In Fulldev you connect your own business tools, such as Google, Shopify, Notion, Slack and WhatsApp, under Integrations in your account. Each integration stays with the person who made it: other members and the organization's admins cannot use it. With Fulldev Connect, its owner and their AI assistant use the connected tools through fixed actions. The Fulldev apps use an account only where its owner turned that on: Message sends and receives an organization's customer messages, Meet reads a person's calendar and meeting notes, Contacts keeps a person's own address books in step, and Sites works in a website's repository at GitHub. This page explains what Fulldev does with the data these integrations handle. The Fulldev privacy statement covers the full.dev websites and the apps in general, including Meet's recordings.
Fulldev, Vismarkt 5a, 9712 CA Groningen, the Netherlands, is responsible for Connect and the apps on this page. Contact us at contact@full.dev.
You sign in with your Fulldev account. Fulldev keeps your name, email address and your organization memberships, and uses them to show who has access and to check every request. When you sign in with Google, Fulldev receives your name, email address and profile picture from Google for your Fulldev account. Only after you choose Accept does Fulldev measure how the app is used, with PostHog in its European region, with session replays that mask what you type and the text on screen. Meet and Message are neither measured nor recorded, and neither are sign-in, consent and provider pages or shared links.
You connect your own account by approving access at the provider, or for Virtuagym by entering the API client Virtuagym gave you. You decide in which organizations it is available and which apps may use it. Fulldev stores the provider's tokens and client secrets encrypted and uses them only on its servers; nobody receives a token.
When the owner of a connected account, or their AI assistant, uses one of Connect's actions, Fulldev makes fixed requests to the provider and passes the answer back. These requests only read, except the changes described below, which the owner requests separately and confirms first. Fulldev does not store the content of these direct requests or answers. It logs who used which action, when, and whether it worked, without the content, and keeps that log for 90 days. To prevent duplicate changes, it also keeps a request hash, an integration reference and the execution status, without the request or answer content. Account details, encrypted access tokens and permissions remain stored while needed to provide access. The AI assistant the person uses handles what it receives under its own terms.
Other Fulldev apps can store data for their own features. If you use a connected account in a workflow, Fulldev Workflows keeps that run's step results until seven days after it finishes. This differs from a direct Connect request. This page describes the other apps' use below.
In Connect, nothing is allowed until an owner or admin of the organization turns on a set of a provider's actions, such as reading Google documents or changing calendar events, for everyone in it or for one of its roles. This holds for owners and admins too, and an admin can block a member from every provider action. A member with access to Connect then uses those actions only with their own account, made available in that organization with that set on. Admins never see members' connected accounts, their content or tokens, or what a person does in other organizations.
Every time you approve an AI assistant, the Fulldev CLI or an agent, Fulldev keeps that AI connection: its name, the client, the organizations, permissions and accounts you chose for it, when you approved it and when it was last used. It works for you alone and never for more than you may do yourself. Only you see and change it, on your profile, and revoking it ends its access at its next request, without affecting your other connections. A provider change already sent cannot be undone. Fulldev keeps the record of a revoked connection; you may ask us to delete it.
With a Google connection, Connect uses only the account's Google documents, spreadsheets, presentations and Google Calendar, and never reads or sends Gmail. Connect does only what an account owner asks for, within the provider's permissions: reading the names and text of those documents, spreadsheets and presentations, and calendar events without their guests; and, when requested, adding rows to and changing cells in such a spreadsheet, making a new document, and adding, changing or removing calendar events, without guests and without notifying anyone. Connect never deletes, shares or moves a file, and never changes a private event.
A super administrator of a Google Workspace can also allow their connection to administer it. Connect then lists the Workspace's people with their address, name and status, and, when the administrator asks, adds a person, with a temporary password shown once and not kept, or off-boards one: it suspends the account, signs it out everywhere and transfers its Drive files and calendar to a colleague. It never deletes an account and never off-boards the administrator who connected. Message, Meet and Contacts ask for their own Google access, described below.
Fulldev uses Google data only to provide these features. It does not sell it, does not use it for advertising, does not use it to train AI models, and people at Fulldev do not read it, except where needed for security or required by law.
Connect passes each answer to the AI assistant the person chose, which is not part of Fulldev and handles it under its own terms. An organization and its members may use Google data only with an AI assistant or service whose handling meets the Limited Use requirements below, including that it does not use the data to train AI models.
The use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. This applies to Connect, Message, Meet and Contacts alike.
Connect reads store details, products, variants, prices, stock by location, and orders with their items, totals, payment and fulfillment status. It does not request customer names, email addresses, phone numbers, addresses or order notes. Shopify still classifies order and fulfillment data as protected customer data. Connect reads it only to answer authorized requests, passes the answer to the chosen AI assistant and does not store that answer. Connect never changes the store.
Connect reads the Notion pages the owner shared with Fulldev on Notion's own consent screen, and the templates of a WhatsApp Business Account. For a Microsoft account it reads calendars and their events' time, title, place and a short preview, never organizers, guests, meeting links or the full text, and a private event only by its time. For Zoom it reads the upcoming meetings the account hosts, never join links, passcodes, participants or recordings. For Figma it reads a design file's layers, text and sizes, never comments, sharing or profiles. None of these change anything. For Virtuagym it lists a club's leads with their names, email addresses, phone numbers, status and source, and adds a lead the owner asks for; it never changes or removes one. In production, Microsoft, Zoom, Figma, Facebook, Instagram and X are for now offered only to Fulldev's own administrators.
Sites edits a website in its repository at GitHub through Fulldev's GitHub app: it reads and writes the repository's files, branches and pull requests and reads its checks. A change names the person who made it as its author.
Message sends an organization's own customer messages, which its admins set up, through an account its owner enabled for Message. This does not give another member access to the owner's account through Connect. The owner can turn that use off while keeping the account connected for other apps.
With a Google connection, Message lists the account's calendars and, for the calendar an admin chose, reads the appointments: their time, title, meeting link and guests' names, email addresses and responses, and it asks Google to tell it when they change. It emails each guest who did not decline the email the admin wrote, before the appointment starts or after it ends, from the connected Gmail account, and cancels it when the appointment moves or the guest declines. It also sends the emails the organization's own system asks for, with the values it gives. Message only sends with this access: it never reads, changes or deletes the mailbox.
With a WhatsApp connection, Fulldev keeps the WhatsApp Business Account's access token encrypted and reads the account's name, phone numbers and message templates. Message submits the templates an admin writes to Meta for review, sends approved templates to the numbers the organization's own system gives, which must confirm that the customer agreed, and receives Meta's delivery and read statuses, template reviews and customers' replies and messaging preferences.
A marketing message, by email or WhatsApp, also goes only to someone the organization's system confirms agreed. Message keeps each message it sends this way with its recipient, its values, its status and any error for 90 days after its last change, and keeps every opt-out, so nobody who unsubscribed, replied STOP or turned off marketing is messaged again. Message uses this data only to send the organization's messages, shares it only with Google or Meta to deliver them, and does not sell it, use it for advertising or use it to train AI models.
Message shows an organization's conversations from a Gmail account, a WhatsApp Business Account or a person's own Slack or LinkedIn account that the account's owner, an owner or admin of the organization, added to Message. Adding it is that person's consent for that account: it ends when they leave the organization or lose their access, turn its use off or remove it, and Message then reads and sends nothing more through it. Owners and admins see every account in Message and choose which other members may read and answer each one. This does not give them the provider's token or access through Connect.
For Gmail, the owner gives Message its own access to their Google account, only to send replies (gmail.send), and enables forwarding to their unique Message address. Resend receives the forwarded mail and passes it to Message. This route does not request gmail.readonly, import earlier mail or sync replies sent directly from Gmail. Message keeps each message's sender and recipients, subject, time and text, with HTML reduced to plain text, and its attachments' names, types and sizes. Attachments are fetched from Resend only when opened and remain available there for up to 30 days. Message sends only the replies people write, and never changes, labels, marks or deletes anything in the mailbox.
For WhatsApp, Message keeps the messages customers send to the business's number from the moment the account is added: the sender's number and WhatsApp profile name, the time, the text, and for a photo, video, voice message or file only Meta's id and type. Such a file is fetched from Meta only when someone opens it, and is not kept; Meta keeps it for 30 days. Message sends text replies only within 24 hours of the customer's last message, as WhatsApp allows. When the number stays on the WhatsApp Business app, Message also keeps the messages the business sends from the app from that moment. The contacts and chat history Meta shares when such a number is connected are never kept.
For Slack, the owner connects their own Slack account and allows Fulldev to read the channels, direct messages and group messages they are in, people's names in the workspace and files shared there, and to post as them. Nothing comes in until the owner chooses their direct and group messages, channels they are in, or both. From then on Message keeps each new message in those conversations: the sender's Slack id and name, the time, the text and the names of its files, and keeps edits and deletions in step. Slack's events are held at most a day until they are handled. Every time someone reads a channel's conversations, Message asks Slack whether the owner is still in it and whether it is public. A file is read from Slack only when someone opens it, and is not kept. Direct messages, group messages and private channels stay visible to the owner alone; only public channels the owner chose are visible to the people Message gives access. Replies go out as the owner, so only the owner sends them. Message keeps Slack messages for at most 90 days, and deletes everything it kept of an account when the Slack app is removed or Slack revokes its access.
Where Fulldev turned LinkedIn messages on for an organization, an owner or admin can add their own LinkedIn account, through LinkedIn's Member Data Portability API, which LinkedIn offers to members in the European Economic Area. Message then reads, every hour, the private messages of that account since it was added: each message's sender and name, text and time, without attachments, and keeps edits and deletions in step. These conversations are read-only and visible to that person alone, also not to the organization's other owners and admins.
Message never answers by itself. If a person gives their chosen AI assistant access and asks it to list or read conversations, Message passes the requested details, including customer names, email addresses or phone numbers, subjects, message text and attachment names, to that assistant. It is a separate service with its own terms and must meet the Google Limited Use requirements, including that the data is not used to train AI models. It sends a reply only where the person allowed it to. Message keeps conversations as long as the account is in Message; removing it from Message deletes its conversations. Message uses this data only to show and answer the organization's conversations, shares it with Google, Meta or Slack to send replies and with the assistant explicitly authorized for those requests, and does not sell it, use it for advertising or use it to train AI models.
You can also let your own AI assistant or bot deliver plain-text items to your private conversations in Message, through an AI connection you gave delivery. Message keeps each item's title and text, the sender name the bot gives, which is not verified, the time, and who delivered it: you and the AI connection used. Links stay text and are never opened. Only you see these items, and they are deleted when you leave the organization. A connection given only delivery cannot read Message or reply.
Meet works for one person's own calls: other members of the organization do not see them. With its own Google access, Meet reads your calendar, adds a meeting booked through your booking link, with the visitor's name and email address, to your calendar, and, if you turn on automatic recording, turns on recording in Google Meet for the new meetings you organize; Google keeps those recordings. With a Notion connection it reads that workspace's AI Meeting Notes, and with its own Slack access the transcripts of your huddles: their title, time, the speakers' names and text, without audio. Meet does not import Zoom or Microsoft Teams recordings.
For Meet's phone recording number, Fulldev's own Twilio account verifies your mobile number with a texted code and records a call from that number once you add the recording number and merge the calls. Before recording, the number asks you to merge the calls and tell the others that you are recording; a beep starts the recording. Twilio's copy is deleted once Meet has the audio, and after 90 days at the latest. The Fulldev privacy statement describes how Meet keeps and transcribes recordings.
In Contacts you connect your own Google accounts, each with Google's consent, and choose per account whether its contacts go to your other accounts and whether theirs are written to it. Every day Contacts reads the saved contacts of these accounts, with their fields and photos, and, only after you reviewed a comparison and started, creates and updates contacts in the accounts that receive them. It changes or removes only contacts it made or that you paired. When you open All contacts, it also reads missing photos, birthdays, companies and job titles from Google profiles linked to your saved contacts; these are shown live and not stored.
To do this, Contacts keeps which contacts are the same person across your accounts, with a fingerprint of each field, the look-alikes it asks you about with the details you need to decide, and for 30 days each contact as it was before a change, so it can be restored. Only you see your accounts and contacts, also through your own AI assistant; your organization's admins do not. Contacts uses contact data only for this, does not share or sell it, and does not use it for advertising or to train AI models. Removing an account from Contacts stops its sync; its Google access stays under Integrations, where removing it ends every app's use. Contacts already written stay in Google.
You can also connect your own LinkedIn account in Contacts, through the Member Data Portability API, on LinkedIn's own consent screen. It is personal: nobody else in your organization, its admins included, can see or use it. Contacts reads which member gave the access, your name and your first-degree connections: their name, company, position and the date you connected, and their profile link and email address only when LinkedIn includes them. They are read when Contacts compares LinkedIn with a Google account you chose, and, once you start LinkedIn updates there, once a day. Contacts then adds a connection's company, position, profile link and email address, when the contact lacks them, to the contacts you paired, and makes new contacts, with the LinkedIn label, for the connections you chose, or automatically when you turn that on; it is off by default, and possible duplicates wait for your decision. It never removes or overwrites anything in Google and never posts, sends messages or changes anything on LinkedIn. Fulldev does not keep a separate copy of your connection list. Removing LinkedIn from Contacts ends its updates; contacts already written stay in Google. The access also ends when LinkedIn's token expires or LinkedIn stops accepting it, and Fulldev then reads nothing until you connect again.
Contacts can add people from more sources to your Google contacts, each with its own access, a comparison and your explicit start: the address books of your Slack workspace and Microsoft account, the Facebook and Instagram network exports you download from Meta and upload, of which your browser sends only your friends, followers and following, and your X network from its official archive and the follows that change after it. For an Instagram export you can separately allow Contacts to look up, through a Page-linked professional account you choose, only the usernames already in the export; it keeps those profile details for 30 days. LinkedIn and these sources' data are used only for these features, never sold, used for advertising or used to train AI models.
An owner can authorize their Facebook Pages and linked Instagram professional accounts, their Instagram professional account, or their X account, to list conversations, read messages and send a message they request. Meta and X enforce the available accounts, conversation history and sending rules; a Meta reply goes only to someone who wrote in the last 24 hours. Connect passes requested message text and participant details to the owner's chosen AI assistant; it keeps no copy of these messages and never sends automatically. Organization membership or admin access gives no access to another person's messaging account.
Only the connected account's owner can reconnect or remove it, under Integrations in their account. They can turn an app's use off without removing the access other apps need. Removing the account deletes its tokens and every app's use of it, including Message's conversations of that account. Removing it in Fulldev does not revoke Fulldev at the provider. To revoke Fulldev's access at Google, remove Fulldev under third-party connections in your Google account: that ends Connect's, Message's, Meet's and Contacts' access to that account. To revoke it at Meta, remove Fulldev's access to the WhatsApp Business Account or the Page in your business settings at Meta, or disconnect the Business Platform in the WhatsApp Business app. At LinkedIn, Slack, X and the other providers, remove Fulldev in their settings. You may ask us to see, correct or delete your personal data at contact@full.dev.
Last updated on 25 October 2026.