Privacy Policy

1. Who we are

Tess (“the Service”) is operated by Tech Direct Support(“we”, “us”), based in Australia. We are the data controller for the information described here. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Questions, access requests and deletion requests: operations@techdirectsupport.com.au.

2. What we collect

Account information

Your email address and a securely hashed password. We never see or store your password in readable form.

Assistant content

The calendar events, tasks and contacts you create through Tess, or that are imported from a calendar you connect. This includes event titles, times, locations, attendee names, task titles and due dates, and contact names, emails, roles and companies.

Conversation transcripts

The text of what you say to Tess and what they say back, so you have a record of the conversation. We do not store the audio of your voice.

Preferences

Your chosen assistant voice.

Calendar connection credentials

If you connect a calendar, we store the access and refresh tokens that authorise us to act on it, along with the email address of the connected account and bookkeeping about when we last synchronised.

What we do not collect

We run no analytics, advertising or tracking of any kind. There are no third-party trackers, no advertising identifiers, and no cookies beyond the one that keeps you signed in.

3. Data from Google APIs

If you connect Google Calendar, we request the https://www.googleapis.com/auth/calendar.events scope, plus your email address for labelling the connection. We deliberately do not request the broader calendar scope, which would also allow creating, deleting and re-sharing entire calendars.

We use that access for exactly two things:

Reading your events so Tess can answer questions about your schedule.
Creating and rescheduling events when you ask them to.

Tess’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not and will not:

use Google user data for advertising, profiling or credit assessment;
sell Google user data, or transfer it to data brokers or resellers;
allow humans to read your Google user data, except with your explicit permission, where necessary for security or to comply with the law, or on data that has been aggregated and anonymised;
use Google user data for any purpose other than providing and improving the assistant features described above.

4. Data from Microsoft 365

If you connect Microsoft, we request Calendars.ReadWrite, offline_access and User.Read through Microsoft Graph, and use them for the same two purposes. Because the Teams calendar and the Outlook calendar are the same Exchange Online mailbox, one connection covers both.

5. How voice processing works

When you speak to Tess, your browser opens a connection directly to Google’s Gemini Live service. Audio does not pass through our servers and we never receive or retain it. Google processes the audio to produce speech and a transcript; we store only the transcript.

Your microphone is only active while a voice session is running, and your browser will show its own recording indicator throughout.

6. Artificial intelligence processing

Tess is built on Google’s Gemini models. To answer a question, the relevant assistant content — the events, tasks or contacts needed for that request — is sent to the Gemini API for processing, together with your instruction. Google’s handling of that content is governed by the Gemini API terms, which differ by service tier.

While Tess is in early access it may run on Google’s free evaluation tier, on which Google may use submitted content to improve its services. For that reason we ask early-access users not to connect calendars containing confidential or sensitive material until we confirm the Service has moved to a paid tier, where content is not used for model training. If this matters to your deployment, contact us before connecting a calendar.

7. Who else processes your data

We use a small number of service providers, all under their own terms:

Supabase — database and authentication hosting.
Vercel — application hosting and delivery.
Google — Gemini models for voice and reasoning; Google Calendar API if you connect it.
Microsoft — Microsoft Graph, if you connect a Microsoft calendar.

These providers operate infrastructure outside Australia, so your information may be processed overseas, including in the United States. We do not sell your information or share it with anyone else.

8. How we protect it

All traffic is encrypted in transit; the Service is served only over HTTPS.
Every record is tied to one account and isolated by database-level row security, so the database itself refuses to return another account’s rows — isolation does not depend on application code being correct.
Calendar tokens are held in a table that no browser session can read. They are reachable only by server-side code, because a leaked refresh token would otherwise grant long-lived access to your real calendar.
Credentials are never included in logs or error messages.

No system is perfectly secure. If a breach affects your information we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

9. How long we keep it

Assistant content and transcripts — until you delete them or close your account.
Calendar tokens — until you disconnect that calendar. On disconnection we delete the token, revoke it with the provider where the provider supports revocation, and remove the events imported from it.
Account information — until you ask us to close the account, after which it is deleted.

10. Your rights

You may at any time:

ask for a copy of the personal information we hold about you;
ask us to correct it;
disconnect a calendar yourself, in Settings;
ask us to delete your data or close your account;
revoke our access independently — at Google account permissions or Microsoft My Apps.

Write to operations@techdirectsupport.com.au and we will respond within 30 days. If you are unhappy with our response you may complain to the Office of the Australian Information Commissioner.

11. Children

The Service is intended for use by businesses and is not directed at anyone under 16. We do not knowingly collect information from children.

12. Changes

We will update this page when our practices change and revise the date at the top. If a change materially affects how we use your information, we will tell you directly.