The short version: Base9 CRM reads your Gmail and Google Calendar to build your CRM automatically. We store only what's needed to run the product. We never sell your data, never send email on your behalf, and never use your data to train AI models.
What we access
When you connect your Google account, Base9 requests the following OAuth scopes:
Gmail read-only — we read email metadata (sender, recipient, subject, date) and message body previews to build your contact list and relationship context. We never send email on your behalf.
Google Calendar read-only — we read your calendar events to surface upcoming meetings and auto-complete meeting-prep tasks after a meeting passes. We never create or modify events.
What we store
Email metadata — sender/recipient email addresses, dates, subjects, and short body previews used to generate relationship context and AI summaries.
Contact records — names and email addresses extracted from your email history, linked to company domains.
Meeting records — event titles, dates, and attendees from your calendar.
AI-generated content — relationship summaries, task descriptions, and email drafts generated from your data and stored so they load instantly.
Notes and outcomes — anything you manually add inside the product (notes, task resolution outcomes, pipeline stage changes).
Inbound leads — if you use the inbound webhook, we store name, email, company, and message from website form submissions.
All data is stored in a private Supabase (PostgreSQL) database. Each user's data is fully isolated by row-level security — no user can access another user's data.
What we don't do
We do not sell your data to any third party.
We do not use your email content or contact data to train AI models.
We do not send email on your behalf, ever.
We do not share your data with advertisers.
We do not read email threads unrelated to your business contacts (personal domains like Gmail, iCloud, and Outlook are filtered out automatically).
AI and third-party services
Base9 uses Google Gemini to generate relationship summaries, task descriptions, and email drafts. To do this, excerpts of your email history and meeting data are sent to Google's Gemini API. Google's data processing terms apply to this usage. We use thinkingBudget: 0 (fast mode) and do not opt in to model training.
Authentication and data storage are handled by Supabase. Your data is stored in their managed Postgres infrastructure.
Data retention and deletion
You can disconnect your Google account at any time from Settings. To permanently delete your account and all associated data, use the "Delete account" option in Settings. Deletion is immediate and irreversible — all companies, contacts, emails, meetings, notes, and AI-generated content are removed.
If you'd prefer we handle deletion manually, email contact@base9.io.
Security
All data is transmitted over HTTPS.
OAuth tokens are stored encrypted and never exposed to the frontend.
Row-level security ensures your data is never accessible to other users.
We use Supabase Auth with Google OAuth — we never see or store your Google password.