Scope and responsible operator
LVDW Management Services FZCO, based in United Arab Emirates at Dubai Digital Park, Dubai Silicon Oasis, Building A1, United Arab Emirates, operates Applied Revenue Consulting (ARC). Tax Registration Number (TRN): 105323856200003.
This policy covers the active public website and email enquiries. It also describes conditional recruitment, private team sign-in and onboarding, personal availability, Calendar, and the separate optional Google Tasks connection. Those features process information only when they are configured and available, ARC has granted the required access, and an authorized person uses them. Hermon functionality and customer-data migration are not part of these public visitor flows. ARC does not send application or other transactional email automatically.
Public website and email enquiries
The public pages provide information about ARC, its work, jobs, and public team directory. The website has no contact form. Selecting the email link opens the visitor's own email application and addresses a message to levivdwaarden@gmail.com; it does not send anything until the visitor chooses to send it.
An email ARC receives may contain the sender's email address, message, and any other details the sender supplies. ARC uses that information to respond to and manage the enquiry. Visitors should not include information that is not needed for their enquiry.
Vercel may process ordinary request, device, and security information needed to host and protect the public website. ARC does not claim a public marketing analytics or advertising profile in this launch scope.
Conditional recruitment
ARC can explicitly publish a reviewed open role. Only while that publication remains active can a visitor start or update an application. The currently visible example roles are closed, do not accept applications, and are not evidence that a vacancy is published.
If an open role is published and a visitor applies, ARC creates a candidate session and stores the applicant's name, email address, phone number, language choice, questionnaire answers, role and question snapshot, publication version, progress and review status, and submission and update times. Questionnaire answers can cover commercial experience and results, training, offers, CRM and working practices, availability, languages, time zone, and residence. The applicant can also supply an external HTTPS video link. Direct production file uploads are not available, and the application flow does not send email automatically.
The candidate session uses an API-path-scoped, HttpOnly, SameSite=Strict cookie and a hashed server-side token record. Both expire after seven days; Production also marks the cookie Secure. Closing or unpublishing a role prevents new application updates but does not automatically erase an application already received.
Private team sign-in and access
Where Team Space sign-in is configured and available, it uses Google sign-in through Memberstack. ARC receives and verifies the immutable Memberstack member ID, normalized email address, verification state, Google-only provider state, and the current ARC organization and module access assigned to that member. ARC does not ask Memberstack for a password and does not treat a browser claim as an ARC permission.
After successful verification, ARC sets a host-only, HttpOnly, SameSite=Lax session cookie. Its lifetime is no longer than the verified provider session and is capped at eight hours. It is used to keep the member signed in and to authorize each protected request.
Onboarding records are tied to the immutable member ID and contain classification, progress, revision, and completion timestamps. They do not duplicate the member email, calendar token, calendar IDs, event content, or availability schedule.
Google Calendar and Nylas
Where the calendar integration is configured and available, an authorized member can choose to connect Google Calendar through Nylas. The requested Google access is limited to Calendar plus basic Google identity information (email, profile, and OpenID). ARC does not request Gmail or Contacts permission for this calendar connection. This is separate from ARC receiving enquiries in its own Gmail mailbox.
For a connection, ARC stores the Memberstack member ID, the Nylas connection and grant identifiers, the provider-confirmed email address, connection status, check times, and selection revisions. ARC retrieves calendar identifiers, names, read-only and primary status, and timezone metadata so the member can choose conflict and destination calendars. Google authorization credentials are handled through Nylas; ARC stores the Nylas grant identifier rather than a Google access token.
For the Planner calendar view, ARC lists calendar items through Nylas from the signed-in member's selected conflict and destination calendars for the visible date range. ARC displays calendar names, appointment titles, start and end times or all-day dates, busy/free values, and event types, such as appointments, focus time, out of office, or working location. Opening an item and checking a requested action's outcome retrieve that selected event's current details, event identifiers, permission and recurrence information, version information, and whether it has participants, even if its current dates fall outside the visible range. The provider response can also contain descriptions, locations and participant information; ARC does not display those additional fields in this editor. Imported event content and proposed edits remain in transient server and browser memory for the current view and action handling; ARC does not save that content in its application database or browser storage. The separate action records described below retain identifiers and hashes instead.
When a member requests an allowed appointment change, ARC sends the selected event identity and the changed title, start/end times or all-day dates, or busy/free value through Nylas to Google Calendar. A member-confirmed delete request asks Google Calendar to delete that selected event; ARC reports whether the deletion succeeded, was refused, or has an uncertain outcome. The member chooses whether Google should notify participants. ARC supports individual appointments and supported individual recurring occurrences; full recurring series, special event types and items without confirmed write permission remain read-only.
ARC's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
ARC stores the member's availability timezone, recurring windows, date exceptions, and revision so authorized teammates can find suitable collective times. Availability requests send the selected provider email, grant, and calendar identifiers to Nylas and return available time slots, not a general calendar export.
When an authorized member requests a meeting, ARC and Nylas process the organizer and participant identities, provider email addresses, selected calendar identifiers, start and end time, title, description, location, and provider event identifiers needed to create the event, notify participants, confirm the outcome, and avoid duplicates.
The Nylas connection flow uses a separate host-only, HttpOnly OAuth state cookie and a hashed server-side attempt. Both expire after ten minutes and are used to bind the provider return to the signed-in member and browser.
If Nylas issues a grant that ARC cannot safely accept, ARC keeps a durable, owner-bound cleanup or reconciliation record so the rejected grant is not mistaken for a connection and can be resolved safely. That record contains opaque member, grant, reconnect, state, claim, attempt, and timestamp data, not Google OAuth credentials, provider response text, calendar content, or customer data. Unresolved or manual-review records are not assigned an invented automatic deletion period.
Optional Google Tasks connection
Google Tasks is optional and separate from Google Calendar and Nylas. When ARC's Google Tasks integration is configured, an authorized member can connect a Google account through a separate Google OAuth flow. ARC requests the Google Tasks permission plus OpenID and email identity permissions. Connecting Calendar alone does not connect Tasks in ARC.
ARC uses the Tasks permission to verify access, read the member's task-list identifiers, titles and update times, and read tasks from a list the member explicitly selects. ARC receives task identifiers, titles, notes, date-only due values, completion status, parent relationships, assignment information and version information. It displays supported tasks, including completed tasks, privately to that member. At the member's request, ARC can create a task, edit its title, notes or due date, mark it complete, reopen it, or delete it from the selected list. ARC does not send a scheduled time because the supported Google Tasks due value is a date. Imported task content and proposed changes in this Planner flow remain in transient server and browser memory for the current view and action handling; ARC does not save that content in its application database or browser storage.
During authorization, ARC stores hashed OAuth state and browser values, the member ID, an encrypted one-time PKCE verifier, and an expiry. The attempt, verifier, and host-only OAuth cookie expire after ten minutes. After successful authorization, ARC stores the member ID, Google account subject and email, connection status and generation, confirmation and check times, and a reference to an encrypted Google refresh token. Access tokens are obtained when needed and are not stored in these application records.
The separate action that sends an existing ARC task to Google Tasks retains its existing ARC task and organization identifiers, selected connection and list, title, notes, due date, request identity, operation state, provider task identifiers and status when known, attempts, safe errors, and timestamps. Those records help prevent duplicate tasks and resolve uncertain results. Standalone task creation and imported-task management in Planner use the more limited action records described below.
A member can revoke the Tasks permission in their Google account. If Google reports that authorization is no longer valid, ARC marks the connection as requiring authorization again and stops using it. ARC does not currently provide a separate self-service Google Tasks disconnect or record-deletion action.
Why ARC uses this information
ARC uses the information described above only for the functions that need it:
- deliver and protect the public website;
- respond to and manage email enquiries;
- accept, resume, and review an application only when a reviewed open role is explicitly published;
- authenticate authorized team members and enforce their current organization and module access;
- connect and verify the member's chosen Google Calendar account;
- save calendar selections and personal availability;
- calculate collective availability and create meetings the authorized user requests;
- display selected Calendar items and carry out the supported appointment edits or deletions the member requests;
- connect a separately authorized Google Tasks account, show its selected list and tasks, and carry out the task creation, edits, completion changes or deletions the member requests;
- record onboarding readiness; and
- protect the service, prevent replay or cross-account access, and reconcile uncertain provider operations.
Providers and storage
ARC uses Vercel to host the public website and Google/Gmail to receive and manage email enquiries. Google processes messages sent to the published Gmail address under its own service terms and privacy commitments.
For conditional recruitment and private team or Calendar features when they are configured and used, ARC uses Memberstack for team identity and access data, Google for identity and Calendar authorization, Nylas for the Calendar connection and API, and Neon PostgreSQL for ARC application records. The separate Google Tasks feature uses Google OAuth and the Google Tasks API when configured and authorized. Each provider processes information under its own terms and privacy commitments.
Google, Gmail, Memberstack, Nylas, Vercel, Neon, and their infrastructure may process information in other countries under their own service arrangements. This policy does not claim a certification, transfer safeguard, or provider configuration that has not been independently completed.
Retention and deletion
Email enquiries are kept only as long as ARC considers necessary to respond to and manage the enquiry and to address applicable operational or legal obligations. ARC does not state a fixed deletion period that has not been adopted.
A candidate session and its cookie expire after seven days. If an open role is published and an application is received, the application, questionnaire, publication snapshot, external video link, version history, operation records used to prevent duplicate submissions, and recruiter review state are kept while needed to manage the application, protect the integrity of the process, and address applicable obligations. ARC does not claim an automatic application-deletion schedule that has not been implemented.
For private team features, the ARC session cookie lasts no more than eight hours and Nylas OAuth state data lasts ten minutes. Persistent member, access, onboarding, calendar-selection, availability, and meeting records are kept while needed to operate and protect the authorized service and to address applicable obligations.
Owner-bound Nylas rejected-grant cleanup and reconciliation records are retained while an issued grant remains unresolved or requires manual review. A record is removed when the grant is safely accepted or a confirmed cleanup completes; ARC does not claim an automatic deletion period for an unresolved provider result.
Google Tasks OAuth attempt data and its one-time verifier expire after ten minutes. The encrypted refresh token, connection record, task-list selection within an action, and task operation and provider-reference records are kept while needed to provide and protect the authorized connection, prevent duplicate tasks, reconcile uncertain results, and address applicable obligations. Reconnecting replaces and removes the previous stored refresh credential. Revoking access at Google stops provider use but does not automatically delete ARC's local records; no automatic deletion period is claimed.
For Planner appointment changes and standalone Google Tasks management, ARC keeps an action record containing the member and connection binding, calendar or list and resource identifiers, action type, request identity, affected field names, hashes of the request and expected result, outcome, and timestamps. These records prevent repeated writes, coordinate actions on the same item and help check uncertain outcomes. They do not contain imported titles, notes, appointment times, proposed edit values, provider credentials or raw provider error messages. They remain while needed to operate and protect the service, resolve uncertain actions and address applicable obligations; ARC does not promise an automatic deletion period.
Team Space does not currently provide a self-service account or record-deletion workflow. Questions or requests concerning information ARC controls can be sent to levivdwaarden@gmail.com. ARC may need to verify the requester before disclosing or changing account-linked information and will assess each request against the records it controls and applicable obligations.
Choices and requests
A visitor decides whether to send an email and what details to include. A sender can use the monitored address below to ask about access, correction, or deletion of information ARC controls.
An authorized member can cancel the Google authorization flow or revoke ARC's Calendar authorization from their Google account. Calendar connection, availability, and scheduling features will then stop working or require reconnection; Team Space access remains governed separately by Memberstack and ARC access grants.
Google Tasks uses a separate authorization. A member can cancel that flow or revoke the Tasks permission in their Google account. ARC will require authorization again when Google reports that access is no longer valid. Questions or verified requests about the encrypted credential, connection, or task operation records can be sent to the monitored address below.
Contact and updates
LVDW Management Services FZCO monitors the address below for privacy, support, and enquiry messages. Postal address: Dubai Digital Park, Dubai Silicon Oasis, Building A1, United Arab Emirates. The last-updated date at the top of this page will change when this policy materially changes.