Privacy Policy
HustleSuite is a multi-platform service. This policy applies to the HustleSuite products, applications, websites and modules operated by us, including Hustle Connect and HustleShield. It explains how we handle personal information when you use our platform, business tools and optional third-party connections. The permissions and data used depend on the features you choose to enable. See our products and websites.
1. Client businesses and their own policies
Independent businesses use our platform to operate their websites, forms, stores, bookings and other services. Those businesses are responsible for publishing their own privacy policies explaining how they collect and use customer information. Please read the policy of the business you interact with. Their policies do not replace this policy for the information HustleSuite processes to operate and protect the platform.
For privacy questions, access, correction or deletion requests, contact privacy@hustlemail.au. Please identify the relevant account and module. Do not send passwords, API keys, verification codes or payment card details.
2. Information we collect
- Account and business information: your name, email address, business details, membership or staff role, contact details and preferences supplied when you register or use a module.
- Information you submit: form responses, uploaded files, content, schedules, orders, invoices and other records that you or your business choose to manage through the service.
- Connection information: the provider, connection name, account identifier, permissions granted, encrypted access credentials or OAuth tokens, verification status and module permissions for connections you configure.
- Service and security records: request times, IP addresses, browser and device information, error reports, delivery status and audit records used to operate, troubleshoot and protect the service. Cookies and browser storage support sessions and preferences; some pages may also use analytics.
3. How we use information
We use information to provide the features you request, authenticate users, enforce ownership and permissions, process forms and schedules, deliver notifications, support accounts, record usage and billing, and prevent abuse. Records submitted to a business are made available to that business and its authorised users according to the feature involved. You should also consult that business's privacy policy.
4. Optional Google connections
Google connections are optional. You choose the Google account and approve permissions on Google's consent screen. We do not ask for or receive your Google password. A verified named connection is available for your use; it does not automatically grant every module permission to run actions.
4.1 Google account identity
We use OpenID Connect and your verified Google email address to identify the Google account attached to a connection. We store the account identifier, email address, connection details and tokens needed to maintain the connection.
4.2 Google Drive
The named Drive connector requests drive.file: access to files that you open with, select for, or create through the application. It supports requested file and backup workflows, including creating, uploading, reading or restoring app-authorised files where the relevant module is enabled. This permission does not provide general access to every file in your Drive. File content is transferred or processed only as needed for the action you request; backup files remain in the selected storage until you or the applicable retention process remove them.
4.3 Google Calendar: scheduling calendar
The managed scheduling connection requests calendar.app.created to create and manage calendars created by the application and their events. It is used to mirror schedules you enable in HustleSuite. Schedule identifiers and synchronisation status are stored so updates, retries and removals can be reconciled. This connection does not grant general editing access to all of your existing calendars.
4.4 Google Calendar: optional private read-only view
A separate optional connection requests calendar.calendarlist.readonly and calendar.events.readonly. These permissions let us list calendars available to your Google account and read events from the calendars you explicitly select for display in your private calendar view. Event information can include titles, dates, times, descriptions, locations and other event details returned by Google. The read-only view does not change those events or export them into the managed scheduling calendar. Selected calendar IDs and view preferences are stored; the private overlay does not persist copies of event bodies in our calendar database.
4.5 Limits on Google data use and sharing
HustleSuite and Hustle Connect's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Google user data is used to provide the connected, user-facing features described above. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI or machine-learning models. Connecting Google does not authorise sending your Drive files or private calendar content to an AI provider. Human access to Google user data is limited to cases permitted by Google's Limited Use requirements, such as your specific permission to investigate a support issue, security investigations, or legal obligations.
5. Service providers and disclosure
We use hosting, storage, network-security, email-delivery and payment providers to operate the service. Information needed for a requested action may be processed by those providers, or by an integration you or your business explicitly enable. Payment gateways process card details through their payment flow; our forms are not intended to store payment card numbers or security codes. Providers and their processing locations vary by feature and may be outside your country. We may also disclose information when legally required or necessary to protect the service and its users.
6. Security
We use HTTPS, encrypted storage for connector secrets and OAuth tokens, ownership and permission checks, and security and audit controls. Access is limited according to the account, business, user and module concerned. No online service can guarantee absolute security. Keep your devices and accounts secure, and report suspected unauthorised access promptly.
7. Retention, disconnection and deletion
Connection details and tokens are retained while needed to support the connection, unless you revoke or remove it. You can revoke Google's access at any time through your Google Account connections. Disconnection stops future authorised API access; it does not automatically delete files already created in your Drive, exported schedules, business records or previously requested backups.
Use the available module controls to remove records, or contact us to request access, correction, export or deletion of your information and stored Google connection data. We verify that the requester is authorised before acting. Operational records are retained according to the feature's retention settings and the need to provide the service, investigate abuse, resolve disputes or meet legal obligations. Deleted data may remain in protected backups until those backups expire; it is not used for normal service operations. Records held independently by a business or third-party provider are also subject to their own retention controls.
8. Your choices
- Choose which optional integrations to connect and which module permissions to enable.
- Choose the calendars displayed in your private view and turn that view off when you no longer need it.
- Revoke third-party access through the provider, and request removal of locally stored connection information.
- Request access to, correction of, or deletion of your personal information using the contact above.
9. Changes to this policy
We may update this policy as features and data practices change. The updated date appears at the top. Material changes to Google data access or use will require the relevant disclosure and consent before that new use begins.