Privacy Policy

Effective October 17, 2026

This policy explains how the Shadowlines security review service handles information. The service is currently in preview. Production availability and Google Workspace Marketplace approval have not been announced. Contact contact@apogee1.net with privacy questions or requests.

Information processed

Account and organization information includes your sign-in identity, email address, organization membership and connected-account identifiers. Google sign-in identifies you; it does not by itself authorize access to your organization's Workspace data.

When an authorized user or administrator connects a supported source, the service processes the permitted inventory, resource configuration, identities, access and sharing relationships, audit or activity evidence, and related security findings. Google Workspace sources can include directory information, Drive file metadata and permissions, and Gmail metadata. Content scanning can additionally process selected file or message content when separately authorized. Actual access depends on the enabled capabilities, granted scopes, administrator authority and available evidence.

Questions, generated answers, reports, evidence references, feedback and repair or evaluation telemetry may be stored to operate and troubleshoot AI Insights. Operational records include authentication and audit events, errors and service usage. Do not put passwords, access tokens or unrelated sensitive personal data in questions or support requests.

Purpose and Google data limits

Information is used to provide organization-scoped security reviews, explain exposures and evidence gaps, generate requested insights and reports, maintain security, and support the service. Incomplete evidence is not a guarantee that an environment is safe or compliant.

Shadowlines' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace user data policy.

Google user data is not sold, used for advertising, or used to develop, improve or train generalized AI or machine-learning models. Human access to Google user data is limited to the circumstances allowed by those policies, such as your documented permission for specific support, security investigation, or legal obligations.

Service providers and AI processing

Hosting, storage and configured AI inference providers process information needed to deliver the service. AI requests can contain your question and relevant evidence or content excerpts. AI evaluation and repair can process the answer and supporting evidence. These are data transfers, even when no model training occurs. Provider selection and processing terms must be established for your deployment before you connect sensitive sources. Contact support for the provider list and applicable terms for your organization.

Google data may be transferred only for the permitted user-facing purpose with the required consent, security, applicable legal requirements, or another circumstance expressly allowed by Google's Limited Use rules. Any sharing needed for a business transfer remains subject to those rules. This policy does not authorize unrestricted sharing or reuse across organizations.

Storage, retention and deletion

Connected-source evidence, findings, answers, reports and operational records can be stored on service infrastructure, rather than only on your device. Retention depends on the deployment and the organization's agreed policy. We do not promise a universal retention period or immediate erasure from backups. Confirm the applicable retention, backup expiry and deletion arrangements with support before onboarding regulated or sensitive production data.

To request access, correction, export or deletion of information held by the service, email contact@apogee1.net from your account. Organization administrators can make requests for their organization. We verify authority and explain the applicable handling, any legal retention obligations and backup limitations.

Control your connections

You can revoke Google's account connection in Google Account connections. Administrators may also need to remove Marketplace installation or domain-wide delegation separately in Google Admin Console. Revoking access stops future access under that grant; it does not itself delete evidence already collected. Contact support to disconnect collection and request deletion of stored data.

Security and policy changes

Access to the service is subject to account and organization authorization. No service can guarantee absolute security. Report suspected security incidents to contact@apogee1.net. Material changes to this policy will be reflected here with an updated effective date. A material change to Google data use requires the applicable disclosure and consent before that use.