Legal | Origen Agency

Privacy policy

Last updated: 29 May 2026

At Origen Agency («we», «our») we take seriously the privacy of the personal data we process when providing our B2B lead generation services and our CRM. This policy describes how we collect, use, store and protect information when you use our website and the Origen Agency CRM platform at crm.origenagency.com.

1. Data we collect

1.1 Data you provide to us

Name, corporate email, phone and company when you register or contact us.
B2B lead information that you enter or import into the CRM (name, email, company, sector, website, notes).
Content that you write in email templates, internal notes and campaigns.

1.2 Data we obtain when connecting Google

If you authorize the integration with your Google account, we access:

Google Calendar to create, read and modify events related to meetings scheduled through the CRM (scopes: calendar.events, calendar.readonly).
Gmail exclusively to send scheduled emails from the CRM as if they were yours (scope: gmail.send). We do not read, store or access other emails in your inbox.
Basic email, name and profile picture (scopes: openid email profile).

1.3 Technical data

Usage logs (action timestamps, errors) for diagnostics.
IP address and user-agent for security.

2. How we use the data

To provide the CRM service and all of its features.
To schedule meetings in your calendar and send confirmation/reminder/follow-up emails to your leads.
To generate the client's internal reports and statistics.
To communicate important service changes, technical support and news to you (you can unsubscribe at any time).

3. Limited Use: Google API Services

Origen Agency CRM's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We do not sell the data obtained from Google APIs.
We do not use the data to serve advertisements.
We do not share it with third parties beyond what is strictly necessary to operate the service (providers listed below).
It is not read by humans except: a) with your express consent, b) for security, c) to comply with applicable law, or d) when the data is anonymized and aggregated to improve the service.

4. Storage and providers

The data is stored in secure infrastructure, encrypted at rest and in transit:

Supabase (Frankfurt, EU): PostgreSQL database and authentication.
Resend : email delivery provider (fallback when you do not use your own Gmail).
Anthropic Claude API : AI processing when you use features such as «Personalize with AI». The content sent to Claude is not used for training.

5. Retention and deletion

We retain your data for as long as your account is active. When you request the deletion of your account:

We delete all of your personal data and that of the leads you imported.
We revoke the Google OAuth tokens associated with your account.
Anonymized logs may be retained for up to 90 days for security auditing.

You can request deletion by writing to us at d.garcia@origenagency.com.

6. Revoking Google access

You can revoke Origen Agency CRM's access to your Google account at any time from https://myaccount.google.com/permissions. When you do so, we will no longer be able to create events in your calendar or send emails on your behalf.

7. Your rights (GDPR)

As a user in the EEA you have the right to:

Access the data we hold about you.
Rectify incorrect data.
Request erasure («right to be forgotten»).
Portability of your data in a structured format.
Object to the processing.
Lodge a complaint with the Spanish Data Protection Agency (AEPD) (aepd.es).

8. Cookies

We use strictly necessary cookies to keep your session logged in. We do not use advertising tracking cookies. For more details, please see our Cookies Policy.

9. Third-party links

Our website may contain links to other sites. Once you leave our website we have no control over the destination. Those sites have their own policies, and we recommend that you review them.

10. Changes to this policy

We may update this policy. If there are substantial changes, we will notify you by email at least 30 days in advance. The current version will always be at this URL.

11. Contact

For any privacy inquiries: