Privacy Policy - onleeSentinel

onleeSentinel ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, and safeguard your information when you use onleeSentinel, a security dashboard application that operates within the Google Workspace environment.

1. Adherence to Google API Services User Data Policy

onleeSentinel's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. Acceptance of This Policy

When you use onleeSentinel and grant the necessary permissions, you acknowledge that your information will be used in accordance with this Privacy Policy.

3. AI and Machine Learning Policy

onleeSentinel does not use Artificial Intelligence (AI) or Machine Learning (ML) models for any purpose within the application. We do not use any user data obtained through Google Workspace APIs or any other source to train, develop, or improve any generalized AI or ML models.

4. Information We Collect and Use

Google Workspace Data: To function within Google Workspace, onleeSentinel requires access to certain Google services based on the scopes you grant. This data is used solely to provide dashboard and alert functionality. The specific data we access depends on the scopes you grant:

Scope / Permission	Usage Description
https://www.googleapis.com/auth/userinfo.email	To identify your administrator account, check license validity, and deliver security email reports.
https://www.googleapis.com/auth/script.send_mail	To send Weekly Reports and High Severity Alerts regarding your security status to administrators.
https://www.googleapis.com/auth/script.external_request	To connect to the Google Alert Center and Cloud Identity Policy APIs to fetch domain security events.
https://www.googleapis.com/auth/script.scriptapp	To manage backend scheduled triggers (e.g., automated checks) and maintain application execution state.
https://www.googleapis.com/auth/drive.file	To create, edit, and access the specific Google Sheets file used to store compliance audit logs and history within your Google Drive.
https://www.googleapis.com/auth/cloud-identity.policies.readonly	To fetch the real-time state of your domain's security settings and policies to perform CIS Benchmark compliance audits.
https://www.googleapis.com/auth/admin.directory.orgunit.readonly	To retrieve Organizational Units (OUs) structure in order to display security check results mapped to the correct user groups.
https://www.googleapis.com/auth/admin.directory.user.readonly	To access basic user statuses to verify which directory accounts are covered in security compliance checks.
https://www.googleapis.com/auth/gmail.addons.execute	To run and render the onleeSentinel Add-on user interface card directly inside the administrator's Gmail inbox.

Specific Data Access and Use

Your Email Address: Accessed mainly to identify you as the administrator using the dashboard and to route the reports you subscribe to (Weekly or Alerts). We do not share your email with third parties.
Security Alerts: The application fetches alert data (Type, Severity, Source, etc.) from your Google Workspace domain solely to display them on your dashboard and generate summaries. This data is processed in real-time or cached temporarily for performance during your session and is not permanently stored on our servers outside of your own Google Apps Script environment execution.

5. Data Sharing, Transfer, and Disclosure

We do not share, transfer, sell, or disclose your Google user data to any third parties under any circumstances.

All access to your Google Workspace data (such as emails, security alerts, and organizational settings) occurs entirely within your own local browser session and your dedicated Google Apps Script environment. No user data obtained through Google APIs is ever transmitted to, stored on, or processed by any external servers or third-party services.

We do not share your information with third-party tool providers, advertisers, analytics platforms, or external databases. Your data remains strictly within your organization's Google security boundary.

6. Data Retention and Deletion

Because onleeSentinel is a serverless application operating within your Google Workspace domain, data storage and retention are under your direct control:

Transient Data: Google Workspace security alerts and policy data retrieved during your session are processed in real-time. They are held in transient memory (cached in your browser session or Google Apps Script runtime memory) solely to render the dashboard and execute audits, and are immediately destroyed when the session or script execution ends.
Persistent Configurations: Any persistent state generated by the application, such as manual audit validations or settings, is stored exclusively in your own Google Spreadsheet (e.g., the Audit_Validations sheet) and Google Apps Script Project Properties within your domain. We do not store this data on our own infrastructure.
Data Deletion: You can delete any saved validations or settings at any time by editing or deleting the target Google Spreadsheet in your Google Drive.
Revoking Access: You can immediately terminate the application's access to your Google user data by uninstalling the application or revoking its permissions via your Google Account Security Settings at Google Account Permissions. Revoking access immediately invalidates all active OAuth tokens and prevents any future data access.

7. Data Protection

Security procedures are in place to protect the confidentiality of your data. We use encryption to protect your information.

8. Contact Us

If you have any questions about this Privacy Policy, please contact us at:
support@onlee.xyz