🔒 Privacy Policy & Data Subject Rights

1. Absolute Zero-Knowledge Promise (Information We Do NOT Collect)

Drive-Guard is strictly built on a Zero-Knowledge, client-side architecture. We mathematically cannot and do not collect, intercept, store, transmit, or log the contents of your Google Drive files, folder structures, proprietary company data, or collaborator email lists on our remote servers.

2. Local Execution & Inability to Breach

When you connect your Google Workspace account, all API calls (e.g., `drive.permissions`, `drive.metadata.readonly`) execute entirely within the memory of your local web browser. Because we do not possess your data, Drive-Guard cannot be the source of a data breach of your Google Workspace files. You maintain complete sovereignty over your data at all times.

3. Global Compliance & Data Subject Rights

Our architecture inherently complies with major global data privacy regulations including the European Union (GDPR), United Kingdom (UK GDPR), ASEAN region (Singapore PDPC, Thailand PDPA, Malaysia PDPA), California (CCPA/CPRA), and Brazil (LGPD):

• Right to Erasure (Right to be Forgotten): Because data is stored locally in your browser storage (`localStorage`), clearing your browser cache or clicking "Sign Out" instantly and permanently obliterates all cached session data. No backend database deletion request is necessary because no backend database exists.
• Right to Access & Portability: You can export all your SOC audit logs directly from your browser via our built-in CSV export tool.

4. Google API Services User Data Policy Compliance

Our use and transfer to any other app of information received from Google APIs will adhere strictly to the Google API Services User Data Policy, including the Limited Use requirements. Drive-Guard does not use your Google Workspace data to train AI models or sell data to third parties.