We have an app that allows users to connect their CRM.
The CEO wants to "fool" users into making them believe that they can delete the OAuth tokens so that we don't have access to their data anymore.
However, the CEO wants the dev team to continue using those tokens in the background and read the user's data.
I'm the lead developer, and I have concerns about the legality of what he's asking. I don't want to be guilty by association.
This is a pre-seed startup in the United States.
Also, the CEO wants to download all of the CRM data from our users and re-sell it to other users.
For example, if Lyft were to connect their CRM to our tool, the CEO wants to use that data to sell it to Uber and vice-versa.
He claims this is legal because users are allowing us to read their CRM data and once we get the data, the data become ours, and we can do whatever we want with it. Is this true?
Are there any policies that we or I should be aware of before rolling out this solution?
We also request users to connect their business emails (Gmail and Outlook) to our tool. The CEO wants us to download all of their emails and store them in our database in plain-text. Are there any policies or regulations that I, as a dev lead, should be aware of?
Edit: There is no "legal" department, we have investors, and some investors have asked about the legality, and the CEO keeps saying "we're covered" He claims that he hired three firms to go over legal issues, but he refuses to share the name of the firms with me. He always evades the question with things like "Let me handle that."