Privacy Policy

This Privacy Policy describes how Hermes Agent Automation Services ("the Application", "we", "our", or "us"), owned, developed, and maintained by Bryan Woods under the domain teamwoods.us, collects, accesses, processes, retains, and protects personal data and Google user data. This Application is an internal administrative workflow engine designed exclusively for domestic operations, personal automation routines, and system maintenance. It is not offered to the public, does not support third-party multi-tenant usage, and is operated solely by the system administrator.

1. Information We Access, Collect, and Process

We believe in data minimization and transparency. The Application processes data under two distinct operational categories: direct technical data necessary to host and secure the application, and Google user data accessed via authorized Google OAuth APIs.

A. Technical Data Collected Automatically

• Server Operational Logs: When accessing the Application's web interface or webhook endpoints, our web server infrastructure temporarily records standard HTTP request logs (including client IP address, browser user-agent, operating system details, timestamps, and request path). These logs are utilized exclusively for server performance monitoring, abuse mitigation, and network security diagnostics.
• Session State & Local Configuration: The Application uses local session identifiers and local secure database records solely to authenticate the administrator and store user-configured automation parameters. We do not use third-party tracking cookies or marketing beacons.

B. Google User Data Accessed via Google APIs

When the authorized administrator connects their Google Account using Google OAuth 2.0, the Application accesses specific categories of Google user data strictly required to execute automated tasks:

• Account Profile & Identity: Primary email address and account ID to authenticate administrative sessions and bind OAuth tokens to the authorized account.
• Google Drive Files & Metadata: File identifiers, names, MIME types, directory structures, and file payloads accessed strictly to execute automated file management, data transfer pipelines, and backup archival routines.
• Google Workspace & Gmail Data: Message metadata, message content, labels, or message dispatch interfaces accessed solely to relay operational alerts, system diagnostic notices, and domestic administrative summaries.
• Google Sheets & Calendar Data: Spreadsheet row data or calendar events accessed solely when configured to log internal system metrics or read administrative schedule triggers.

2. Detailed Purpose of Google Data Processing

The Application processes Google user data exclusively to perform user-requested and user-configured automation workflows. The table below provides a granular mapping between accessed Google data and its functional execution:

Google Service / Data Category	Specific Operational Purpose	Processing Method & Storage
Google Account / Profile (userinfo.email, userinfo.profile)	Identifies and validates the administrator's authorized account during OAuth authentication.	Profile data is read ephemerally. The OAuth refresh token is encrypted at rest on the local server.
Google Drive (drive, drive.file, drive.readonly)	Reads specific administrative files, archives operational data, and automates directory organization.	Processed ephemerally in volatile system memory (RAM). Payloads are purged immediately after task completion.
Gmail / Workspace (gmail.send, gmail.readonly)	Transmits administrative notifications, server health alerts, and processes incoming operational triggers.	Message payloads are processed in volatile RAM only to construct and send notifications; no emails are stored.

Explicit Prohibitions on Data Use:

• Google user data is never sold, rented, leased, or traded to third parties.
• Google user data is never used for targeted advertising, retargeting, interest-based profiling, or commercial marketing.
• Google user data is never transferred to third-party data brokers, information resellers, or marketing exchanges.
• Google user data is never utilized to train, tune, or improve generalized or non-personalized artificial intelligence (AI) models, large language models (LLMs), or machine learning (ML) algorithms.

3. Data Retention and Deletion Schedule

We maintain strict retention boundaries to prevent unnecessary data persistence:

• Google API Payloads (0-Second Retention): All file contents, email messages, document data, and metadata retrieved via Google APIs exist solely in volatile memory (RAM) for the milliseconds required to execute the active workflow. They are wiped from memory immediately upon task completion. No copies remain in persistent storage.
• OAuth Refresh Tokens: Tokens remain stored on the local, encrypted server volume until access is revoked by the administrator.
• Server Operational Logs: Technical server access logs (IP addresses and connection timestamps) are rotated and permanently purged automatically every 14 days.

4. How to Request Data Deletion and Revoke Access

Users maintain unilateral control over the Application's access to their Google data at all times:

1. Instant OAuth Revocation: You can disconnect and permanently revoke the Application's permissions at any time through the Google Account Permissions Manager. Revoking access immediately renders stored OAuth tokens invalid and terminates all automated API calls.
2. Purging Server Configurations: To request or verify the complete removal of stored OAuth tokens, configured workflow pipelines, or associated technical logs from the host server, submit a deletion request to privacy@teamwoods.us. Requests are verified and executed within 24 to 48 hours.

5. Data Sharing and Third-Party Disclosures

The Application operates in a private, single-tenant deployment. We do not share, disclose, or transfer any Google user data or personal information to third parties. Data is only transmitted across secure HTTPS connections directly between our private server infrastructure and Google's official API endpoints.

6. Google API Services User Data Policy (Limited Use Disclosure)

7. Technical Data Protection and Security Controls

To protect administrative credentials and data in transit, we employ multi-layered technical security safeguards:

• Encryption in Transit: All communications between the Application, Google APIs, and connecting browsers are enforced using modern Transport Layer Security (TLS 1.2 and TLS 1.3) with HSTS enabled.
• Encryption at Rest: OAuth client secrets, refresh tokens, and internal database volumes are stored using industry-standard file-level AES-256 encryption on the host filesystem.
• Network and Host Isolation: The Application is hosted on dedicated virtual infrastructure protected by restrictive network firewalls, strict port isolation, and key-based administrative access controls.

8. Children's Privacy Protection (COPPA Compliance)

The Application is designed exclusively for adult administrative operations and is not intended for, directed at, or marketed to children under 13 years of age. We do not knowingly collect, request, or maintain personal information from children under 13.

9. Policy Modifications and Notifications

If our data processing practices, infrastructure, or integration scopes change, this Privacy Policy will be promptly updated on this page with a revised "Last Updated" date. Because the Application is operated exclusively for internal administrative use, updates are reviewed directly by the system administrator upon deployment.

10. Developer and Administrative Contact Information

For questions, privacy inquiries, or data deletion verification regarding Woods Automation Services, contact the administrator directly:

Developer / Administrator: Bryan Woods
Domain: teamwoods.us
Contact Email: bryanhwoods@gmail.com