Privacy policy

Last updated 7 August 2026

This policy covers the connector at this address, operated by Latinum Labs, for Summer Holdings Group LLC. Latinum Labs is responsible for the handling described here. It is a private deployment: data is not sold, rented, shared for advertising, or used to train any model.

What is stored

• Google credentials. The refresh token for each individually authorized account, encrypted at rest. Accounts reached through Workspace delegation have no stored credential at all.
• Account records. The email address, display name, and granted permissions of each connected account, and which connector user added it.
• Identity. An identifier derived by hashing the Google account that set up a connection, together with the email address and display name Google returns for it.
• Authorization records. Registered client details and issued grants, so the assistant can reconnect without reauthorizing every time.

What is not stored

Messages, attachments, and Drive files are not copied into a database here. Requests from the assistant are passed through to Google's APIs and the results returned; they are not retained after the request completes. Nothing is indexed, cached, or written to disk.

How it is protected

• Stored credentials are sealed with envelope encryption — a per-record AES-256-GCM key, itself wrapped by an RSA key held in Azure Key Vault and never exposed to the application.
• All traffic is HTTPS, TLS 1.2 or better.
• The service holds no credentials of its own: it reaches its key vault and its storage through an Azure managed identity, and storage shared-key access is disabled.
• Logs record hashed user and account identifiers, the tool called, and whether it succeeded. Message contents, search queries, attachment data, email addresses, tokens, and encrypted values are never logged.
• Each person's set of connected accounts is isolated from every other's. Holding one mailbox's credentials does not reveal any other account connected to this service.

Limited use

This application's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion

An account's stored credential and registry entry are deleted when it is disconnected. Revoking the app from a Google account invalidates its credential immediately. Operational logs are retained for a limited period for troubleshooting.

Your requests

To ask what is held about you, or to have it deleted, write to max@summertax.com.