Privacy Policy
How Athena protects account, CRM and connected-channel data.
Website cookies and measurement
Essential cookies support sign-in, security and your saved privacy choice. Our public marketing pages offer separate optional choices for Google Analytics and Meta Pixel. These providers load only after the relevant choice. Analytics measure page visits and booking steps; a booking completion is measured only after Athena reports success. The events we implement exclude names, email addresses, phone numbers, property addresses, access tokens and CRM content. Meta may associate permitted marketing activity with your Meta account under its own privacy policy. Rejecting optional cookies does not prevent booking or using your account. Change your choice at any time using Cookie preferences at the bottom of the public site or booking page. We store your choice for up to 180 days. A Global Privacy Control signal disables our optional Meta marketing cookies.
Cookies: tus opciones
Las cookies esenciales permiten iniciar sesión, proteger tu cuenta y recordar tu elección. Google Analytics y Meta Pixel son opcionales y se cargan después de tu autorización. Puedes rechazar ambas opciones o cambiarlas desde Preferencias de cookies al pie del sitio público o la página de reservas. Rechazarlas no impide reservar. Guardamos tu elección hasta 180 días y respetamos Global Privacy Control desactivando las cookies de marketing de Meta.
Information we process
We process the account details, customer relationship records and channel metadata needed to provide the Athena Portal and CRM. When you connect Meta, Google, Microsoft or Twilio, we process only the permissions and data required for the features you choose to use.
How information is used
Information is used to authenticate your account, synchronize authorized leads and conversations, send communications you approve, provide support, prevent abuse and improve service reliability. Athena does not sell personal information or use customer CRM data to advertise to unrelated third parties. Mobile opt-in data and consent are not shared with third parties or affiliates for marketing or promotional purposes.
Google email and calendar data
When you connect Gmail, Athena accesses your account identity and inbox messages (sender, recipients, subject, message text and thread identifiers) to display and synchronize conversations in your CRM. Sending requires your action or an automation you enable. Attachments are not downloaded by this inbox integration. The separate team calendar connection accesses availability and creates, updates or removes appointments for Athena shoots. These features request their own permissions.
Optional AI drafts
Only when you confirm an AI draft request, Athena sends the selected contact's name, inquiry text, property address, your draft and instructions, and your agent name to OpenAI to prepare that draft. Inquiry text can originate from connected email. Your entire mailbox, OAuth tokens and unrelated conversations are not included. Drafts require your review before sending. Requests disable response storage; this does not mean zero data retention. OpenAI may retain API content for abuse monitoring under its applicable data controls. Athena does not use connected Google data to train general-purpose AI models.
Limited use of Google data
Athena's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and its Limited Use requirements. Google data is used only for the user-facing functions described here, not sold or used for advertising, credit decisions, or training general-purpose models. Human access is limited to user-authorized support, security investigation, or legal requirements.
Connected accounts
Connected providers remain subject to their own terms. You can disconnect a provider from the CRM integrations area. Disconnecting stops new synchronization, removes the local credential when no connected channel still uses it, and cancels unsent queued emails from the disconnected default mailbox. Existing CRM conversations and explicitly created contacts are retained until you request deletion. A request already accepted by a provider cannot be recalled. You can also revoke Athena in your provider account settings; that may affect other Athena connections to that Google account.
Public WhatsApp choices
Agent-site and property inquiry forms offer optional WhatsApp choices for the named agent: inquiry and appointment follow-up, with a separate choice for property news and promotions. We record the chosen scope, phone number, disclosure text and version, language, form source and acceptance time with the inquiry. A form submission records your stated choice; it does not verify ownership of the phone number. SMS permission does not grant WhatsApp permission.
Data protection mechanisms
Athena uses HTTPS to protect data transmitted between your browser, Athena services and Google APIs. Stored Google OAuth credentials are encrypted on the server using AES-256-GCM. Encryption keys are provided through server-side configuration rather than included in credential records or returned to the browser. These safeguards protect access to connected Gmail and Google Calendar accounts.
Access and authorization controls
Access to private CRM records in the Portal requires an authenticated session and is scoped to the customer workspace associated with that session. Google authorization uses short-lived, single-use OAuth state, PKCE and an additional browser-bound verification cookie marked HttpOnly and Secure. CRM changes requested through the Portal are subject to origin checks. The application requests the permissions needed for the connected features and checks the permissions granted by the user.
Protection of private CRM responses
Private Portal CRM API responses instruct browsers and intermediaries not to cache them and suppress referrer information. Connected-account credentials remain on the server and are not included in the connection details returned to the Portal. Optional AI drafting uses the selected context and confirmation described above; OAuth credentials are not included in those requests.
Data retention
Records are retained only as needed to provide the service, meet legal obligations and resolve security incidents. Disconnecting a provider and deleting stored CRM history are separate actions, as described under Connected accounts and Your choices.
Your choices
You may request access, correction, export or deletion of your personal information. Contact javier.pena@athenavisualsstudio.com from the email associated with your account.
Contact
Athena Visuals Studio · Athena Creative Group LLC · Southwest Florida · javier.pena@athenavisualsstudio.com · (239) 365-6933.