Privacy Policy

Who operates this project

The service at impactmaker.kr is operated by impactmaker, an AI-native research lab. Privacy contact: impactmaker. Email: impactmaker.kr@gmail.com.

This is a personal, non-commercial research project. The Google Cloud application is named impactmaker. It is operated for the owner's authorized workflows, not as a public service for collecting other people's Google accounts. This website does not offer Google sign-in or request account passwords.

Website information

The website is a static information site. It has no registration or contact form, advertising, analytics script, external font, cookie storage code or local-storage code. Selecting the email link opens your email application.

Vercel provides website hosting and may process technical request data, such as IP addresses, requested URLs, access times and browser information, to deliver and secure the site. GitHub stores the site's source code. Google account contents and OAuth credentials must not be placed in this website's deployment or source repository. Email inquiries are processed through Gmail and by the operator to respond to the request.

Infrastructure providers may use operational records and their own security mechanisms under their service policies. See Vercel's privacy policy, GitHub's privacy statement and Google's privacy policy.

Google data: access and purpose

The private integration connects Google Drive files to user-approved work: finding materials, reading selected documents, organizing information and performing explicitly approved document operations. Depending on the granted permissions and requested task, data can include account identifiers, file names and IDs, file types, folder relationships and document content.

If the operator explicitly uses an already-authorized Workspace function, related data may include document or spreadsheet content, calendar information, contact information or email content needed for that task. This notice does not itself request or expand any Google permission. Access is limited by the actual Google consent grant and the user's instructions.

Google handles authentication on its own screens. The integration's access and refresh tokens are kept in the server-side client's supported encrypted credential store, not in this static website. Tokens enable authorized API access and are treated as credentials, not ordinary task content.

Operator-approved operating rules

• Use Google data only for the requested, user-facing workflow and its necessary operation.
• Request the minimum permissions required by implemented functions.
• Do not sell Google data or use it for advertising, credit decisions or the operator's generalized AI model training.
• Require specific approval for sharing content or making material changes to existing business files.
• Restrict human access to the user's authorized work and the exceptions permitted by applicable Google policy and law.

Use and transfer of information received from Google APIs must adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Processing and service providers

Authorized Google data is processed in an operator-controlled, server-side agent environment. Selected content may be sent to external AI providers only when needed for a user-approved task. The current AI workflow uses OpenAI. This website does not upload document contents to an AI provider or embed a public AI chat.

Google API data must be processed only through provider terms and configurations that exclude generalized model training. If that condition has not been established for a workflow, the associated AI transfer must not be enabled. Authorizing a task does not authorize unrelated reuse, advertising or sale of its data.

Google, the server infrastructure provider, OpenAI and other specifically selected processors may process data outside the operator's country, including in the United States or other regions used by their services. The countries and retention applying to a particular provider depend on its service and account configuration; this policy does not promise local-only processing or zero provider retention. The operator must assess applicable transfer requirements before enabling a new processing route. See OpenAI's privacy policy.

Only the content needed for the authorized task should be transmitted. A new provider, materially different purpose or broader disclosure requires a policy update and any legally required notice or consent before that use begins. Information may also be disclosed when necessary to comply with a legal obligation or investigate a security incident.

Retention and deletion

Connection credentials are retained to support the authorized connection until they are removed through the client's disconnection or credential-management procedure. Revoking access in Google blocks future authorized access but does not itself delete every stored copy in other systems.

Requested outputs, conversation history and operational records can remain in the operator-controlled workflow environment to fulfill the task and preserve its working history. The current workflow does not promise a universal automatic deletion period. The operator reviews whether those records remain necessary and handles deletion requests through the contact below. Records required by law or needed for an active security investigation may be retained for that purpose.

To stop Google access, use Google Account connections. To request deletion of copies, generated files, retained task records or connection credentials, contact the operator. Deletion is subject to applicable obligations and the actual controls of the relevant storage or processor. Backup and security copies may require separate handling; immediate erasure from every system is not promised. Files in your Google Drive are not deleted merely because the integration is disconnected.

Your choices and security

You may request information about processing, correction, deletion, restrictions or withdrawal of consent where applicable. The operator verifies identity in a proportionate way before acting and responds under applicable legal requirements. Do not send passwords, authentication codes, OAuth callback URLs or recovery codes by email or chat.

Credentials are separated from website content. Access should be restricted, requests should use secure transport, and diagnostics should omit secret values and unnecessary document contents. No security measure is an absolute guarantee against an incident. This personal project is not intended to collect children's accounts or sensitive data through the public website.

Privacy contact and updates

Operator and privacy contact: impactmaker
Email: impactmaker.kr@gmail.com.

This policy is updated when the project's actual processing materially changes. The revision date is shown above. If a new use requires separate consent, publication of an updated policy does not replace that consent.