Privacy Policy

Privacy policy

Updated: 17 September 2026

This policy explains how Niwa AI handles information through niwachat.com, its WordPress plugin, Niwa CRM and the Niwa connection relay. A website operator who installs Niwa controls that website’s customer records, access permissions, hosting and backups. The operator’s own privacy notice also applies to that installation.

Information used by Niwa

Depending on the features you enable, Niwa processes account and installation details through Freemius for licensing, WooCommerce catalog information for shopping assistance, and the messages, files and business records you provide for requested tasks. Conversations, agent transcripts and operational memory can be stored on the WordPress installation until its operator deletes them. They are not necessarily temporary.

We use this information to provide the features you request, administer subscriptions, maintain service security and support the product. Improving an individual response or retrieving relevant context does not mean permission to train a general-purpose AI model on Google data.

Google Calendar data

Access and purpose

Connecting Google Calendar is optional. Niwa uses your Google account identifier and email address to identify the connection. It requests access to events on calendars you own and to your availability. The current integration uses your primary calendar. It does not request permission to manage calendar sharing, Gmail or Google Drive.

Niwa reads busy time intervals to prevent conflicting bookings. It creates, updates and cancels Google events for appointments you manage in Niwa. Niwa CRM also synchronizes changes in both directions, using event titles, descriptions, start and end times, time zones, all-day status, event identifiers, version tags and cancellation status. The initial CRM import covers the previous 12 and next 24 months; this is an import window, not an automatic retention limit. Previously imported events remain until deleted.

Storage, transfers and security

Google sign-in and consent take place on Google. The central Niwa relay exchanges authorization codes and issues an encrypted connection credential bound to the requesting WordPress installation. Calendar event requests run between that installation and Google. Calendar event bodies do not pass through the relay’s OAuth endpoints.

The installation stores its connection credential encrypted using its WordPress secrets. The connector contains an encrypted Google refresh token; short-lived access tokens are used server-side. The relay verifies signed installation requests and does not provide credentials to an AI model. Temporary authorization state expires after 10 minutes, and connection exchange codes after 5 minutes.

Imported events and synchronization records are stored in the installation’s WordPress database. CRM recovery history may contain earlier versions. Access is limited by the installation’s user roles and connector permissions. Connections use HTTPS. Encryption, access controls and request validation reduce risk; no service can promise that a breach is impossible.

AI assistance and external agents

When you ask Niwa or an authorized agent to work with calendar information, relevant Google data and resulting summaries may be sent to the configured AI provider to carry out that request. Providers can include OpenAI through ChatGPT/Codex or its API, or OpenRouter and the model providers selected through it. Optional semantic retrieval can use an approved API provider or Niwa’s central OpenAI embedding service. Freemius is used for licensing and installation validation, not for receiving calendar event content.

Before AI processing is enabled on an installation that uses Google Calendar, the operator must configure the AI account to exclude inputs and outputs from generalized model training and confirm those controls in Niwa. Confirmation is bound to the specific account or API key. A different, unconfirmed account is blocked. Niwa cannot independently read a user’s ChatGPT or other provider’s privacy settings; the operator must keep the declared controls enabled. For ChatGPT, turn off “Improve the model for everyone” in Settings, Data Controls. API users must also disable any training or data-sharing opt-in.

Niwa sets Responses requests to store=false when these Google-data protections apply. For OpenRouter it also requests providers that deny data collection and support zero data retention. These request controls do not replace account settings or the provider’s applicable security, abuse-monitoring and legal obligations.

External MCP agents need a separate owner-confirmed connector for the specified agent and AI account, with training disabled and the same restrictions on raw and derived Google data. Niwa cannot detect a remote agent switching accounts. The operator must revoke and replace its connector when the remote account or data-use conditions change.

Niwa AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data, including aggregated, anonymized, summarized or otherwise derived data, is used only for the authorized, visible user-facing features. It is not used to train or improve generalized AI or machine-learning models, sold to data brokers, used for advertising or used to assess creditworthiness. Human access is limited to your affirmative agreement, necessary security investigation, legal requirements or other uses expressly permitted by that policy.

Retention, disconnection and deletion

Connection credentials remain on your installation until you disconnect. Disconnect requests revocation at Google and removes the local credential after revocation is confirmed. If revocation fails, Niwa reports the failure and retains the credential so you can retry. You can also remove Niwa AI in Google Account connections. Cached busy intervals expire after one minute.

Disconnecting does not erase events already stored in CRM, independent appointments, Google events, conversations or backups. Local event records, synchronization baselines and recovery snapshots remain until deleted through the installation’s deletion process. Reconnecting can import events that still exist in Google again.

To request deletion, contact the website operator or use its privacy request process. For Niwa support, contact privacy@niwachat.com or niwaai.contact@gmail.com. Identify the installation and connected Google email; never send passwords, authorization codes or tokens.

The operator verifies the requester’s identity before erasure. WordPress Tools, Erase Personal Data includes a Niwa Calendar eraser that disconnects matching connections and removes mapped Google calendar data from CRM, linked appointment copies, synchronization records and CRM recovery snapshots. It does not delete events from your Google account. The operator must separately remove relevant AI conversations, agent transcripts, derived memory and exports, and process applicable requests with external agents or providers. A full deletion request must not be marked complete merely because the Google connection was removed.

Hosting backups and provider-held copies follow the applicable operator or provider retention arrangements. The operator must disclose its backup retention period, keep backups outside normal application access, and reapply completed erasures before restoring data to active use. Niwa’s OAuth relay does not maintain an archive of your calendar events. If a legal obligation requires retaining specific records, the responsible operator must explain what is retained and why.

Other service providers

Freemius handles plugin licensing and related account or subscription services. AI requests use the provider configured by the operator. Search storage, including Qdrant when configured, and the website’s hosting provider may process information needed by enabled features. Operators should review these providers and their data-processing settings before enabling an integration.

Changes and contact

We update this policy when data handling changes. Material new uses of Google data require an updated disclosure and consent before that use. Questions and deletion requests can be sent to privacy@niwachat.com or niwaai.contact@gmail.com.