This policy covers epiczlab, the Google OAuth application associated with Devcraft Consulting, as well as the website at devcraftconsulting.se and email enquiries. epiczlab uses Google for sign-in and to let you connect Google Drive items you choose. Devcraft Consulting is based in Stockholm, Sweden. For privacy questions or requests, email hello@devcraftconsulting.se.
Google sign-in and Drive access
The application name shown on Google's consent screen is epiczlab. Google sign-in is used to authenticate you to the application. Google handles your Google password; you do not provide it to epiczlab.
When a workspace admin connects Google Drive, the Drive connection requests a single scope, Google Drive file permission (drive.file). You explicitly select folders through Google Picker for use with the application.
This permission applies to individual Drive items you authorize for the app and items created by the app. It does not grant access to your entire Drive. The permission can allow reading, creating, changing, and deleting authorized items; it is not a read-only permission. Selecting a folder does not provide blanket access to every file in your Drive.
Google sign-in is used for authentication. The Drive connection lets epiczlab download documents from the folders you choose to share with the application and add them to your customer's knowledge base. These permissions do not grant access to your Gmail messages or Google Calendar events.
Documents in your customer's knowledge base
epiczlab accesses and downloads the content of authorized documents from the Google Drive folders you select. Downloaded documents are added to the epiczlab knowledge base in a workspace used exclusively by the specific customer.
The imported document content is stored in that customer's workspace to provide its knowledge base. It is not made available in other customers' workspaces. This creates a copy of the document content outside Google Drive.
Disconnecting Drive and deleting tokens
A workspace admin can disconnect Google Drive at any time. Disconnecting permanently deletes the stored encrypted refresh token from our active database. Deleting the connection or the workspace also deletes the token.
The encrypted refresh token is retained only while the connection is active. Any remaining backup copies expire within our standard backup-rotation window.
You can review or revoke epiczlab's access at any time through your Google Account connections. Revoking access prevents further access under that authorization. It may affect Google sign-in and connected Drive features.
Revoking authorization does not itself delete documents already imported into the customer's epiczlab knowledge base. To request deletion of your epiczlab data, including imported document content, contact hello@devcraftconsulting.se and identify the account, customer workspace, and documents concerned. Do not send your Google password or access tokens.
Google Drive token storage and protection
When a workspace admin connects Google Drive, Google provides an OAuth refresh token. We store only the refresh token. Short-lived access tokens are generated on demand from it, held in server memory only for the duration of a request, and discarded. Access tokens are never persisted.
The refresh token is encrypted before it reaches our PostgreSQL database using AES-256-GCM authenticated encryption, with a unique random 96-bit initialization vector for each secret and an authentication tag that detects tampering. The 256-bit encryption key is held separately in the deployment environment or secret store, so database access alone cannot decrypt a token.
The encrypted token belongs to a single workspace. Database row-level security isolates it from other customers' workspaces. Tokens are stored on a write-only basis: no API or user-facing endpoint returns them. A refresh token is decrypted only on the server, temporarily, to obtain an access token for a Drive request.
All communication with Google and between our services uses TLS/HTTPS encryption.
How Google Drive tokens are used
Refresh tokens are used solely to read authorized documents from the folders you selected, on your behalf, for the knowledge base import you configured. Tokens are never sold, shared with third parties, or used for advertising. The refresh token is sent to Google only as needed to obtain an access token.
Google API Limited Use
Our use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Website visits and email enquiries
- Website requests. When you visit, your browser sends technical information such as your IP address, requested URL, and browser information to our hosting provider, Vercel, to deliver the website. The hosting service may process request logs for operation, troubleshooting, and security.
- Email enquiries. If you email us, you provide your email address and any name, contact details, message content, or attachments you choose to include. This information is used to respond to your enquiry and discuss or provide the services you request.
- Fonts. Our homepage loads fonts from Google Fonts. Your browser connects to Google to retrieve them, which sends Google technical information including your IP address and browser request details. See Google Fonts privacy information.
Website cookies and analytics
The Devcraft Consulting marketing website does not set cookies or use browser storage, and does not include advertising trackers or analytics scripts. This description applies to the marketing website, rather than epiczlab's sign-in session.
Website and email service providers
Technical website requests are handled by Vercel, and font requests from the homepage are handled by Google. Email correspondence passes through the email providers used by you and Devcraft Consulting. These services process information to deliver the website, fonts, and messages.
For details about the hosting provider's processing, see Vercel's privacy policy.
Website and email storage and security
The marketing website is served over HTTPS, which encrypts information in transit between your browser and the website. There is no account database or form submission storage in the marketing website. Email enquiries are stored separately in the email systems used to handle correspondence.
Please avoid sending passwords, access tokens, or sensitive personal information in an initial email enquiry.
Website and email retention and deletion
Email correspondence is retained for handling your enquiry and any resulting business relationship, and where needed to meet legal obligations. Hosting logs are subject to the hosting service's retention settings and policies.
To request deletion of information you have sent us, email hello@devcraftconsulting.se and identify the correspondence concerned. We may need to verify your identity before acting on a request. If information must be retained to meet a legal obligation, we will explain this in our response.
Your privacy requests
You can contact us to request access to, correction of, or deletion of your personal information, or to raise concerns about its use. Depending on applicable law, you may also have rights to restrict or object to processing and to receive a portable copy of your information.
You can raise a complaint with your local data protection authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY).
Changes to this policy
Updates will be published on this page with a revised date. Changes to how epiczlab uses Google user data will be disclosed before that data is used for a new purpose, with additional consent requested where required.