Privacy Policy

BerstraOS (core.berstra.com) is a private business management system operated by BERSTRA PTY LTD in Brisbane, Australia. It is used by the business owner to manage jobs, invoices, payments to workers and suppliers, timesheets, assets and related records. It is not offered to the public: there is no open sign-up, and accounts are created by the operator.

This policy explains what data BerstraOS receives when you connect a Google account, how that data is used and stored, and how you can revoke access or have it deleted.

You can choose to connect Google accounts in BerstraOS settings. Depending on the feature, we request:

• Basic profile (openid, email, profile) — your Google account email address and name, used only to show which account is connected and as the sender name of emails you send.
• Gmail send (gmail.send) — permission to send email on your behalf. See section 3.
• Gmail metadata (gmail.metadata, optional) — read-only access to message headers such as labels, dates and header fields, never message bodies or attachments. Used only to confirm whether an email BerstraOS tried to send actually reached your Sent folder. See section 3.
• Google Calendar (calendar) — to show your calendars and events in BerstraOS and to create or update events for jobs you schedule. Calendar data is fetched when you view it and is not copied into our database, apart from a log of events you create or change from BerstraOS.

We do not request access to read message bodies or attachments, or to search, label, modify or delete your email, your contacts, your Drive files or any other Google data.

The Gmail permissions are used for one purpose: when you open a document in BerstraOS (for example an invoice or a remittance advice), review the recipient, subject, message and attachments, and press Send, BerstraOS sends that one message from the Gmail account you selected. The message first waits in your email queue for the send delay you chose (10 minutes by default), during which you can recall it, and is then sent by our server. If Gmail is temporarily unavailable, the same message is retried a limited number of times. Nothing is sent in bulk or without your action.

If a send is interrupted so that it is unclear whether Gmail accepted it, and you granted the optional gmail.metadata permission, BerstraOS lists that account's recent Sent messages and reads one header that BerstraOS itself added to the message (X-Berstra-Queue-Id) to check whether it was delivered, so it is never sent twice. It does not read message bodies, attachments or your inbox, and stores nothing from this check except the Gmail message ID of the matching message. Without that permission you check the Sent folder yourself.

Sent messages appear in that Gmail account's Sent folder like any other email.

For your business records, BerstraOS keeps a copy of each email it sent for you: sender and recipient addresses, subject, message text, the time it was sent, Gmail's message ID, and the attachments (the generated PDF and any files you uploaded, such as payment screenshots). This history is visible only to your account.

• When you connect an account, Google issues an access token and a refresh token. These are stored in the BerstraOS database (PostgreSQL, operated on our own server) in a record tied to your BerstraOS account. Row-level security means no other account can read them.
• Tokens are used only by BerstraOS's server to call the Google API you authorized (sending an email, or reading or updating your calendar), and only when you use that feature.
• All traffic between your browser, BerstraOS and Google is encrypted with HTTPS.
• Email attachments you send are stored in a private Cloudflare R2 storage bucket and can only be downloaded by your signed-in account.
• The application runs on Cloudflare Workers. Cloudflare processes requests as our hosting provider and does not use this data for its own purposes.

We do not sell Google user data, use it for advertising, use it to train AI or machine-learning models, or transfer it to third parties, except as needed to provide the features described above (Google itself, and Cloudflare as our hosting provider), to comply with the law, or to protect against security incidents. No person reads your Google data unless you ask us to help with a specific problem or the law requires it.

BerstraOS's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• In BerstraOS: go to Settings → Email and choose Remove next to a Gmail account. This revokes the authorization at Google and deletes its stored tokens. Calendar access can be disconnected in Settings → Calendar, which deletes its stored tokens.
• In your Google account: you can remove BerstraOS at any time at myaccount.google.com/permissions. BerstraOS then can no longer use the tokens.
• Deletion: email us at the address below to delete stored Google tokens, sent-email history or attachments. We will confirm and complete the deletion within 30 days, except for records we must keep by law (for example, Australian tax law requires business records to be kept for five years).

Tokens are kept only until you remove the account or revoke access. If Google reports that a token is no longer valid, BerstraOS stops using it and asks you to reconnect.

If we change how Google user data is used, we will update this page and its “last updated” date before the change takes effect.

Questions, access or deletion requests: jiahuizhang.apply@gmail.com
BERSTRA PTY LTD, Brisbane, Queensland, Australia