Privacy Policy

What we collect

• Your Google account identity. When you sign in with Google we request only your basic profile and email address. We use your email address to identify you and to decide what you are allowed to see.
• Access records. We log actions taken in the Portal — signing in, viewing a folder, downloading, uploading, renaming, moving or deleting a file, and every change to who has access — along with your email address and a timestamp.
• Permission records. Which folders an administrator has granted your account, and at what level.

We do not collect analytics, advertising identifiers, or behavioural tracking data, and the Portal contains no third-party trackers.

Why we collect it

To authenticate you, to enforce which documents you may access, and to keep an answerable record of who accessed which business document and when. Because these are business records, that access log is a core purpose of the Portal rather than an optional extra.

Where it is stored

• Documents are stored in Google Drive, within a Google Shared Drive controlled by Projekt Indigo Studio Limited.
• Permission and access records are stored in a PostgreSQL database hosted on Google Cloud SQL in Mumbai, India (asia-south1).
• The application itself runs on Google Cloud Run in Mumbai, India (asia-south1).

Who it is shared with

We do not sell your data and we do not share it for advertising. Data is processed only by the service provider that runs the Portal — Google (sign-in, Drive storage, database and application hosting) — and is visible to Projekt Indigo Studio Limited administrators.

Access is closed by default

Signing in with Google does not by itself grant access to anything. An administrator must explicitly grant your account access to a folder; until then, and after access is revoked, you can see nothing. All traffic is encrypted in transit.

Cookies

The Portal sets a session cookie so you stay signed in, and administrators previewing the Portal as another role set a small preference cookie. Both are strictly necessary for the Portal to function. There are no advertising or analytics cookies.

Retention

Permission records are kept until an administrator revokes them. Access logs are retained as business records so that document access remains auditable. To request removal of your account or a copy of the data held about you, contact us using the address below.