TechCom LLC
Privacy policy
This policy describes how Techcom Field Operations Portal (portal.techcomllc.net/app_v3) collects, uses, shares, protects, retains, and deletes information, including data received from Google APIs.
Who this app is for
The portal is an internal TechCom LLC tool. It is limited to employees and contractors whose email is on TechCom’s crew directory. It is not offered to the general public.
Information we receive from Google
When you choose Sign in with Google, we request these OAuth scopes:
-
Sign-in identity
(
openid,https://www.googleapis.com/auth/userinfo.email,https://www.googleapis.com/auth/userinfo.profile) — your verified email, name, and profile so we can match your Google account to your TechCom crew record and open a portal session. -
Read-only Google Calendar events
(
https://www.googleapis.com/auth/calendar.events.readonly) — event title, times, location, description, organizer, attendees, and meeting links from your primary calendar. We use this only to show your meetings on My Work, to open a join link, and to remind you when a meeting is about to start. We do not create, edit, delete, or invite people to calendar events.
We do not request write access, calendar settings, calendar sharing controls, or Gmail, Drive, or Contacts scopes. A narrower Calendar permission such as free/busy-only cannot power these features because the portal must display event details and join information for meetings you were invited to, not only meetings you created.
We use Google user data only to provide these features to the signed-in person, in accordance with the Google API Services User Data Policy, including the Limited Use requirements.
Sharing, transfer, and disclosure of Google user data
TechCom LLC does not sell Google user data. We do not use Google user data for advertising, credit decisions, or unrelated product training. We do not share, transfer, or disclose Google user data to independent third parties (including other users, other companies, data brokers, or advertisers), except in the limited cases below.
- No transfer to other portal users. Calendar events, attendees, descriptions, and meeting links are shown only to the signed-in person who granted access. Other TechCom employees cannot open your Google Calendar through this app.
- Google. We send OAuth tokens back to Google’s authorization and Calendar APIs so Google can authenticate the request and return that user’s events. Google processes that traffic under Google’s own terms.
- TechCom operators. A small number of TechCom administrators who run this server may see stored credential metadata (for example Google account email and connection status) while operating, securing, or debugging the service. They do not use Calendar contents for any purpose other than running the portal.
- Infrastructure processors. Encrypted tokens and related records are stored on TechCom-controlled servers and database hosting used to operate the portal. Those processors are not permitted to use Google user data for their own purposes.
- Monday.com is not a recipient of Google Calendar contents. After sign-in, the portal loads TechCom work items from TechCom’s own Monday.com boards. We do not upload, copy, or forward Google Calendar event bodies, attendees, or meeting notes to Monday.com. Meeting Continuity only uses calendar identifiers (such as event id, time, title, and attendee emails) on TechCom servers to look up TechCom’s existing Monday Notetaker records for that same meeting.
- Other login methods. Optional SMS one-time-code login uses RingCentral and the phone number already on your crew record. That path does not receive or transmit Google Calendar data.
- Legal requirement. We may disclose Google user data if we are required to do so by law, regulation, or a valid legal process, or to protect TechCom, our workers, or the security of the service.
We do not transfer Google user data to any other application, AI model provider, analytics vendor, or marketing platform.
Data protection for sensitive Google user data
Google Calendar events and OAuth tokens are treated as sensitive. We protect them with the following mechanisms:
- Encryption in transit. The portal is served over HTTPS/TLS. Google OAuth and Calendar API calls also use HTTPS.
-
Encryption at rest.
The Calendar refresh token is stored encrypted with Fernet
(AES-128-CBC with HMAC) using a server-side key
(
APP_V3_TOKEN_ENCRYPTION_KEY). Access tokens are minted on demand and are not written to the database. - Least-privilege access. Each stored token is keyed to one portal user. APIs resolve identity from the portal session; a user cannot request another person’s calendar. Calendar contents are not placed in shared Monday boards.
- Short-lived session. After Google sign-in, the browser holds a TechCom-issued session token (not the Google refresh token). That session expires automatically (default 24 hours).
- Minimal live cache. Event lists are fetched live from Google and held in server memory for about 45 seconds to avoid repeat API calls. That cache is not a durable copy of your calendar.
- No write surface. The My Work event dialog does not let users invite attendees or change events, because this app is not authorized to edit Calendar.
- Operational controls. Access to production servers, environment secrets, and the database is limited to TechCom administrators. Tokens and Calendar payloads are not written to application logs.
Retention and deletion of Google user data
What we keep, and for how long
- Sign-in identity (email, name). Used to match the crew directory and issue a session. The session token is stored in the browser until it expires or you sign out. We do not keep a separate Google profile archive.
- Calendar refresh token. Kept for as long as Calendar remains connected for that user, so My Work can keep showing upcoming meetings without asking Google for consent on every visit.
- Calendar events. Not stored as a full calendar copy. They are read from Google when you open My Work (or when an upcoming-meeting reminder is checked) and discarded from memory when the short cache expires.
- Meeting Continuity metadata. If you open a recurring meeting, TechCom may keep a small local record (Google event id, title, start/end time, organizer email, and attendee emails) so the next occurrence can show prior TechCom notes and tasks. This is not a backup of your Google Calendar.
How you delete it
- Revoke Google access. Open Google Account → Third-party access, find Techcom Field Operations Portal, and remove access. Google then invalidates the grant. The next Calendar request fails, and the portal stops using that token.
- Request deletion from TechCom. Email oleksii.burachyk@techcomllc.net from your work address and ask us to delete your Google user data. We will delete the stored Calendar refresh token and Meeting Continuity records derived from your Google Calendar, and confirm when that is done. We aim to complete deletion requests within 30 days.
- When employment ends. Removing your email from TechCom’s crew directory prevents further sign-in. Remaining Google tokens and Calendar-derived records for that account are deleted as part of offboarding, or sooner on request.
Revoking access in Google stops new reads immediately. To also erase TechCom’s stored token and Meeting Continuity metadata, send the deletion request above (or we delete them at offboarding).
Other information the portal uses
After sign-in, the portal loads work items from TechCom’s own systems (including Monday.com boards used for crews, reports, and management). That operational data belongs to TechCom LLC and is visible according to each person’s job permissions. It is not Google user data.
Limited Use
TechCom LLC’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Contact
Privacy questions, sharing questions, or deletion requests for Techcom Field Operations Portal: TechCom LLC, oleksii.burachyk@techcomllc.net.