Privacy Policy

Effective Date: 24th April 2026

1. Introduction

This Privacy Policy describes how AppsEDU ("we", "us", or "our") collects, uses, and protects your information when you use our Workspace Audit application (the "Service"). Our commitment is to be transparent about the data we access and to safeguard your privacy.

2. What Data We Collect

We collect only the information necessary to provide and improve our Service. This data is broken down into the following categories:

Information You Provide Directly

• Account Information: When you sign in with Google, we receive your name, email address, and profile photo as provided by Google.
• Onboarding Information: For new users, we ask for your Organisation Type, Organisation Size, and your Role. This helps us understand our user base and improve the tool.

Information We Access from Your Google Workspace

Google API Scopes (Manual Scan)

To perform the foundational security audit when you sign in, our Service requests your permission to use the following "read-only" scopes from the Google API:

• https://www.googleapis.com/auth/cloud-identity.policies.readonly
  Used to read core Workspace security toggles (e.g., Password strength, Drive external sharing policies).
• https://www.googleapis.com/auth/admin.directory.orgunit.readonly
  Used to read your Organizational Unit structure to determine policy inheritance.
• https://www.googleapis.com/auth/admin.directory.group.readonly
  Used to read your Group structure to determine policy inheritance.

Additional Scopes (Pro Tier Automated Scans & Deep Dives)

For users who upgrade to our Pro tier and enable advanced scanning (Risk Center, Timeline), we require you to manually grant additional "read-only" permissions to our secure backend service account via Google's Domain-Wide Delegation (DwD) feature. These scopes are:

• https://www.googleapis.com/auth/drive.readonly
  Used to scan Shared Drive metadata (managers and external members) to find orphaned or exposed drives. We do not read or access the contents of your files.
• https://www.googleapis.com/auth/admin.reports.audit.readonly
  Used by the "Third-Party App Risk" scan to find OAuth app authorizations in your domain's audit logs, and to populate the Security Timeline.
• https://www.googleapis.com/auth/admin.directory.user.readonly & https://www.googleapis.com/auth/admin.directory.user.security
  Used to verify user 2-Step Verification enrollment and identify inactive or suspended accounts.
• https://www.googleapis.com/auth/admin.directory.group.member.readonly
  Used to identify external members within your Google Groups.
• https://www.googleapis.com/auth/apps.groups.settings
  Used by the "Google Groups Security" scan to read the security settings of your groups (e.g., detecting groups set to "Public").
• https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
  Used to audit custom administrator roles and privilege escalation paths.
• https://www.googleapis.com/auth/apps.licensing
  Used to map license usage across your organization.
• https://www.googleapis.com/auth/admin.directory.domain.readonly
  Used to scan your domain's DNS security records (SPF, DKIM, DMARC) to prevent email spoofing.

These scopes are never requested from you at sign-in via the OAuth consent screen and are only used by our automated backend functions, which you must explicitly authorize inside your own Google Admin Console.

Your Communication Preferences

During onboarding, we ask for your preferences regarding email communications, such as product updates or security newsletters.

3. How We Use Your Data

• To Provide the Service: The primary use of your Google Workspace data is to run the security scan, compare it against best practices, and generate the report for you to view in the dashboard.
• To Improve the Service: We use the onboarding information (e.g., Organisation Size, Role) in an anonymized and aggregated format to analyze user demographics and guide our product development. Your specific data is never singled out.
• Data Usage Clarification: We do not use your specific security findings for aggregated analytics or any other purpose without your explicit consent. Your report data is for your use only.
• To Communicate With You: If you opt-in, we will use your email address to send you the communications you have requested, such as product updates or security newsletters. You can unsubscribe from these emails at any time via a link in the email footer.

4. Data Storage, Security, and Transfers

All customer data, including your user profile and generated security reports, is stored exclusively on servers located within the European Union (EU).

We take data security seriously and implement industry-standard measures to protect your information, including encryption of data in transit (HTTPS) and at rest (as provided by Google Cloud Firestore and BigQuery). Access to production data is strictly limited to authorized personnel for maintenance and support purposes.

5. Your Data Protection Rights (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

You have the right to:

• Access, update, or delete the information we have on you.
• Request correction of any information that is inaccurate or incomplete.
• Object to our processing of your Personal Data.
• Request that we restrict the processing of your personal information.

To exercise these rights, please contact us at privacy@appsedu.com.

6. Data Sharing (Subprocessors)

We do not sell your personal data to third parties. We only share data with essential service providers ("subprocessors") who are required to provide our service, as well as authorized organizational partners. Our subprocessors are:

• Google Cloud Platform: Used for application hosting, database storage (Firestore), and backend logic (Cloud Functions).
• Google Authentication: Used to securely manage user sign-in.
• SendGrid (Twilio): Used to send email notifications, security alerts, and PDF/CSV reports to you, the user.
• Google Gemini API: Used to generate the AI-powered insights and summaries within your dashboard. We send aggregated, non-personally identifiable data about security settings to this service for analysis. Data submitted through this enterprise API is not used to train Google's public foundation models.
• Authorized Parent Organizations and Partners: If your organization joins the Service via an invitation link from a Parent Organization (e.g., a Multi-Academy Trust) or a Managed Service Provider (MSP), you grant them read-only visibility into your domain’s security posture and compliance scores. They cannot modify your settings, and you may revoke this access at any time from your settings dashboard.

7. Data Retention and Deletion

We retain your user profile information as long as your account is active.

Security scan reports, configuration snapshots, and historical audit logs (such as the Security Timeline) are retained in our data warehouse for a period of up to six (6) months (180 days) to enable historical analysis and regression tracking. After this period, they are systematically and permanently purged. We also utilize automated routines to proactively delete old, cached findings from our hot storage to minimize our data footprint.

You may request the permanent deletion of your account and all associated data, including all historical reports, at any time by contacting us at privacy@appsedu.com.

8. Education Privacy and FERPA Compliance

If you are an educational agency or institution subject to the Family Educational Rights and Privacy Act (FERPA) or similar educational privacy laws, we acknowledge that in providing the Service, we may process student metadata (such as organizational unit placement, email addresses, or third-party app authorizations).

• School Official: We operate as a "School Official" with a "legitimate educational interest" to provide security auditing services to your institution.
• Data Usage: We use this data solely for the purpose of providing and improving the Service for your institution. We do not use student data for targeted advertising, marketing, or to create student profiles for non-educational purposes.
• Control: The educational institution retains ownership and control of all student records and metadata. Data will be deleted upon termination of the contract or at the school's explicit request.

9. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top. We may also notify you via email if the changes are significant.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy@appsedu.com.