public replies; listing/performance metrics; the Ads customer IDs you select and their performance metrics and conversion-action list; the Analytics property you select and its reporting metrics; the Search Console property you select and its search metrics. We do not use this connection to read Gmail.
What we do with it. Show your Analytics, Search Console, Business Profile, and Ads data inside your Location so that Location's users can see performance and manage listings/reviews. Upload conversions to your Ads account only when that Location has turned that feature on.
What we store (honest list).
- Encrypted access and refresh tokens, the connected Google email, and the list of permissions Google actually granted.
- The Business Profile, Ads, Analytics, and Search Console selections for that Location (ids and display names).
- Short-lived copies of dashboard reports (Analytics, Ads, Business Profile performance, Search Console) so the screens load without calling Google on every click. These caches are replaced as they expire or when the connected property changes.
- Copies of Business Profile reviews (reviewer display name, rating, review text, your reply) so the Location can work with reviews in the CRM. Review rows are kept for that Location's history, including when Google later removes a review.
- A conversion-upload log (status, click ids such as gclid, conversion time/value, which Ads conversion action). That log is kept so the Location can see what was sent and retry failures. It is not a copy of your Google Ads account.
What we do not do. We do not take over your Google accounts. We do not spend against Sulus.ai's Ads account through this connection. We do not sell Google user data. We do not use Business Profile, Analytics, Search Console, or Ads data to build or sell advertising audiences for Sulus.ai. Conversion upload sends data to your Ads account, at your direction — it is not a sale of Google data by us.
Offline conversion uploads. If a Location turns this on, we may send conversion events and SHA-256-hashed email or phone from that Location's CRM contact records to that Location's Google Ads account. This uses CRM data the Location already has; it does not use Gmail or Calendar content. The Location (not Future Assistant) is responsible for having a lawful reason to upload its customers' data. Connecting Google is not that lawful reason by itself. See Section 5.4 of our Terms of Service.
4.4 The boundary between Gmail/Calendar data and advertising
Future Assistant does not use Gmail, Calendar, or Google Business Profile data to create, target, optimize, or measure advertising, and does not combine restricted-scope Google user data with advertising data for any targeting purpose. The advertising features in Section 4.3 operate only on their own independently authorized data and on the CRM records you maintain. There is no data path from your mailbox or calendar into any advertising audience, conversion upload, or targeting function.
4.5 Drive files created or picked in the Service (drive.file)
A separate per-user Google connection (Gmail / Calendar) may also request drive.file. That permission reaches only Google Drive files the user picks or that Future Assistant creates — not their whole Drive. We use it so workflow steps can read or write a spreadsheet or file the user chose. We do not use Drive files for advertising.
5. How we comply with Google's Limited Use requirements
Future Assistant's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we use Google user data only for prominent, user-facing features; we do not sell it or use it for advertising; we do not transfer it except to service providers bound by equivalent restrictions, for security, to comply with law, or in a corporate transaction with your consent; and we do not allow humans to read it except with your agreement, for security purposes, to comply with law, or on aggregated/de-identified data.
5.1 Artificial intelligence and machine learning
Future Assistant uses AI models — currently OpenAI and/or Anthropic models, configured per business — to generate summaries, drafts, and recommendations. Google user data is sent to those models only to produce output for you, in the session in which you requested it. We do not use your Google data to train generalized or standalone AI models, and we require our AI providers not to train on data submitted through their business/API tiers.
5.2 Restricted scopes and independent security assessment
Google classifies gmail.readonly and gmail.modify as restricted scopes. Applications accessing these scopes are required to complete an annual security assessment from a Google-designated third-party assessor. Future Assistant requests these scopes because full inbox sync and search are core to the Service; this assessment is part of our ongoing compliance process.
6. How we share information
We do not sell your personal information. We share information only: with the service providers listed in Section 6.1, bound by written obligations no less protective than this policy; at your direction (e.g., sending an email, publishing a review response, or uploading conversion data); for legal compliance and safety; or in a corporate transaction, with your explicit consent for any Google user data obtained via restricted or sensitive scopes.
6.1 Subprocessors
| Provider | Service performed | Data processed |
|---|---|---|
| Convex | Application backend: database, file storage, full-text search, scheduled jobs, webhook handling | All Service data, including Google user data |
| Vercel | Hosting and delivery of the web application | Request and log data |
| Postmark | Transactional email (account, security, notification email) | Recipient address and message content of transactional email |
| OpenAI / Anthropic | AI model providers for summaries, drafts, and recommendations | Content submitted for AI-generated output, not retained for training |
7. International data transfers
Future Assistant is offered to users in the United States. We do not currently offer the Service to users in the European Economic Area, the United Kingdom, or Switzerland, and this policy does not address the requirements that would apply if we did.
8. How we store and protect information
We use commercially reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction, including encryption of data in transit (TLS) and at rest, encrypted storage of OAuth tokens, role-based access controls, per-workspace data separation, and logging and monitoring of access to production systems.
What we store at rest. As described in Section 4.1, Future Assistant stores synced Gmail message content and cached Google Calendar events at rest, and indexes message content so it is searchable. We do not fetch this content transiently from Google on each request.
No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and any applicable regulator as required by applicable law.
9. Data retention and deletion
9.1 Retention
Contact-level deletion: when you delete a contact, it is first placed in a recoverable, soft-deleted state for 60 days, during which it can be restored. At the end of that window, an automated daily process permanently deletes the record, cascading to associated stored email messages.
Workspace and account deletion: when a sub-account or account is deleted, a dedicated purge routine permanently removes all data derived from that account's Gmail and Calendar connections, together with the account's CRM records.
When you disconnect Gmail or Calendar, we delete that connection's OAuth tokens. Location Google disconnect stops new Google calls; see Section 9.3 for what remains stored. We retain other personal information only as long as necessary for the purposes described in this policy.
9.2 Deleting your data
You may delete individual contacts, and the data associated with them, from within the Service at any time. You may request deletion of your entire account by emailing support@sulus.ai. We will verify your identity before acting on the request.
9.3 Disconnecting Google — what stops, and what does not disappear
You can disconnect inside the Service:
- Location Google (Business Profile, Ads, Analytics, Search Console): Location Settings → Integrations → Google → Disconnect.
- Gmail / Calendar (per person): Account → Connections → disconnect that mailbox/calendar.
You should also revoke Future Assistant at https://myaccount.google.com/permissions. That is the place that turns off Google's grant. After revoke or disconnect, we stop calling Google for that connection and stop syncing new data.
- Email already copied into a contact's conversation, and cached calendar events used for conflict checking. Those stay in the workspace until you delete the contact (Section 9.1) or delete the account (Section 9.2).
- Business Profile reviews already copied into that Location, and the conversion-upload log. Reviews stay as that Location's history. On a contact erasure we remove the person-link from the conversion log but keep the log row so the Ads ledger still makes sense.
- Short-lived Analytics / Ads / Search Console report caches are dropped when we disconnect or when the selected property changes; they are not a second copy of your Google account.
10. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, or obtain a portable copy of your personal information, to opt out of sale or sharing, to limit use of sensitive information, to withdraw consent, and to appeal a decision we make about your request. To exercise a right, email support@sulus.ai. We will verify your identity before acting on a request.
11. Children
Future Assistant is a business tool and is not offered to or directed at anyone under 18. You must be at least 18 years old to use the Service.
12. Changes to this policy
We may update this policy from time to time. We will post the updated policy here and update the "Last updated" date. If changes materially affect how we handle Google user data, we will notify you by email at least 30 days before the change takes effect.
13. Contact us
Email: support@sulus.ai (privacy & data rights) · info@sulus.ai (general)
Phone: +1 (949) 480-0016
Postal: Sulus.ai, 4935 Main Street Suite 7-351, Spring Hill, TN 37174, United States