Publisher privacy policy

Google data we access

After the owner authorizes an account, the publisher accesses metadata for one designated Google Drive folder and its nine configured report files, including file identity, name, parent folder, file type and deletion status. It downloads report contents and the bundle manifest, and updates the contents of those same existing files.

The reports may contain business identifiers, sales and inventory metrics, operational status and replenishment recommendations. The publisher is not designed to collect customer identities, payment information, Gmail messages, contacts or calendar data. Its normal workflow does not search unrelated Drive folders, create or delete files, or change sharing permissions.

The requested Google Drive scope technically permits broader account access. The publisher validates the designated folder and exact configured file identities before its report operations. This application restriction does not narrow the underlying Google OAuth permission.

How we use the data

We use the report data to publish the owner’s current business reports, verify their integrity and freshness, preserve a previous valid bundle for recovery, and detect or recover from failed or interrupted publication. Checksums, publication receipts and operational records document those checks. The reports are for review by the owner and authorized business operators.

Google API data is not sold or used for advertising, credit decisions or training general-purpose AI models. The headless publisher does not send report contents to an AI service.

Storage and security

The designated reports remain in Google Drive under the account’s existing sharing controls. The company-controlled runtime also stores report snapshots, recovery backups and operational records with restricted file access. These records may include downloaded Google Drive report contents. Report history and recovery records remain until the owner removes them after reviewing business retention needs; this publisher does not promise automatic deletion after a fixed interval.

On macOS, the owner’s OAuth client credentials and refresh token are stored in Keychain and accessed by the dedicated signed helper. Short-lived access tokens are held in memory for API requests. OAuth secrets are excluded from report files, application logs and source code. Google API requests use encrypted HTTPS connections. A future AWS runtime retrieves the same logical OAuth credentials from AWS Secrets Manager and stores business records in the company-controlled cloud environment.

Sharing and human access

Google processes the authorized API requests and hosts the designated files. Existing Drive sharing settings determine who can view the reports; the publisher does not grant new access. Authorized company operators may review reports for business operations and inspect recovery records to resolve publication problems. If the company activates the AWS runtime, AWS processes and stores the operational data needed to run that service.

We do not transfer Google report data to advertising platforms or data brokers. Any additional disclosure must be necessary for the authorized reporting service, security or applicable legal obligations and consistent with Google’s data-use requirements. Access for troubleshooting is limited to authorized personnel and the data needed to resolve the issue.

Disconnecting and deleting data

The owner can stop scheduled publication and revoke the publisher’s authorization through Google Account connections. Revocation prevents new authorized requests, but does not erase reports already in Drive or local recovery copies.

To remove stored credentials and retained publisher records, the owner can contact us to coordinate deletion from the company-controlled runtime, its backups and any activated cloud runtime. The owner controls deletion of the existing Drive files separately. The publisher has no Drive file-delete operation. Records subject to an applicable retention obligation may need to be retained; we will explain any such limitation when handling a request.

Google data-use requirements and changes

We follow the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring Google API data. We will update this policy before introducing materially different Google data practices and obtain any additional authorization required for that change.

Contact

For questions about the publisher or its Google authorization, contact Socialite Wellness Inc., Vancouver, British Columbia, Canada, at info@socialitewellness.ca.