私隱政策 · Privacy Policy

第一部分：私隱政策（繁體中文）

本私隱政策說明 DEPT AI（「我們」）在營運 小保工作台（SiuPo Workspace）（香港保險顧問 AI 工作台）時，如何存取、使用、加密儲存、保護及刪除使用者資料（包括透過 Google OAuth 2.0 授權存取的 Google 使用者資料及 Apple iCloud CalDAV 日曆資料）。

1. 我們存取哪些 Google 使用者資料（Google User Data Accessed）

小保工作台僅在已登入的顧問主動點擊「連結 Google」並完成 Google OAuth 2.0（配合 PKCE S256 驗證）授權後，才會存取以下 Google API 權限範圍（Scopes）：

• 基本身份及電郵識別（openid、email / userinfo.email）：透過 https://openidconnect.googleapis.com/v1/userinfo 讀取你授權的 Google 帳戶電郵地址及電郵驗證狀態（email_verified），用於識別並於工作台介面顯示已連結的 Google 帳戶。
• Google Calendar 行程讀寫權限（https://www.googleapis.com/auth/calendar.events）：透過 Google Calendar API v3（/calendars/primary/events）讀取、建立、更新及刪除你本人主要 Google 日曆（primary calendar）內的行程資料，包括行程識別碼（id、iCalUID）、標題（summary）、備註說明（description）、地點（location）、開始與結束時間（start、end）、全日標記、狀態（confirmed / tentative / cancelled）、版本標籤（etag、updated）、行程連結（htmlLink）及小保內部對應識別欄位（extendedProperties.private.siupoMeetingId 及 siupoClientId）。

我們不會索取你的 Google 帳戶密碼，亦不會透過顧問個人日曆授權存取你的 Gmail、Google Drive 私人檔案或 Google Contacts。

2. 我們如何使用 Google 使用者資料（How Google User Data Is Used）

從 Google API 取得的資料僅用於提供工作台內置日曆與你個人 Google Calendar 之間的雙向同步功能（Two-Way Calendar Synchronization Only）：

• 讀取外部行程並同步至工作台：讀取過去 30 日至未來 180 日時間窗內的日曆行程，並透過增量同步權杖（syncToken）及可選的 Google Push Notification Webhook（events.watch）更新變更，讓你於小保工作台月曆及日程頁面一併檢視外部行程與客戶會面，避免排程衝突。
• 從工作台回寫行程至 Google Calendar：當你在工作台新增、編輯或刪除會面／日曆行程並選擇同步至 Google Calendar 時，系統會將該行程寫入、更新（配合 If-Match ETag 衝突保護）或從你的 primary Google Calendar 移除。系統只寫入你本人的日曆，不會自動向客戶發送外部日曆邀請電郵。
• 跨來源去重與衝突處理：系統根據會面 ID、iCalUID 或標準化時間與標題將重複行程合併顯示，並以最後修改時間（Last-Write-Wins）處理同步更新。

3. Apple Calendar（iCloud CalDAV）憑證與資料處理

如你選擇連結 Apple Calendar，你需提供 Apple ID 電郵及於 appleid.apple.com 產生的「App 專用密碼（App-Specific Password）」（切勿輸入你的主要 Apple ID 登入密碼）。伺服器僅使用該專用密碼透過 HTTPS CalDAV（PROPFIND、REPORT、PUT、DELETE）探索支援 VEVENT 的日曆並執行雙向 .ics 行程同步。你的 Apple ID 及專用密碼在寫入資料庫前，均於伺服器端以 AES-GCM（256-bit）加密保存，絕不以明文儲存或回傳至瀏覽器。

4. 資料儲存與安全保護（Storage & Security）

• 基礎設施邊界：網站及 API 部署於 Vercel；結構化資料庫儲存於 Cloudflare D1（透過需專用伺服器權杖驗證的私有 Cloudflare Worker siupo-workspace-storage 存取）；私人保單及客戶 PDF 文件儲存於私有 Cloudflare R2 儲存桶，僅於驗證登入及顧問權限後簽發短效讀取／上載連結。
• 權杖與憑證靜態加密（Encryption at Rest）：Google OAuth access_token、refresh_token 以及 Apple CalDAV 專用密碼均在伺服器端使用由 ENCRYPTION_KEY（SHA-256 衍生 256-bit 金鑰）配合每次隨機產生的 12-byte IV 進行 AES-GCM 認證加密，然後才存入 Cloudflare D1 的 calendar_connections 及 secrets 資料表。
• 傳輸安全與帳戶隔離：所有網絡傳輸均採用 HTTPS / TLS 加密。使用者登入密碼以 scrypt 雜湊處理，登入 Session 僅在資料庫保存 SHA-256 雜湊並使用 Secure、HttpOnly、SameSite=Lax Cookie。每位顧問的日曆連結及 calendar_events 記錄均嚴格綁定其 workspace_id 及 user_id，其他顧問無法讀取你的個人日曆憑證或未關聯客戶的私人外部行程。

5. 資料保留、中斷連結與刪除機制（Retention, Disconnection & Deletion）

• 保留期間：加密的日曆授權憑證及同步行程快取僅在你維持日曆連結期間保留，以便提供持續雙向同步。
• 於工作台內即時中斷連結及清除資料：你可隨時於小保工作台「日程與跟進 → 個人日曆連結設定」點擊 Google Calendar 或 Apple Calendar 旁的「中斷」按鈕。中斷連結時，系統會：(1) 嘗試停止已註冊的 Google Calendar Webhook 通道（channels/stop）；及 (2) 即時從 Cloudflare D1 刪除該日曆供應商在 calendar_connections 及 secrets 中的加密憑證，以及在 calendar_events 中儲存的所有同步行程記錄。
• 於第三方平台撤銷授權：你亦可隨時前往 Google 帳戶安全性與第三方應用程式權限設定（myaccount.google.com/permissions） 直接撤銷小保工作台的存取權，或前往 appleid.apple.com 撤銷 Apple 應用程式專用密碼。
• 申請完整資料刪除或查閱：如需查閱、更正或要求刪除你的工作台帳戶、客戶記錄或任何已儲存資料，請以註冊電郵發信至 chat@deptai.work。我們會在核實身份後盡快完成刪除並回覆確認。

6. 不出售、不作廣告用途、不用於 AI 模型訓練及 Google「有限用途（Limited Use）」承諾

• 絕不出售或轉讓（No Sale or Unauthorized Transfer）：DEPT AI 絕不出售、出租、交換或向任何第三方轉讓你的 Google 使用者資料、Apple 日曆資料或客戶資料（除提供本服務所必需的基礎設施供應商 Vercel 及 Cloudflare 外）。
• 絕不用於廣告投放（No Advertising Use）：Google 使用者資料絕不用於任何廣告宣傳、個人化廣告定向、再行銷（Retargeting）或信貸評級用途。
• 絕不用於訓練 AI 模型（No AI / ML Model Training）：從 Google API 取得的日曆資料及 Google 使用者資料絕不會傳送予人工智能模型作訓練、微調（Fine-tuning）或改善任何通用／基礎 AI 模型。工作台內的 AI 輔助功能僅在顧問明確要求整理指定客戶會前摘要或文件草稿時執行推論，且不會將你的個人 Google Calendar 資料用於訓練任何 AI 模型。

7. 其他工作台功能之資料處理說明

• 語音輸入轉錄：使用語音輸入時，音訊會經伺服器傳送至 Groq Whisper 作語音轉文字處理；小保不儲存原始錄音檔。
• 見客練習：見客練習採用虛構客戶設定，經短效權杖連接 xAI 語音服務作即時對話練習，不會讀取真實 CRM 客戶資料，亦不在伺服器保存練習音訊或對話紀錄。請勿在練習中輸入真實客戶個人資料。
• 裝置推送通知（Web Push）：使用者可自願開啟瀏覽器／iPad 主畫面推送通知；訂閱端點以 AES-GCM 加密儲存並綁定登入 Session，登出後即停止推送，且鎖定畫面通知不包含客戶姓名或財務細節。

Part II: Privacy Policy (English)

This Privacy Policy explains how DEPT AI (“we”, “us”, or “our”) accesses, uses, stores, secures, and deletes user data when operating SiuPo Workspace (小保工作台), including Google user data accessed via Google OAuth 2.0 and Apple Calendar data accessed via iCloud CalDAV.

1. What Google User Data We Access

SiuPo Workspace only accesses Google user data when an authenticated advisor explicitly initiates the “Connect Google” flow and grants consent via Google OAuth 2.0 (using Authorization Code with PKCE S256). We request the following scopes:

• Account Identity (openid, email / userinfo.email): Accessed via https://openidconnect.googleapis.com/v1/userinfo to read your verified Google email address (email_verified) solely to identify and display which Google account is linked to your workspace profile.
• Google Calendar Events (https://www.googleapis.com/auth/calendar.events): Accessed via the Google Calendar API v3 (/calendars/primary/events) to read, create, update, and delete calendar events on your primary Google Calendar. Fields accessed include event ID (id, iCalUID), title (summary), notes (description), location, start and end timestamps (start, end), all-day flag, event status (confirmed, tentative, cancelled), concurrency metadata (etag, updated), event link (htmlLink), and private sync identifiers (extendedProperties.private.siupoMeetingId and siupoClientId).

We never collect your Google password, and our user-facing calendar OAuth flow does not request access to Gmail, Google Contacts, or personal Google Drive files.

2. How We Use Google User Data

Google user data is used exclusively to provide two-way synchronization between your in-app SiuPo calendar and your primary Google Calendar:

• Inbound Sync (Read): We read events from your primary Google Calendar (covering a window from 30 days in the past to 180 days in the future, followed by incremental updates via syncToken and optional Google Calendar events.watch push webhook notifications) so your existing schedule appears alongside client meetings inside the in-app calendar.
• Outbound Sync (Write): When you create, edit, or delete a meeting or calendar event in SiuPo Workspace and select Google Calendar synchronization, we create, update (using If-Match ETag conflict checks), or delete the corresponding event on your primary Google Calendar. We do not automatically send calendar invitations to external attendees.
• Deduplication & Conflict Resolution: Matching events across internal meetings and connected calendars are deduplicated for display and resolved using Last-Write-Wins timestamps.

3. Apple Calendar (iCloud CalDAV) Credentials Handling

If you optionally connect Apple Calendar, you provide your Apple ID email and an App-Specific Password generated at appleid.apple.com (never your main Apple account password). Our server uses these credentials solely over HTTPS CalDAV (PROPFIND, REPORT, PUT, DELETE) to discover your VEVENT calendar and perform two-way .ics event synchronization. Your Apple ID and App-Specific Password are encrypted on the server using AES-GCM (256-bit) before storage in Cloudflare D1 and are never logged or returned in plaintext.

4. Data Storage and Security

• Cloudflare D1 & R2 Storage: The web application and API run on Vercel. Structured records, encrypted credentials, and synced calendar event caches are stored in Cloudflare D1 behind a token-authenticated private Cloudflare Worker (siupo-workspace-storage). Private PDF documents are stored in Cloudflare R2 and accessed only via short-lived signed URLs after session and advisor scope checks.
• Token Encryption at Rest: Google OAuth access_token and refresh_token values, as well as Apple CalDAV App-Specific Passwords, are encrypted on the server using AES-GCM (256-bit key) with a unique 12-byte random IV per write (derived via SHA-256 from the server-only ENCRYPTION_KEY secret) before being persisted in the calendar_connections and secrets tables in Cloudflare D1.
• Access Control & Isolation: All data in transit is encrypted via HTTPS/TLS. Each user's calendar connection and synced calendar_events rows are strictly scoped to their authenticated workspace_id and user_id. Other workspace members cannot access your OAuth tokens or personal calendar connection.

5. Retention, Disconnection, and Deletion

• Retention: Encrypted calendar tokens and synced event records in Cloudflare D1 are retained only while your calendar connection remains active.
• In-App Disconnect & Immediate Deletion: You can disconnect Google Calendar or Apple Calendar at any time in the workspace under Calendar Settings (“日程與跟進 → 個人日曆連結設定 → 中斷 / Disconnect”). When you disconnect: (1) any active Google webhook channel is stopped via Google's channels/stop endpoint, and (2) your encrypted credentials in calendar_connections and secrets and all cached events for that provider in calendar_events are immediately deleted from Cloudflare D1.
• Revoking Access at the Provider: You may also revoke SiuPo Workspace's Google OAuth access at any time at https://myaccount.google.com/permissions, or revoke your Apple App-Specific Password at https://appleid.apple.com.
• Data Deletion Requests: To request complete deletion or export of your user account, workspace records, or any stored data, email chat@deptai.work. We verify the requester's identity and complete deletion requests promptly.

6. No Sale/Transfer, No Advertising, No AI Model Training, and Google Limited Use Compliance

• No Sale or Transfer: DEPT AI does not sell, rent, license, trade, or transfer Google user data (or any calendar or client data) to third parties, except to infrastructure sub-processors (Vercel and Cloudflare) strictly necessary to host and operate the service.
• No Advertising: Google user data is never used for serving advertisements, ad targeting, retargeting, user profiling, or creditworthiness evaluation.
• No AI / ML Model Training: Google user data (including Google Calendar events and metadata) and Apple Calendar data are never used to train, fine-tune, or improve any generalized, foundational, or third-party artificial intelligence or machine learning models.

聯絡我們及法定實體資料 · Contact & Legal Entity

營運方 / Operator： DEPT AI（由 Cyborg Consulting Limited 營運 / operated by Cyborg Consulting Limited）
電郵 / Email： chat@deptai.work
生效日期 / Effective Date： 2026-10-19