Our privacy policy, in plain English

This part covers everything Deep Current receives through Google's APIs when you connect a Google or YouTube account. You sign in on Google's own page and see exactly what is asked for. Deep Current asks only for the access the tool you are connecting needs, and only when you press to connect that tool.

What we access, and what we use it for

YouTube — posting videos (https://www.googleapis.com/auth/youtube.upload): when you post or schedule a video to YouTube from Deep Current, we upload that video to your channel with the title, description and visibility (Public, Unlisted or Private) you chose. We only upload videos you added and told us to post.

YouTube — your channel's details (https://www.googleapis.com/auth/youtube.readonly): we read the name, handle and ID of the channel you connected, so Deep Current can show you which channel is connected and send your videos to that channel. We store only the channel's name, handle and ID.

YouTube — stats and comments (https://www.googleapis.com/auth/yt-analytics.readonly and https://www.googleapis.com/auth/youtube.force-ssl): only for businesses where this feature is switched on, and asked for separately. We read view, watch-time and audience figures for your videos and the comments on them, to show them to you, and post a reply to a comment only when you write it or set up the rule that sends it.

Google Ads (https://www.googleapis.com/auth/adwords): we read your campaigns, costs, keywords, search terms and results to show you what your ads cost and what they bring in, and — only when you press to approve a change — we make that change in your Google Ads account, for example pausing a wasted keyword or creating a campaign you reviewed.

Google Search Console (https://www.googleapis.com/auth/webmasters.readonly): we read which Google searches show your website and how its position changes. We cannot change anything in Search Console.

Google Business Profile (https://www.googleapis.com/auth/business.manage): where switched on, we read your business locations and their reviews, and publish the review replies you approve.

Google Calendar (calendar.freebusy, calendar.events.owned, calendar.calendarlist.readonly): only if you connect a calendar to online booking or the phone receptionist. We check when you are busy (not what your other events are), let you pick which calendar to use, and add, move or remove the bookings Deep Current made.

Google Drive, Sheets and Docs (drive.readonly, spreadsheets.readonly, documents): only when you use these tools. We read the pictures in a Drive folder you link for social posts, read a spreadsheet you choose to import, and create a Google Doc when you ask us to export something to one.

Your name and email address (openid, userinfo.email, userinfo.profile): to show which Google account is connected.

What we never do with Google user data

We use it only to provide the features described above, which you can see and use in Deep Current. We never sell it. We never use it, or let anyone else use it, for advertising, retargeting or interest-based ads. We never use it to determine credit-worthiness or for lending, and never for any purpose unrelated to those features. We never transfer it to anyone except as needed to provide those features, to comply with the law, for security, or as part of a merger or sale where it stays under these same protections. We never use Google user data to train or improve AI or machine-learning models, and we never send it to any AI provider that would. Data from YouTube is not sent to any AI service at all. Where a feature you start uses AI (for example, the Google Ads audit summarising your account's figures), the figures are sent through that AI company's paid business API, whose terms forbid using them to train its models.

Who we share Google user data with

Only these, only this data, and only for these reasons:

• Your own account — your team and, if an agency runs your account, that agency. Never any other business on Deep Current.
• Supabase (our database, in the United States) — stores the Google data we keep for you, with the sign-in tokens encrypted.
• Fly.io (our servers) — runs the code that talks to Google for the tools you connected.
• Vercel (our web hosting) — delivers the dashboard where you see your data. It does not store it.
• Anthropic (Claude AI, paid business API) — your Google Ads figures, for the Ads audit you start; your Google reviews, to draft replies you approve or set a rule to send; and, for the phone receptionist, the open appointment times we work out from your calendar's busy times (never what your events are).
• Google's Gemini API (paid) — small preview images of the photos in a Drive folder you link, only when you press “Index this folder”, so we can suggest your own pictures for posts.
• Twilio (phone calls and texts) — the open times the receptionist offers a caller.
• Google itself — the videos, replies, ad changes and bookings you tell us to send to your own Google account.
• The law, or a buyer — only if the law requires it, or if Deep Current is sold or merged, with notice to you and these same rules still applying.

We share Google user data with no one else. Not advertisers, not data brokers, not other businesses on Deep Current. YouTube data and your calendar's events never go to any AI company, and no Google data goes to OpenAI or Perplexity. Our other suppliers (email, payments, domain names, search-ranking data) never receive it.

No person at Deep Development & Design reads your Google user data unless you ask us to for support, it is needed for security (such as investigating abuse), or the law requires it.

How we protect it

Everything travels over encrypted HTTPS connections. YouTube sign-in tokens are encrypted with AES-256-GCM by our server before they are stored, and are never sent to the browser. All of our data, including the other Google sign-in tokens, is kept in a database that is encrypted at rest (AES-256) by our database provider, with row-level access rules so each business can only reach its own records. The tokens are used only by our servers, only to talk to Google for the feature you connected. Access to our systems is limited to the staff who run them, behind their own logins.

How long we keep it, and deleting it

We keep Google user data only while the connection is in use. Disconnect YouTube or any other Google connection from Connections in your dashboard and the stored tokens and account details for it are deleted straight away. Posts you made stay in your post history (with the link to the YouTube video) until you delete them or close your account. Close your account and everything is deleted within 30 days, as described below. You can also remove Deep Current's access at any time at myaccount.google.com/permissions. Deep Current's YouTube features use the YouTube API Services: by connecting YouTube you agree to the YouTube Terms of Service, and Google's Privacy Policy applies to what Google does with your data.

Limited Use. Deep Current's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If your business sends invoices from Deep Current, you can connect your own QuickBooks Online or Xero so those invoices land in your books. You sign in on Intuit's or Xero's own page and pick which company to connect. We never see your QuickBooks or Xero password. We only receive a sign-in token that lets Deep Current work with the one company you picked.

Access we ask for. QuickBooks Online: com.intuit.quickbooks.accounting. Xero: accounting.transactions, accounting.contacts and accounting.settings.read, plus Xero's standard sign-in permissions (openid profile email offline_access), which keep the connection signed in.

What we send to your books. Invoices once they have gone to your customer (sent, opened or paid): the invoice number, title, dates, line items, discount, tax and notes, and the customer's name, email and phone, which are added as a customer in your books if they are not already there. Drafts are never sent. If you cancel an invoice here that was already copied, it is voided in your books too.

What we read from your books. Whether each copied invoice has been paid or voided, and the date it was paid, so it can be marked paid here. Your products and services and your tax codes (QuickBooks), or your sales accounts and tax rates (Xero), so you can choose in Settings which ones invoices are recorded against. Your company name, so you can see which books are connected. We look up existing customers by email or name, and existing invoices by number, only so we never add the same one twice. QuickBooks and Xero may also send us a note that something changed; we then read that invoice back ourselves. We don't read your bank accounts, bills, payroll or reports.

What we never do with it. We don't sell it, don't use it for advertising, don't use it to train AI models, and don't share it with other businesses on the platform. One company's books can only be connected to one business.

How it's stored. The sign-in tokens are encrypted (AES-256) before they're stored, are never shown in the browser, and are only used on our servers to talk to QuickBooks or Xero. We also keep a short sync log and a record of which Deep Current invoice matches which invoice in your books.

Disconnecting. You can disconnect at any time from Invoices → Accounting sync in your dashboard. The stored tokens are deleted straight away, and we ask Intuit or Xero to cancel them. We keep the sync log and the invoice-matching record, so that reconnecting the same books never copies every invoice a second time; connecting different books clears it. You can also remove Deep Current's access from inside QuickBooks or Xero. To have the rest deleted too, ask us using the details at the bottom of this page, or close your account and all of it goes with it.