Privacy Policy

Ali Samadi Agency ("we", "us", "our") operates alisamadii.com. This policy explains what personal information we collect, why we collect it, and how you can control it. We keep data collection to the minimum needed to respond to you and deliver our services.

Information we collect

• Contact details you submit through our contact or onboarding forms — such as your name, email address, and message.
• Billing information when you start a project. Payments are processed by Stripe; we never see or store your full card details.
• Basic usage data (e.g. pages visited) collected by privacy-respecting analytics to help us improve the site.

How we use your information

We use your information to reply to enquiries, prepare quotes, deliver and support projects, process payments, and meet our legal and accounting obligations. We do not sell your personal information, and we do not use it for advertising.

Third-party services

We rely on a small number of trusted providers to run our business — including Stripe for payments, Google for optional calendar integration (see below), and our hosting and email providers for delivering the site and communicating with you. Each processes data only as needed to provide their service.

Google user data (Google Calendar)

Our client dashboard offers an optional appointment booking feature. If you choose to connect your Google account, we request access to the following Google Calendar scopes:

• Free/busy availability (calendar.freebusy) — read when your calendar is busy so the booking widget only offers time slots when you are available. We never read event titles, descriptions, attendees, or any other event content through this scope.
• Calendar events (calendar.events) — create an event on your calendar when a visitor confirms a booking, so the appointment appears in your schedule with the visitor's name and contact details.

We use this access solely to power the booking feature you enabled. Specifically:

• We store the OAuth tokens Google issues to us, encrypted, in our database so the connection keeps working between sessions.
• We store the bookings created through the widget (date, time, visitor name and contact details) in our database so you can see them in your dashboard.
• We do not store your calendar contents. Availability is checked live at the moment a visitor views the booking widget and is not retained.
• We do not use Google user data for advertising, do not sell it, and do not share it with third parties. No humans read this data except as needed for security, to comply with the law, or with your explicit consent for support.
• We do not use Google user data to develop, improve, or train machine-learning or artificial-intelligence models.

You can disconnect Google Calendar at any time from your dashboard, or revoke our access from your Google account permissions. On disconnection we delete the stored tokens. You can also email us to request deletion of any stored booking data.

Google user data (Google Ads)

Our client dashboard also offers optional advertising reporting and conversion tracking. To provide it, we request access to the following Google scopes:

• Google Ads (adwords) — read campaign, budget, and conversion reporting from Google Ads accounts linked to our manager account, and apply the campaign changes a client requests (for example budget updates or negative keywords).
• Data Manager (datamanager) — upload offline conversion events (for example when a lead from a client's own website becomes a customer) to the client's linked Google Ads account so their campaigns can be measured accurately.

We use this data solely to provide the reporting, alerting, and conversion tracking features inside the client dashboard. We do not sell it, do not use it for advertising of our own, and do not share it with anyone outside the service providers listed above.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect your data

We protect all personal information we hold, including sensitive data received from Google APIs, with the following mechanisms:

• Encryption in transit: all data moves between your browser, our servers, and Google over HTTPS using TLS 1.2 or higher.
• Encryption at rest: our database and its backups are encrypted at rest, and the OAuth tokens Google issues to us are additionally encrypted before storage.
• Access controls: access to personal and Google user data is restricted to authorized personnel who need it to operate the service. Tokens are stored server-side only and are never exposed to other users, browsers, or third parties.
• Credential security: API keys and OAuth credentials live in secured server configuration, never in client-side code or version control.
• Revocation and deletion: when you disconnect an integration or close your account, we revoke and delete the stored tokens, and we delete associated Google user data within 30 days on request.

No method of transmission or storage is 100% secure, but we review and update these safeguards on an ongoing basis.

Data retention

We keep personal information only as long as needed to provide our services and meet legal and accounting obligations. Google user data is retained only while the related integration stays connected; disconnecting it removes the stored tokens immediately, and you can email us to have any remaining related records deleted within 30 days.

Your rights

You can ask us to access, correct, or delete the personal information we hold about you at any time. To make a request, email a@alisamadii.com and we'll respond promptly.

Contact

Questions about this policy? Reach us at a@alisamadii.com, Ali Samadi Agency, USA.