Security Policy

1. About this app
   Hermes Integration (“the App”) is a personal automation tool built and operated by M. Setio (“I”, “me”), an individual developer based in Indonesia. The App is used only by its developer to read email from his own Google accounts and to automate personal record-keeping. It is not offered to the public, and no other user accounts exist.
2. Data the App accesses
   With my explicit consent through Google’s OAuth screen, the App requests the following scope:

Message metadata (sender, subject, date received).
Message bodies and attachments, only for messages that match specific search filters (for example, notifications from a document-management system, or reports with spreadsheet attachments).
The App does not send, delete, modify, or label any email. It does not access contacts, calendar, or Drive through this authorization.

3. How the data is used
   The data is used only to:

Detect new notification emails and download the attached or referenced documents.
Extract tabular data from report attachments and merge it into my own local database.
The data is not used for advertising, profiling, selling, or training of generalized AI or machine-learning models.

4. Storage and security

The OAuth token and all downloaded data are stored only on my own computer, in access-restricted folders.
Nothing is uploaded to a third-party server operated by me.
The token can be revoked by me at any time at https://myaccount.google.com/permissions, or by deleting the local token file.
Email content is deleted from local storage when it is no longer needed; derived records (for example, rows added to a database) are kept for as long as I need them.
5. Sharing and disclosure
I do not sell, rent, transfer, or share Google user data with any third party, except where required by law. Short summaries of results (for example, “3 new documents downloaded”) may be delivered to my private messaging account; they do not include full email content.

6. Google API Services User Data Policy
   The App’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. Human access
   No person other than me reads the data. Email content is processed by automated scripts on my computer. If a language-model assistant is used to summarize results, only the minimum text needed for that task is processed, and it is not retained by me for any other purpose.
8. Your rights and deletion
   Because the App serves only its developer, there are no other data subjects. For any question or to request deletion of data related to you that might appear in my mailbox, contact me at the address below.
9. Changes
   I may update this policy. Material changes will be reflected by the “Last updated” date above.