Legal information
Privacy policy
What we do with data from the website, the application and your Google account.
Updated: 5 November 2026
Data controller
CANIGOU & CO EURL, 9 rue des Colonnes, 75002 Paris, France, publisher of www.getpax.com and of the GetPax application (app.getpax.com) (see the legal notice). Contact: contact@heep.ai.
Scope
This policy covers two sets of data: those of the www.getpax.com marketing website (demo form) and those of the GetPax application, a sales assistant for events sales teams (restaurants, venues, caterers) that can connect to your Google account.
Website data: demo form
The "Book a demo" form collects your name, the name of your venue (optional), your work email address and the size of your sales team, as well as the page and language from which you send it. This information is used only to contact you to arrange a demonstration and to answer your request (Article 6(1)(b) GDPR).
Application data
When you use the application, we process your account data (name, work email address, venue), the enquiries from customers and prospects you centralise in it (contact details, dates, guest numbers, budget, correspondence), and your menus, rooms, prices and quotes. We process them to provide the service you requested, on the basis of performance of the contract (Article 6(1)(b) GDPR). Data from your Google account is also governed by the next, stricter section.
Google user data
This section applies to the GetPax application (app.getpax.com), developed and operated by CANIGOU & CO EURL, when you choose to connect your Google account. Connecting is optional: GetPax asks for your explicit permission through Google's consent screen, and you can refuse or grant only some permissions. For Google data, this section prevails over any other section of this policy.
Google data we access
Depending on the permissions you grant, GetPax accesses the following data:
- Google profile (Google Sign-In): your name, email address and profile picture.
- Gmail, read: the emails in your mailbox (sender, recipients, subject, date, body and attachments).
- Gmail, send: sending, from your address, the emails you approve in GetPax.
- Google Calendar, read: the events in your calendars (title, date, times, location, attendees).
- Google Calendar, calendar created by GetPax: creating a GetPax calendar in your account and managing its own events only.
How we use Google data: solely for GetPax features
GetPax uses Google user data solely to provide or improve user-facing features that are prominent in the GetPax user interface, and for no other purpose. Each permission serves a feature you see and use:
- Google profile: creating your GetPax account and signing you in.
- Gmail, read: showing your customers' enquiries (private hire, events, quotes) in the GetPax inbox, linking them to the right contact or deal, and suggesting a draft reply for you to review.
- Gmail, send: sending the reply, quote or follow-up you approved; no email is sent without your action.
- Google Calendar, read: showing your availability in GetPax and flagging date or room conflicts.
- Google Calendar, calendar created by GetPax: adding the events you confirm in GetPax.
"Improve" refers only to these features and to your account (for example, how reliably enquiries are filed in your GetPax inbox). Google data is not used for any other product or service, including other CANIGOU & CO services.
What GetPax does not do with Google data
GetPax does not use, transfer or sell Google user data:
- to serve advertising, including targeted, personalised, retargeted or interest-based advertising;
- for prospecting, marketing or profiling, nor for analytics: it is never sent to Google Analytics or any other analytics tool;
- for data brokers or information resellers, nor to build or enrich databases;
- to determine creditworthiness or for lending purposes;
- to develop, improve or train generalised or non-personalised AI and/or ML models.
Artificial intelligence
Draft replies and enquiry filing are produced by an AI model (Cloudflare Workers AI), called at processing time for your account only. GetPax does not use data obtained from Google Workspace APIs to develop, improve or train generalised or non-personalised AI and/or ML models. Cloudflare processes this data on our behalf only, without retaining it beyond processing or using it to train its models.
Sharing, transfer and disclosure
GetPax transfers or discloses Google user data to third parties only:
- to provide or improve the features described above, to our sole processor Cloudflare, Inc. (hosting and AI model), bound by contract, acting only on our instructions and not reusing the data for its own purposes;
- to send an email you approved to its recipients, at your request;
- where required by law, or for the security of users and of the service (preventing abuse);
- in the event of a merger, acquisition or sale of assets, under the same commitments and after notifying you.
Technical error reports (Sentry) contain no Google data.
No human at GetPax reads your Google data, except with your explicit consent for specific messages (for example for a support request), for security purposes (investigating abuse or a vulnerability), or to comply with the law.
Data protection
Data is transmitted only over encrypted connections (HTTPS/TLS) and stored encrypted. Google access tokens are encrypted, kept server-side and used only by the service. Access to our systems is restricted to the team members who need it, protected by strong authentication, and logged.
Retention and deletion
Google data is kept as long as your Google account is connected to GetPax and it is needed for the features described above. When you disconnect your Google account or close your GetPax account, we revoke our access tokens and delete Google data within 30 days at the latest, unless the law requires us to keep it.
At any time, you can:
- disconnect Google from the GetPax settings;
- revoke access from your Google account (myaccount.google.com/permissions);
- request deletion of your data by writing to contact@heep.ai: we act on it within 30 days.
Compliance with Google's policy
GetPax's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Recipients and processors
Data is never sold or transferred. It is accessible only to the members of the GetPax team who need it. Cloudflare, Inc. hosts the website and the application as a processor. Functional Software, Inc. (Sentry) receives, as a processor, technical error reports from the website and the application (error message, page concerned without its parameters, browser), without IP address, form content or any Google data, kept for no more than 90 days in the European Union. Only with your consent, Google Ireland Limited (Google Analytics) receives visit statistics from the marketing website (see “Cookies and analytics”), never application data or Google user data. These services may involve a transfer outside the European Union, governed by the European Commission's standard contractual clauses and, for Google, by the EU–US Data Privacy Framework.
Retention period
Demo form requests are kept for no more than three years after the last contact, then deleted. Application data is kept for the duration of the contract, then deleted within 30 days, unless the law requires otherwise.
Bot protection
The form is protected by Cloudflare Turnstile, which checks that it is sent by a person. Turnstile is only loaded when you use the form and processes technical information (IP address, browser) solely for this check.
Cookies and analytics
Only with your consent, the marketing website uses Google Analytics to measure its audience (page views, journeys, traffic sources, demo form submissions). No Google tag is loaded until you have made a choice, and refusing has no effect on your browsing. Google Analytics cookies (_ga, _ga_…) are kept for no more than 13 months; visit data is kept for 14 months in Google Analytics. Legal basis: your consent (Article 6(1)(a) GDPR and Article 82 of the French Data Protection Act).
Your choice is stored in a strictly necessary getpax_consent cookie, kept for 6 months. You can change it or withdraw your consent at any time with the “Manage cookies” button at the bottom of every page: analytics cookies are then deleted.
Logged-in users (administration, application) also receive a session cookie needed to sign in. The GetPax application sets no analytics or advertising cookies.
Your rights
You can access, correct or erase your data, object to its processing, or ask for it to be restricted or ported by writing to contact@heep.ai. You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
Changes
We may update this policy; the update date is shown at the top of the page. Any new use of Google data will be notified to you and will apply only after you consent again.