Google OAuth Scopes & Data Access

This page is a public, verifier-facing companion to our Privacy Policy. It explains, in concrete operational terms, which Google OAuth scopes SEWPOINT requests, why each scope is necessary, what data is accessed through it, where that data flows, and what we are contractually and technically forbidden from doing with it.

Nothing on this page expands the permissions you grant via the Google OAuth consent screen. If there is ever any conflict between this page and the actual OAuth consent screen, the consent screen and our Privacy Policy prevail.

SEWPOINT's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, for all data we receive from Google APIs (content from files you specify, file metadata, thumbnails, and any embedded text, images, or chart data), we commit that:

1. The data is used only to provide and improve user-facing features that are prominent in SEWPOINT's interface.
2. The data is not used for advertising, retargeting, personalized advertising, user profiling, or credit-worthiness/lending decisions.
3. The data is not sold to anyone.
4. The data is not used—and our service providers (including AI inference providers) are contractually prohibited from using it—to develop, improve, or train generalized or foundational AI/ML models.
5. The data is not read by humans, except (a) with your explicit consent, (b) where strictly necessary for security investigations, (c) where required by applicable law, or (d) in aggregated and anonymized form for internal operations consistent with applicable law.

SEWPOINT requests only the minimum OAuth scopes necessary to deliver the features users invoke from the SEWPOINT dashboard. For Google Workspace file editing we request only https://www.googleapis.com/auth/drive.file. We do not request broad Drive access or access to your Gmail, Calendar, Contacts, Photos, Chat, or any other Google service.

SEWPOINT reads and updates only those files to fulfill the instructions you submit. We do not list, search, or scan your Drive beyond files you identify in a task.

You may revoke access at any time at Google Account → Security → Third-party apps with account access. Revocation takes effect immediately on Google's side; SEWPOINT will also discard its stored OAuth tokens when you click Disconnect Google Workspace in account settings or when authorization fails.

Every feature below requires drive.file and per-file authorization for the Google Workspace files you specify in that task. Feature names match our home page and dashboard.

We never enumerate or list Drive files you have not specified in the current flow.

Google recommends https://www.googleapis.com/auth/drive.file for apps that need per-file access. SEWPOINT adopted it because:

• Minimum OAuth surface. drive.file is non-sensitive and limits access to files you explicitly specify in SEWPOINT or files SEWPOINT creates for you.
• User-controlled scope. Layout edits, translation, templates, and chart updates run only on the file IDs you identify for that task.
• No Drive-wide access. SEWPOINT does not list, search, or mirror your Drive. Each Agent Studio or Templates run works only on files you specify.
• Write permission follows Google Drive. If you only have view access to a file, edits require edit permission on that file in Google Drive—we surface that clearly before write operations.

When you submit an instruction in SEWPOINT (for example, "translate this deck to Japanese"), the data flow is, at a high level:

1. Account connection. You connect Google Workspace once; OAuth grants only drive.file (plus sign-in scopes).
2. Per-file authorization. For each task, you identify the Google Workspace file(s) SEWPOINT should work on. You grant access to those files only.
3. Targeted fetch. SEWPOINT reads only those file IDs to fulfill your instruction.
4. Transient processing. Structural data (layouts, text, charts, optional thumbnails) stays in memory for that request only.
5. AI inference. Providers receive only what the instruction requires, under no-training / zero-retention terms (see Privacy Policy §5).
6. Write-back. Changes are applied only to the same file(s) you specified for that task.
7. Cleanup. Transient content is discarded at request end; only coarse operational metrics may be retained per Privacy Policy.

We do not maintain shadow copies of your decks, we do not export them to any analytics warehouse, and we do not retain raw slide content beyond the transient window described in our Privacy Policy.

For absolute clarity, with respect to all data received from Google APIs we will never:

• Use it to train, develop, or improve generalized or foundational AI/ML models, or permit any service provider to do so.
• Use it for advertising, retargeting, personalized advertising, audience targeting, or user profiling.
• Use it for credit-worthiness, lending, insurance underwriting, or any eligibility decision.
• Sell, rent, or otherwise commercially redistribute it to any party.
• Read it in human-readable form, except (a) with your explicit consent, (b) where strictly necessary for security investigations, (c) where required by law, or (d) in aggregated and anonymized form for internal operations.
• Enumerate or scan any file in your Drive that you have not directly identified in a request.
• Share it with third parties, except service providers acting on our documented instructions and bound by equivalent confidentiality and security obligations, and only to the minimum extent necessary to fulfill the request you initiated.

A summary of what we retain from Google APIs and for how long. The authoritative version is in Privacy Policy §6.

You may at any time revoke our access, delete saved templates, and request deletion of any retained data by contacting admin@sewpoint.app or by using the in-product controls.

Google data is handled under the following controls, in addition to the general measures described in Privacy Policy §7:

• Transport security. All calls to Google APIs and to our backend use TLS 1.2 or higher.
• Token-at-rest encryption. OAuth access and refresh tokens are stored encrypted in our database and are never logged in plaintext.
• Least-privilege access. Production credentials are scoped per-service; engineers do not have routine read access to user OAuth tokens or to user file payloads.
• Per-request fetch. SEWPOINT does not pre-fetch, mirror, or cache user decks. Fetches happen only when triggered by an active user request.
• No human review by default. Production payloads are not routinely read by humans. The narrow exceptions are listed in §2 above and in Privacy §4.
• Breach notification. In the event of a confirmed security incident affecting your Google API data, we will notify you and the relevant authorities as required by applicable law.

You can revoke SEWPOINT's access to your Google account at any time, in either of two equivalent ways:

1. From SEWPOINT. Open your account settings inside SEWPOINT and click Disconnect Google Workspace. SEWPOINT will discard its stored OAuth tokens for your account.
2. From Google. Visit Google Account → Security → Third-party apps with account access, select SEWPOINT, and click Remove access.

Either action immediately stops SEWPOINT from being able to make further calls to Google APIs on your behalf. To additionally delete any data SEWPOINT has retained about you, follow the account-deletion flow in your SEWPOINT account settings or email admin@sewpoint.app.

We will update this page whenever the set of Google scopes we request changes, whenever the mapping of features to scopes changes, or whenever we materially change how Google API data is handled. The Last updated date at the top reflects the most recent revision. For changes that require new consent, you will be re-prompted at the OAuth consent screen.

Questions about this page, about the scopes we request, or about how we handle Google API data:

Email: admin@sewpoint.app

LinkedIn: SEWPOINT on LinkedIn — message SEWPOINT on LinkedIn for business and technical support. You may also email us using the address above.

Mail: SEWPOINT 30 N Gould St Ste R Sheridan, WY 82801 United States

This page does not replace our Privacy Policy or Terms & Conditions; it supplements them with operational detail focused specifically on Google API data.