Privacy Policy

Summary of how Google user data is handled

The table below summarises how the salvatorelaspata.dev application accesses, uses, stores, shares, protects and deletes the Google user data it obtains through the Google Drive and Google Sheets APIs. Each point is expanded in the sections that follow.

1. Data controller and scope of this policy

This policy describes how the salvatorelaspata.dev application, registered by Salvatore La Spata in the Google Cloud Console and shown on Google's OAuth consent screen, handles the data of the Google account that authorises it. It covers this application only, and no other service or website.

• Data controller: Salvatore La Spata
• Contact: [email protected]
• Application homepage: https://salvatorelaspata.net — this policy is hosted on the same domain and is linked from the homepage footer.

2. What the application is

n8n is an open source workflow automation platform. The instance this policy refers to is private and self-hosted: it runs on infrastructure controlled by the data controller and is used solely to automate the controller's own personal tasks.

• It is not a service offered to the public: there is no sign-up, no third-party users and no functionality exposed to external visitors.
• The only Google accounts that can authorise the application are the controller's own account and any account explicitly added as a test user in the Google Cloud Console.
• Google data is accessed only when a workflow — started manually by the controller or by a schedule they defined — requires it.

3. What Google account data is accessed

During authorisation the application requests, via OAuth 2.0, the scopes listed below. These are the default scopes of n8n's Google Drive and Google Sheets nodes and match exactly the ones declared on the consent screen.

Once authorisation is complete, Google also issues the application an OAuth 2.0 token (access token and refresh token) representing the permission granted. The application does not request and does not receive access to Gmail, Contacts, Calendar, Google Photos, YouTube, location history or any Google service other than Drive and Sheets.

4. How the data is used

Data obtained through the Google APIs is used exclusively to run the automations configured by the controller, namely to:

• read rows from a Google Sheets spreadsheet and process them to produce a result;
• write, update or delete rows in a Google Sheets spreadsheet created or specified by the controller;
• read, upload, rename, move or delete Google Drive files explicitly referenced in a workflow;
• locate a file or spreadsheet by name, ID or folder so that it can be selected within a workflow.

Processing happens in transit, inside the controller's own n8n instance. The data is not used for profiling, advertising, retargeting, behavioural analysis, creditworthiness assessment or any purpose other than executing the workflow that requested it.

5. Use of Google API Services and User Data (Limited Use)

The app's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

The full text of the policy referenced above is available at Google API Services User Data Policy. In practice this means that:

• data obtained from Google APIs is used only to provide or improve user-facing features within the workflows that request it;
• the data is not transferred to third parties, except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition with the user's explicit prior consent;
• the data is not sold or transferred to data brokers, advertising networks, information resellers, or to any party that would use it for advertising, retargeting or creditworthiness assessment;
• data obtained through Google Workspace APIs is not used to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models;
• no humans read the user's Google data, except with the user's explicit prior consent, for security purposes (such as investigating abuse), to comply with applicable law, or where the data is aggregated and anonymised for internal operations.

6. Sharing with third parties

No data obtained from the Google APIs is shared with third parties. The only communication is the direct, HTTPS/TLS-encrypted exchange between the controller's n8n instance and Google's servers.

• There are no analytics, advertising-tracking or profiling systems receiving data from the Google APIs.
• No Google data is sent to external vendors or third-party services.
• Disclosure to an authority may occur only where the controller is under a legal obligation to comply.

7. Where the data is stored, for how long, and how it is deleted

The application runs on a private server controlled by the data controller and located in the European Union. There is no external storage bucket, no third-party database and no backup of Google content outside that server. What is kept, and for how long, is set out below.

• OAuth tokens: stored encrypted (AES-256) in the n8n instance database, protected by the instance encryption key. They remain valid until the user revokes the authorisation.
• Drive and Sheets content: processed in transit and not stored permanently. No copy of Google files is created outside the controller's n8n instance.
• Workflow execution logs: may temporarily contain the processed data; they are kept only as long as needed to verify correct operation, and in any case no longer than 30 days, after which they are deleted automatically.

How to revoke access and request deletion

1. Revoke the authorisation at myaccount.google.com/permissions: from that moment the application loses all access to the account's data.
2. Alternatively, or in addition, write to [email protected]: the stored credentials and the associated execution logs will be deleted within 30 days of the request.

8. Security

• All calls to the Google APIs are made over an encrypted HTTPS/TLS channel.
• OAuth credentials are encrypted at rest in the n8n database using the instance encryption key.
• Access to the n8n interface is protected by authentication and restricted to the controller alone.
• The instance is kept up to date with supported n8n releases.
• No collaborator or third-party vendor has access to the Google data processed.

9. Legal basis and data subject rights (GDPR)

Processing is based on the consent given at the time of OAuth authorisation (Article 6(1)(a) of Regulation (EU) 2016/679), which can be withdrawn at any time as described in section 7. As this is a personal-use application, the data processed is the controller's own.

Anyone authorising the application may exercise their rights of access, rectification, erasure, restriction, portability and objection (Articles 15-22 GDPR) by writing to [email protected], and has the right to lodge a complaint with the Italian Data Protection Authority.

10. Children

The application is not directed at children under 16 and does not knowingly collect their data.

11. Changes to this policy

Any changes are published on this page, with the date at the top updated accordingly. Material changes to how Google data is handled will be reflected here before they take effect.

12. Contact

For any question about this policy or about how Google data is handled:

• Salvatore La Spata
• [email protected]
• https://salvatorelaspata.net