Hebun AI — Privacy Policy

Information Hebun may access

Hebun may access and hold:

• Google account identity. Your Google account identifier, your email address, whether Google reports that address as verified, and — for Google Workspace accounts — the domain Google reports for the account.
• Authorization credentials. The OAuth access and refresh tokens Google issues when you grant access, together with the list of scopes Google states it granted.
• Google Drive file metadata, only if you grant the Drive scope described below.
• Account and sign-in information you provide directly to Hebun, such as the email address and password credential used to sign in.

How Hebun uses information

Information is used to authenticate you, to identify which Google account a workspace has connected, to keep that connection working, and to perform the specific read you ask for. Hebun does not use this information for advertising, and does not sell it.

Google API data

Hebun requests the Google scopes openid, email and profile in order to identify the connected account.

For Google Drive, Hebun requests one scope only: https://www.googleapis.com/auth/drive.metadata.readonly. This is a read-only metadata scope. Under it Hebun can list file metadata — file identifier, file name, MIME type, last-modified time, size where Drive reports one, and whether the file is in the trash.

Hebun does not read the contents of your Drive files. Google’s own scope definition does not permit file content download under this scope. Hebun also requests no scope that would let it create, modify, share or delete anything in your Drive, and it holds no such capability.

Hebun’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Data obtained from Google APIs is not used to train generalized artificial intelligence or machine learning models, is not sold, and is not transferred to others except as described below.

Data sharing

Hebun does not sell personal information and does not share it with third parties for advertising or marketing.

Information is transmitted to Google when Hebun makes an authorized request on your behalf, and it is processed by the hosting and database infrastructure Hebun runs on for the sole purpose of operating the service. Hebun may disclose information where it is legally required to do so.

Data security

Traffic between your browser and Hebun, and between Hebun and Google, is carried over HTTPS. Stored provider credentials are encrypted at rest using AES-256-GCM authenticated encryption, and each sealed credential is cryptographically bound to the workspace and credential record it belongs to, so a credential moved to another record cannot be decrypted. Passwords are verified on the server and are not stored in a recoverable form.

No system can be guaranteed secure. This section describes the controls Hebun implements; it is not a warranty, and Hebun does not claim any security certification.

Data retention and deletion

Hebun retains your Google account identifier, email address, granted scopes and encrypted tokens for as long as the connection exists, so that the connection can continue to be used. Tokens are replaced when Google issues new ones.

Hebun does not currently operate an automated retention schedule that deletes this information after a fixed period. To have your connection data deleted, contact Hebun at the address below and it will be removed from Hebun’s records.

Your choices and revocation

You can withdraw Hebun’s access to your Google account at any time from your Google Account permissions page at myaccount.google.com/permissions. Revoking there takes effect at Google and Hebun can no longer make requests with the revoked grant.

Granting the Drive metadata scope is optional and separate from signing in. You may also ask Hebun to delete your data by contacting the address below.

Contact

Questions about this policy, or requests concerning your data, can be sent to hebuntech@gmail.com.

Changes to this policy

If this policy changes, the updated version will be published at this address with a new last-updated date. The Terms of Service apply alongside this policy.