Privacy Policy

Effective Date: August 18, 2006
Last Updated: August 18, 2006

GExcel (“we,” “us,” or “our”) respects your privacy. This Privacy Policy explains what information we collect, how we use it, how we protect it, and your rights regarding it, in connection with your use of https://gexcel.vercel.app and our backend services (collectively, the “Service”).

This Policy should be read alongside our Terms of Service.

1. Information We Collect

1.1 Information from Google Sign-In

When you sign in with Google, we receive, via Google OAuth2, with your explicit consent:

• Your Google account ID, name, and email address (scopes: openid, email, profile)
• A Drive access/refresh token (scope: drive) that allows the Service to read your Drive folder structure, list files, and modify sharing permissions on files you explicitly select

We do not receive your Google account password. We do not access Drive content outside folders you explicitly browse or select within the Service.

1.2 Google Drive Content Metadata

When you use the folder browser and catalog features, we access and may store:

• Folder and file names, IDs, thumbnail links, and MIME types
• File sharing-permission status
• Public URLs generated after a file’s permission is changed to “Anyone with the link can view”

We do not download, copy, or permanently store the actual image/video file bytes on our servers. We store references (links, names, metadata) necessary to build your catalog and Excel export.

1.3 Account & Usage Data

• Catalog names, product names, and the list of image/video URLs associated with each product
• Plan, subscription status, billing cycle, and credit balance
• Timestamps of catalog creation, exports, and account activity
• Admin flag (for internal team accounts only)

1.4 Payment Information

Payments are processed by Razorpay. We receive and store limited billing metadata (Razorpay order ID, payment ID, subscription ID, payment status, amount, plan/pack purchased). We do not receive or store your full card number, CVV, UPI PIN, or bank credentials — these are handled entirely by Razorpay under its own security and privacy practices.

1.5 Technical Data

• IP address, browser type, device information, and access logs, collected automatically for security, debugging, and fraud prevention
• Cookies and similar technologies (see our Cookie Policy)

2. How We Use Your Information

We use collected information to:

1. Authenticate you and maintain your session (JWT in an httpOnly cookie);
2. Provide core functionality: browsing Drive folders, generating public links, building catalogs, and exporting Excel files;
3. Enforce plan/credit entitlement limits;
4. Process subscription and credit-pack payments via Razorpay;
5. Send transactional communications (e.g., payment confirmations, entitlement warnings, security alerts);
6. Maintain platform security, detect fraud or abuse, and enforce our Terms of Service;
7. Analyze aggregate, non-identifying usage trends to improve the Service;
8. Comply with legal obligations.

We do not sell your personal information or Drive data to third parties. We do not use your Google Drive content for advertising purposes.

3. Google API Services User Data Policy Disclosure

GExcel’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, where applicable to the scopes we request.

Specifically:

• We only request the minimum Google Drive scope necessary to list folders/files and modify sharing permissions on files you explicitly select.
• We do not use Drive data to serve advertisements.
• We do not allow humans to read your Drive data except: (a) with your affirmative consent for a specific support request, (b) for security purposes (e.g., investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized.
• We do not transfer Drive data to third parties except as necessary to provide the Service (e.g., our database and hosting providers), to comply with law, or as part of a merger/acquisition (subject to this Policy continuing to apply).
• You may revoke GExcel’s access to your Google account at any time via your Google Account permissions page. Revoking access will prevent the Service from functioning until reconnected, but does not automatically delete data already stored in our database (see Section 6 on deletion).

4. Legal Basis for Processing (EU/UK Users)

If you are located in the European Economic Area or UK, we process your personal data on the following legal bases under GDPR:

• Performance of a contract — to provide the Service you’ve signed up for;
• Consent — for Google Drive access scopes and non-essential cookies;
• Legitimate interests — for fraud prevention, security, and service improvement;
• Legal obligation — for tax, accounting, and compliance requirements.

5. Data Sharing & Third-Party Processors

We share information only with service providers who process it on our behalf, under contractual confidentiality obligations, including:

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

We may disclose information if required by law, subpoena, or governmental request, or to protect our rights, users, or the public from harm or fraud.

6. Data Retention & Deletion

• We retain your account data, catalogs, and billing metadata for as long as your account is active, and for a reasonable period thereafter to comply with legal, tax, and accounting obligations (typically up to 7 years for financial records, per Indian law).
• You may request deletion of your account and associated data by emailing bhroser550@gmail.com. We will delete or anonymize your personal data within 30 days of a verified request, except data we are legally required to retain.
• Deleting your GExcel account does not reverse sharing-permission changes already made to files in your Google Drive; you must manually revert those in Google Drive if desired.
• Revoking Drive access via Google does not, by itself, delete data already stored in our database — please also submit a deletion request to us.

7. Data Security

We implement industry-standard technical and organizational measures to protect your data, including:

• Encrypted connections (HTTPS/TLS) for all data in transit;
• httpOnly, secure cookies for session tokens (JWT), not accessible to client-side scripts;
• OAuth tokens stored server-side, never exposed to the browser;
• Access controls restricting internal access to production data;
• Razorpay HMAC signature verification for webhook authenticity.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we work to protect your information using accepted industry practices.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion of your data (“right to be forgotten”);
• Object to or restrict certain processing;
• Request a portable copy of your data;
• Withdraw consent (e.g., by revoking Google Drive access) at any time, without affecting the lawfulness of prior processing;
• Lodge a complaint with your local data protection authority (EU/UK users) or the Indian Data Protection Board (under the Digital Personal Data Protection Act, 2023, once applicable rules are notified).

To exercise these rights, contact us at bhroser550@gmail.com.

9. Children’s Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

10. International Data Transfers

Our servers and service providers may be located outside your country of residence, including in jurisdictions with different data protection laws than your own (e.g., the United States, via hosting providers). By using the Service, you consent to this transfer, storage, and processing, which we undertake with appropriate safeguards.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notice at least 7 days before taking effect. The “Last Updated” date at the top reflects the most recent revision.

12. Contact Us

For privacy-related questions or requests:

GExcel
Email: bhroser550@gmail.com (Data Protection Contact)