Privacy Policy

2. Google API Services User Data Policy

Patrimony's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not use your Google data for any purpose other than providing the Patrimony service you have requested
• We do not use your Google data for advertising
• We do not transfer, sell, or use Google user data to train AI or machine learning models
• We do not allow humans to read your Google data except: (a) with your explicit consent, (b) where necessary for security or fraud prevention, or (c) where required by law

Google OAuth scopes we request:

• Specific File Access (drive.file) — to create and manage the dedicated Patrimony (Documents) folder, your asset records spreadsheet, and any documents you explicitly upload. We cannot see, read, or modify any other files or folders in your Google Drive.
• Basic Profile & Email (openid, email, profile) — to securely identify your account and personalize your dashboard.

3. Data Storage and Ownership

Your data is in your Google Drive. We do not maintain a parallel copy of your asset records on our servers.

When you connect your Google Account, we create a dedicated folder directly in your personal Google Drive:

• Patrimony (Documents) Folder — a transparent, user-owned folder in your Google Drive containing your asset database spreadsheet (Patrimony_Database_DO_NOT_DELETE), uploaded supporting documents (PDFs, certificates, ID scans), and automated recovery backups.

This folder is located directly in your Google Account. You can inspect, view, or export your records directly at any time via Google Drive. Disconnecting Patrimony from your Google Account or revoking permissions immediately terminates our access.

4. Information We Collect and Store on Our Servers

We store the minimum required to operate the service:

• Email address & Profile Data: For account identification and personalization.
• Encrypted OAuth token: Your Google refresh token, securely encrypted, to authenticate Drive API calls for scheduled checks.
• Inactivity threshold & Timestamps: To run the Dead Man's Switch scheduler.
• Nominee details & Access tokens: To notify nominees and route portal access.
• Login audit timestamps: For account security and audit trail.

We do not collect, store, or process: The contents of your asset records, the files you upload, data from your other Google services, or behavioral analytics.

5. How We Use Your Google Drive Data

When you load your dashboard, our server reads your Google Sheet and Drive folder to compile your asset records and display them in the UI. We temporarily process your Google Drive data in memory to render your dashboard. We do not persistently store those records after the request is completed.

6. Third-Party Personal Information — Nominee Data

When you add a nominee, you provide their name, email address, and relationship to you. This is third-party Personally Identifiable Information (PII). This information is used exclusively to contact nominees when your safety protocol triggers, stored encrypted, and never used for marketing.

7. Data Retention & Account Deletion

Account metadata, encrypted tokens, inactivity settings, and nominee details are retained until account deletion. Login audit timestamps are retained for 12 months.

Account Deletion — Clean Break Protocol: When you delete your account, your Google OAuth token is revoked immediately, all Firestore data is permanently deleted, and your identity is removed. This process is irreversible.

For complete instructions on self-service deletion or submitting a manual deletion request by email, visit our dedicated Account & Data Deletion Page.

8. Your Rights

Under the GDPR and the DPDP Act (2023), you have the right to Access, Rectification, Erasure, Withdraw Consent, and Data Portability. To exercise any right, contact support@patrimony.info.

9. Cookies and Session Management

We use secure session tokens in your browser to maintain your authenticated session. We do not use advertising or tracking cookies.

10. Children's Privacy

Patrimony is not intended for users under 18. We do not knowingly collect data from children.