Privacy Policy
This policy covers AIES Automation, an internal application that connects the business's own automation workflows to the business's own Google account. It is not the privacy notice of the customer storefront. The storefront is not open yet. When it opens, it will have its own privacy notice, which customers will be shown where they buy.
AIES Automation is the private internal automation application of AI E-Commerce Studio ("the business", "we"). This policy describes what the application can access in the Google account it connects to and how that data is handled.
1. Who uses the application
AIES Automation is operated by the business for its own use. It is not offered to the public. The only Google account connected to it is the business's own Google account, and the only person who grants it access is the operator of the business.
2. Google access the application is granted
The application connects through two Google sign-in authorizations given by the operator, one for Google Sheets and one for Google Drive. The permissions Google grants are broader than the work the application does, and we state them here as Google lists them:
| Permission (Google scope) | What it allows |
|---|---|
spreadsheets | See, edit, create and delete all Google Sheets spreadsheets in the account. |
drive | See, edit, create and delete all Google Drive files in the account. |
drive.file | See, edit, create and delete the specific Drive files used with the application. |
drive.metadata | See and manage information about Drive files, such as names and folders. |
drive.appdata | See, create and delete the application's own configuration data in Drive. |
drive.photos.readonly | View photos, videos and albums stored in Google Photos. |
These are the permissions requested by the Google Sheets and Google Drive connectors as they are currently configured in the automation software. In practice the workflows work with one operations spreadsheet and one order storage folder, described in section 3. They do not use the Google Photos or application data permissions.
The application has no permission for Gmail, Calendar or Contacts.
3. Data the application processes
Through that access, the application reads and writes the business's own records in the business account:
| Where | What |
|---|---|
| Operations spreadsheet (Google Sheets) | Inquiry records: first name, email address, the options chosen on the inquiry form, the date and time, and a record of the consent given. Order and file logs: order references, file names, sizes, dates and status. Internal records: expense ledger, cost calculations and task status. |
| Order storage folder (Google Drive) | Files that a customer sends to the business for their order, such as photos and scans of recipes, kept in a private folder for that order. |
Records about people enter the business account because those people contacted the business or placed an order and provided the information themselves. The application does not connect to any other Google account and does not gather data from other sources. Although its permissions extend to other files in the business account (section 2), the workflows are built to work only with the spreadsheet and folder named above.
4. How the data is used
Data accessed through Google Sheets and Google Drive is used only to run the business's own operations: recording inquiries and orders, storing order files, replying to the people who contacted the business, fulfilling orders and keeping business records.
We do not sell this data and do not use it for advertising.
Artificial intelligence. Data obtained through Google APIs is not currently used to train artificial intelligence or machine learning models, and the application does not currently send it to any AI service. The business may later use an AI service to help transcribe recipes and images that customers send for their orders. Before any such processing is switched on, this policy will be updated to describe it and to name the service provider involved.
The operator of the business is the only person with access to the data, and reads it as needed to run the business, to comply with the law or for security purposes.
The application's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Storage and security
- The records are stored in Google Sheets and Google Drive, in the business account. The spreadsheet and the storage folder are private and are not shared with other accounts.
- The workflows run on automation software (n8n) that the business operates on a virtual server rented from DigitalOcean. The access credentials issued by Google are stored by that software in encrypted form.
- Saving of workflow run data is switched off for the workflows that handle inquiries and order files, so the automation software does not keep a history of that data. Data is still held in memory while a workflow runs, and the server and its software can produce temporary files and technical logs. We do not claim that no transient copy ever exists.
- Connections to Google and to the automation server use encrypted transport (HTTPS).
6. Retention and deletion
Records are kept only for as long as they are needed to handle the inquiry or order they belong to, to operate the business, and to meet legal obligations that apply to the business, such as tax and accounting record-keeping.
When a person asks us to delete their data, we delete what we are not required to keep. Records that the law requires the business to retain are kept for the required period and are then deleted.
The operator can remove the application's access to the Google account at any time in the Google Account settings, under third-party access. Removing access stops all further reading and writing by the application.
7. Service providers and sharing
We do not share data obtained through Google APIs with third parties, except with the service providers needed to run the application, and only to the extent needed:
- Google: stores the spreadsheet and the files (Google Sheets, Google Drive). The business also sends its email through Gmail, under a separate authorization that is not part of this application.
- DigitalOcean: supplies the virtual server on which the business runs its automation software.
Netlify hosts this public website. The website is a set of static pages with no forms, accounts, cookies set by us or analytics. Netlify, like any web host, may process technical request data such as IP addresses when the pages are loaded. It does not receive data from the Google account.
We may also disclose data where the law requires it. If the business starts using another service provider to process data from the Google account, this policy will be updated before that happens.
8. Your requests
If you have contacted AI E-Commerce Studio or placed an order and want to know what data we hold about you, to have it corrected or to have it deleted, write to markovich.it@gmail.com.
We may need to confirm that a request comes from the person the data is about. We respond to requests within a reasonable time and within any period that the law applicable to the request sets. If we cannot do what is asked, for example because a record must be retained by law, we will explain why.
9. Changes
If this policy changes, the new version will be published on this page with a new date.
10. Contact
AI E-Commerce Studio, AIES Automation
Email: markovich.it@gmail.com