Application privacy

Scope and operator

This notice describes the private ZAOS Backup and Uci integrations operated by ZATARA Global Consultancy. It covers their Google account connections and related operational data. It is not a general privacy notice for every ZATARA service.

Information accessed and its purpose

• Google Calendar: Uci requests calendar.readonly and calendar.events permissions. It reads event titles, dates, times, descriptions, locations, attendees and meeting links to check availability and answer scheduling requests. It can create, update and cancel events, including sending Google Calendar invitations or cancellation notices when applicable.
• Google Drive: ZAOS Backup uses drive.file access to create and manage application backup files. Operational archives are encrypted before upload. This permission does not grant access to all pre-existing Drive files.
• Authorisation credentials: OAuth access and refresh tokens are stored on the operational server to maintain the authorised connections. Tokens are not published in source repositories.
• Assistant context: Uci processes WhatsApp identifiers, relevant contact information, messages and scheduling records to interpret requests, maintain conversation context and apply owner/contact permissions.

Processing and sharing

Relevant messages, conversation context and Calendar tool results may be sent to Google's Gemini API to interpret requests and produce replies. Replies are delivered through WhatsApp; scheduling details may also be shared with intended meeting participants through Calendar invitations and assistant replies. Contact permissions limit which assistant actions a correspondent can request.

The application and operational data are hosted on an OVHcloud VPS. Encrypted offsite backup archives are stored in the operator's authorised Google Drive. Authorised administrators can access operational data when needed to maintain or troubleshoot these services. Google and WhatsApp also process information under their own applicable service terms and policies.

ZATARA does not sell Google user data or use it for advertising. ZATARA does not use Google user data to train its own general-purpose AI models. Processing by external providers remains subject to the provider's applicable terms and account configuration.

Storage, security and retention

Access to the server and private application state is restricted. OAuth credentials are kept outside tracked source code, and offsite archives are encrypted. These measures reduce risk but do not guarantee that a security incident cannot occur.

Conversation history, scheduling records and connection state remain in operational storage until removed by the operator. Uci's local backup archives are retained for approximately 14 days. Offsite archives are retained independently until the operator removes them; deleting live data does not immediately remove existing backups.

Control, revocation and deletion requests

The Google account holder can review or revoke the integration at Google Account connections. Revoking access prevents further authorised API access but does not automatically erase existing local records or backup archives.

To request access information, correction or removal of related operational records and backups, contact office@zatara.id. Please identify the integration and account concerned without sending passwords or tokens. We may need to verify the requester's authority before acting, and will explain any operational or retention constraints.

Changes and contact

This notice will be updated when the described data practices change. Questions about these integrations can be sent to ZATARA Global Consultancy at office@zatara.id.