Legal

Privacy Policy

This policy explains how ShuttleCloud handles personal data on its websites and through its migration technology, embedded integrations, partner import and export portals, data-download services and related support (together, the “Services”). It covers email, contacts and calendar data where the feature you select supports them.

1. Who we are and the Services covered

ShuttleCloud Corp (“ShuttleCloud,” “we,” “us” or “our”) provides the Services, including through its subsidiary ShuttleCloud Technologies S.L.U. and integrations with third-party providers. Our contact details appear in Section 15.

This policy covers shuttlecloud.com and other ShuttleCloud websites that link to it; the import service embedded in consumer Gmail; partner-branded migration and export portals, including the Yahoo Mail Data Migration Assistant and Comcast/Xfinity export service; and other supported integrations using ShuttleCloud’s migration technology or APIs. Supported account providers may include Google, Microsoft Outlook or Microsoft 365, Yahoo/AOL and other email providers.

Features vary by integration. You may be offered email or contacts migration, calendar migration, a data download, or continued import/forwarding. The feature screen identifies the source, destination, data categories and available choices. Copying or downloading data does not itself close your source account or delete its contents. ShuttleCloud does not operate or control your source or destination email provider or its mailbox service. A third-party app’s unrelated features remain governed by that app’s own notice.

When we decide how to handle information collected on our own website or for our direct business relationships, we act as a data controller. When a provider or organization engages us to process account data on its behalf, we act as its processor or service provider under its instructions. That provider’s notice explains its responsibilities. This policy describes ShuttleCloud’s practices; it does not replace Google’s, Microsoft’s, Yahoo’s or another provider’s privacy policy. The integration-specific provisions below explain differences in our handling of data. No general provision or partner notice overrides the Google protections in Section 5.

2. Information we access and process

We receive information from you, the accounts you authorize, the provider or organization offering an integration, and your interaction with our websites. Depending on the Service you use, this includes:

• Provider-account and authorization information: source and destination addresses, account identifiers, granted permissions, and OAuth access and refresh tokens. These relate to the provider accounts you connect, rather than a ShuttleCloud website login. For providers that require other credentials, we process the username, password or application password identified in the connection flow.
• Email data: message contents, attachments, sender and recipient details, subject lines, dates, headers, message identifiers and supported folder, label and message-status information.
• Contact data: names, email addresses, telephone numbers, postal addresses, organizations, notes and other supported fields contained in the contacts you select.
• Calendar data: calendar names and supported event information, including titles, descriptions, dates, times, time zones, recurrence, locations, organizers, attendees and reminders.
• Service and job information: the selected feature and data categories, source and destination, language, job identifiers, progress, item counts, timestamps, acknowledgment and completion or failure status, and download-file status.
• Website and security information: IP address, browser and device information, approximate location, referring pages, pages viewed and interactions, operational, error and security logs, and information collected through cookies or similar technologies where used. Website analytics may process online identifiers and information about visits and interactions. Section 10 explains cookies and analytics on ShuttleCloud-operated pages, technologies used by providers on their own websites, and the consumer Gmail integration’s specific limits.
• Support information: your contact details, correspondence and information you provide when asking for help.
• Business and transaction information: your name, organization, role, business email, telephone number, request details, subscription choices, and billing or transaction information where relevant to an inquiry or purchase.

Messages, attachments, contacts and events can contain personal information about other people and sensitive information. We process that content to carry out your selected service; we do not extract it to build profiles about you or other people. Please avoid sending passwords, tokens or unnecessary message content to support.

3. How we use information

We use necessary information to connect authorized accounts; carry out the selected transfer, import or forwarding; convert supported formats; preserve supported folders, labels and item attributes; prepare downloads; handle errors and necessary retries; and report progress.

We use limited account and job information for service notifications, support, fraud prevention and security. The provider or organization offering a partner integration may receive necessary account identifiers, selections, acknowledgment and job status to administer the service. Selecting a destination does not give the source provider general access to that destination’s contents.

We do not sell migration content or provider-account data, use it for advertising, or combine it with unrelated products to build marketing profiles. We do not use email, contact or calendar content processed by these migration Services, or Google user data, to develop, train or improve AI or machine-learning models.

For our own website and business relationships, we use information to answer inquiries, administer contracts and payments, maintain website operation, measure website usage and improve performance and usability. Website analytics are subject to the choices described in Section 10. Our communications concern requested information, the Services, account or job status, support, security and necessary business administration. ShuttleCloud does not send advertising or promotional campaigns.

Where we act as controller and EEA or UK law applies, we rely on contract performance or steps you request before a contract for direct services and inquiries; legitimate interests for proportionate security, administration and support; legal obligations for required records and compliance; and consent where required, including applicable optional analytics. We assess legitimate interests against your rights. Consent may be withdrawn at any time.

Where a partner is the controller, it determines the lawful basis and we follow its documented instructions. OAuth authorization permits the disclosed account access; it is not blanket consent to advertising, unrelated uses or international transfers. We do not use migration content for automated decisions about you producing legal or similarly significant effects.

4. Third Party Connections

Using our website or requesting a migration does not require a separate ShuttleCloud website account or login. You connect the source account and, for transfers to another account, authorize the destination account through the relevant provider connection. You may already be signed in to that provider. Google, Comcast and supported Yahoo, Microsoft and other connections use OAuth: you approve access through the provider’s authorization process, and we receive tokens for the granted permissions rather than the provider password. Connections using IMAP or another supported protocol may use OAuth or require a username and password or application password, depending on the provider. The connection screen explains the method used.

Before access begins, the integration explains the feature, data, destination and relevant sharing and requests affirmative authorization. We request only permissions needed for the implemented functionality. You may decline a permission, although its dependent feature may then be unavailable. Where an organization legitimately authorizes a managed-account migration, access is limited to its authorized accounts, permissions and instructions.

You can stop access by revoking the connection in the provider’s account settings, using available integration controls, or contacting us. Revocation can interrupt an unfinished job; it does not automatically remove data already copied into another account or downloaded. Contact us separately to request deletion of information we retain.

Microsoft Outlook and Microsoft 365. We use authorized access only for the selected email, contact or calendar migration and related support. The consent screen identifies the requested permissions, including continued access where needed to finish a job. Permissions may allow broader read/write actions, but our use is limited to the selected function. Personal-account users can revoke access in Microsoft Account Consent Management. Work or school users can use Microsoft My Apps or ask their administrator where consent is organization-managed.

Yahoo/AOL and other providers. We read selected source data and write supported items to the chosen destination as authorized. You can manage connections in the provider’s account-security settings; where an application password is used, you can revoke it there. Partner-portal choices, such as remaining with a provider or choosing a download, are separate from granting access to a destination account.

5. Google OAuth scopes and Google user data

Google as a destination or source

When Google is your destination, we copy selected source email into Gmail, contacts into Google Contacts, and calendar data into Google Calendar where the integration supports those features. For imports from a non-Google provider into Gmail, we add the selected messages without reading the contents of messages already in the destination Gmail inbox. We process destination account and organizational information needed to place the imported data.

When a supported integration uses Google as the source, we access only the source content and associated data needed for its disclosed, authorized and Google-permitted feature. For example, consumer Gmail’s Gmail-to-Gmail import reads selected messages, attachments and message/label information in the source Gmail account to copy them into the destination. Yahoo and Comcast export portals use Google as a destination, not as a source for downloads. A transfer or download involving only non-Google accounts does not require Google account authorization. Hosting on Google Cloud is separate from access to a user’s Google account.

What the permissions are used for

• Account identification: confirm the selected Google account using necessary account identifiers and email-address information.
• Gmail: import messages and attachments, preserve supported attributes and create or use labels representing source folders; or read selected source Gmail data where the supported feature requires it, as described above.
• Google Contacts: import supported contact fields and process returned identifiers. Where contacts are being read from a Google source through a supported feature, access is limited to the selected transfer.
• Google Calendar: create or use the selected destination calendar and add supported events. Relevant data includes calendar identifiers, names, time zones, permissions and imported event fields. Source calendar access is requested only if the integration actually offers and explains that feature.

Google calls these permissions “OAuth scopes.” Consumer Gmail’s Settings → Accounts and Import → Import mail and contacts integration requests full Gmail access (https://mail.google.com/), which can permit reading, composing, sending and permanently deleting email. We use it only for the selected import and continued forwarding if selected. Other integrations request the scopes needed for their implemented features; full Gmail access is not represented as the minimum scope for every import.

Contacts and Calendar permissions may allow reading, editing or deleting data even when we use them only to import selected items. Google’s consent screen displays the actual access requested. We use only the access needed for the selected feature and do not use broader permission for unrelated reading, sending or deletion. Imported events follow the destination calendar’s visibility and sharing settings; any supported action that changes sharing or notifies attendees is explained before you choose it.

The consumer Gmail integration imports mail and contacts; calendar migration and downloadable archives are separate features available only in integrations that offer them. A permission described in this policy does not by itself authorize a new feature or access to additional data.

Limited Use, sharing and human access

We comply with the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring Google user data. We also follow the Google Workspace API User Data and Developer Policy where applicable. These restrictions apply to information received through sensitive or restricted Google scopes and data derived from it. Google user data is used only for the authorized user-facing migration or import feature and its permitted support and security functions. It is not used or transferred for advertising, retargeting, data brokerage, sale, creditworthiness or lending decisions, or the development, training or improvement of generalized or non-personalized AI or machine-learning models.

Transfers of Google user data are limited to what is necessary for the user-facing service with your consent, security purposes, legal requirements, or a business transfer after your explicit prior consent. Service providers must follow the same restrictions.

We do not routinely read Google user data. Human access is limited to your documented affirmative agreement to inspect specific data for assistance; necessary security investigations; legal requirements; or lawful internal operations on aggregated and anonymized data. These restrictions bind employees, contractors, affiliates, service providers and successors, and apply to derived data. They prevail over any broader general wording elsewhere in this policy.

Revoking Google access

You can review or revoke access through Google Account Connections where the connection appears. For the consumer Gmail import, use Gmail’s Accounts and Import controls to stop an import or continued forwarding, or contact dpo@shuttlecloud.com. To request deletion of information held by ShuttleCloud, identify the relevant account and job if available. Revocation and deletion are separate actions; you manage copies already held in Gmail, Google Contacts or Google Calendar through those services.

6. Downloading data

Where a partner export portal offers downloads, we access the selected source data and prepare the format shown in that portal. Formats may include email archives such as EML, MBOX or PST, contacts files such as CSV or vCard, and supported calendar files. Available formats differ by provider. Preparation may require temporary storage of source content and generated archives; this differs from the consumer Gmail integration described in Section 9.

Download files use protected delivery and a limited availability period shown in the download screen or notification. Temporary content and files are deleted when that period ends or earlier when no longer needed for delivery. You can request earlier deletion through the contact details below. If the link expires, you may need to initiate another supported download.

Keep download links and archives confidential. After downloading, you control their storage and sharing. Deleting ShuttleCloud’s copy does not delete copies on your devices or elsewhere.

Yahoo and Comcast downloads do not access Google account data. The Services do not offer a standalone, one-time Gmail archive download through Google scopes.

7. Who receives information

We disclose only the information needed for the purposes described here:

• Your selected destination receives the content and information needed for the authorized transfer. Downloads are delivered to you. Source and destination providers operate under their own privacy notices.
• The partner or organization offering an integration receives necessary account, selection and job-status information to administer that integration. Where it acts as controller, we follow its instructions and applicable contractual restrictions.
• Our affiliates, including ShuttleCloud Technologies S.L.U., provide service delivery or support only where authorized for the relevant integration.
• Depending on the integration, Google Cloud Platform provides processing infrastructure, temporary storage where required and operational records. Google Workspace supports business communications that may include information supplied in a service exchange.
• Where used, SendGrid delivers service notifications using recipient addresses and necessary status information.
• Where used, Help Scout manages support requests and Slack supports internal issue coordination with necessary ticket information. These tools are not repositories for mailbox contents or download archives. Any access to specific Google data remains subject to Section 5.

Google receives website usage information through Google Analytics. Other analytics providers, where used, receive the measurement information needed for the purposes in Section 10.

Service providers act under confidentiality, security and purpose restrictions. Not every provider is used for every integration; partners may require different approved providers and processing locations. Contact us for the service-specific list. Website service providers process only the information needed for the website functions described here. We do not provide personal information to service providers for advertising.

We may disclose information for legal requirements or necessary security and abuse investigations, and to professional advisers where lawful and necessary. Personal information may transfer in a merger, acquisition or asset sale subject to applicable law and continuing protections. Google user data can transfer in such a transaction only after your explicit prior consent; notice or an opt-out alone is insufficient.

8. Security of data

We protect personal data through encryption in transit and at rest where stored, restricted access based on job responsibilities, protection of authentication secrets, operational monitoring, vulnerability management and incident-response procedures. These controls apply to temporary download files and retained credentials as well as other personal data.

ShuttleCloud is ISO 27001 certified and undergoes independent third-party security assessments, including assessments required for its Google integrations. Certification and audits do not mean that every risk can be eliminated. Further information is available on ShuttleCloud’s Security page. Report suspected security issues to security@shuttlecloud.com.

9. Retention and deletion

Retention depends on the Service and data category. The following consumer Gmail rules apply specifically to the import available through Gmail’s Settings → Accounts and Import → Import mail and contacts:

Consumer Gmail content. ShuttleCloud never stores email-message or contact content for this integration. We process it to transfer it into Gmail; we do not retain mailbox copies or generate downloadable archives for this feature.

Consumer Gmail credentials and tokens. Source credentials, OAuth access tokens and OAuth refresh tokens are deleted immediately when the import finishes. If you select continued forwarding, the credentials and tokens required for it are retained for 45 days from the start of the import and then deleted. Logs and support records for this integration do not contain stored email-message or contact content.

For other integrations, download portals and website information, we apply the following category-specific criteria. Any additional retention or download-expiry period is disclosed by the relevant feature; the consumer Gmail 45-day forwarding period does not automatically apply elsewhere.

• Other integrations’ credentials and tokens: kept only while needed for the authorized job and necessary retries, or an ongoing feature expressly selected by you. They are deleted when the job or feature ends or access is no longer needed. We do not keep them for unrelated future migrations.
• Other migration content: processed for the selected transfer, with any necessary temporary working copies removed when no longer needed. We do not maintain an ongoing mailbox, contact or calendar archive after a completed migration.
• Download content and archives: retained for preparation and the availability period communicated with the download, then deleted as described in Section 6.
• Account identifiers, job records and logs: retained only for necessary completion records, troubleshooting, security and legal obligations. Limited records may include folder names and message identifiers. Their retention does not authorize storing message contents. We delete or anonymize records when their purposes end.
• Support records: retained as needed to resolve and document a request and meet legal requirements, then deleted or anonymized. Information supplied for troubleshooting is not repurposed.
• Website, business and billing information: retained while needed for the inquiry, service or business relationship, transaction or legal recordkeeping, then deleted or anonymized. Website analytics data are retained only as needed for the measurement purposes described in Section 10, according to the applicable retention settings. Where used, cookies and other browser storage have their own lifetimes; deleting or expiring them does not itself delete information already held by an analytics provider. Source and destination providers determine retention for information they process on their own websites under their respective notices.

After a deletion request or termination of access, we delete information no longer required and instruct relevant providers accordingly. For Microsoft integrations, ending use or closing the connected service triggers deletion of Microsoft data retained for it, subject to legally required records. Any necessary legal retention is limited and access-restricted. Residual backup copies, if any, remain protected and expire through the applicable backup lifecycle; this does not create a content-storage exception for the consumer Gmail integration.

Deletion by ShuttleCloud does not delete source-account data, imported destination items or files already downloaded. Anonymization is not permission to reuse Google data for prohibited purposes or train generalized models. Contact dpo@shuttlecloud.com to request deletion or ask about the retention criteria for your integration.

10. Cookies and website analytics

Our website and migration flow do not require a separate ShuttleCloud account or login, and we do not use chat widgets or embedded videos. Cookies set by an email provider on its own website are governed by that provider’s notices. Analytics deployed on ShuttleCloud-operated pages are addressed separately below.

Cookies and similar technologies. ShuttleCloud and its service providers may use cookies, tags, scripts and similar technologies on our websites and export portals, depending on the site and tools in use. These may support service operation, remember preferences, protect security, or measure and improve website usage. This includes technologies used by Google Analytics and other analytics services where enabled. Cookies store small amounts of information on a device and may include an online identifier; other technologies may collect usage information described in Section 2. We do not use these technologies for advertising, remarketing or identifying visitors for marketing. The consumer Gmail integration’s specific limits below continue to apply.

Website and portal analytics. We use Google Analytics, and may use other analytics services, to understand how visitors use our websites and export portals where those tools are enabled, measure traffic and performance, and improve usability. Depending on the tool and settings, these services may process pages viewed, referring pages, interactions, visit times, browser and device information, approximate location and online identifiers. Google and any other analytics providers receive this measurement information to provide their services. Google explains its processing in How Google uses information from sites or apps that use its services.

Limits on analytics. Website analytics are used for service measurement and improvement, not advertising, retargeting or marketing profiles. We do not send source or destination account email addresses, passwords, application passwords, OAuth tokens, email contents, attachments, contacts, calendar contents or other data obtained through Google APIs to website analytics services. The same limits apply to any additional analytics provider. Our analytics do not give us access to the contents of a provider account beyond the migration permissions separately authorized by the user.

Analytics and other optional technologies. Google Analytics and any other optional analytics used by ShuttleCloud are outside the consumer Gmail integration. Technologies requiring consent are disabled until you agree. Where an applicable legal exception permits use without consent, we meet its conditions, including information and opt-out requirements where applicable. We explain the purposes before requesting consent, offer a way to refuse, and make withdrawing consent as easy as giving it. Simply visiting a page, continuing to browse or authorizing an account migration is not consent to optional tracking.

Consumer Gmail integration. ShuttleCloud uses no advertising cookies or its own analytics tools in this integration. Google operates Gmail and may use its own technologies under Google’s Privacy Policy and Cookie Policy. We do not give Google API data to advertising or marketing systems.

No advertising. ShuttleCloud does not send advertising, use advertising or retargeting cookies, or identify website visitors for marketing. We do not disclose personal information to advertising or visitor-identification services for those purposes.

Provider websites and third-party tools. Source and destination email providers operate independently of ShuttleCloud. Google, Yahoo, Microsoft and other providers may use cookies and similar technologies on their own sign-in, authorization and account pages, including where you are already signed in. Their own notices and controls govern those activities. Analytics tools deployed on a ShuttleCloud-operated page are part of our website processing under this policy, even where a third party supplies the tool. ShuttleCloud remains responsible for its own website practices and the information it processes for the migration. We do not provide migration content or Google user data for providers’ advertising purposes.

Your choices. You can use your browser settings to refuse or delete cookies or to receive an alert when a cookie is set. Blocking a technology needed for a particular function may affect that function. For optional analytics on ShuttleCloud-operated pages, use the privacy or cookie choices offered for those services; you may refuse or withdraw consent without losing access to migration functions that do not require that analytics. Google also offers the Google Analytics opt-out browser add-on for supported browsers; it does not control other analytics services. Cookies on a provider’s own website are also subject to that provider’s controls. For questions about these technologies or your choices, contact dpo@shuttlecloud.com. Migration content, account information, authentication secrets and Google-derived data are never used for advertising.

11. Processing locations and international transfers

Processing locations depend on the integration. The consumer Gmail import runs on Google Cloud Platform infrastructure in the United States. The Yahoo export project is delivered from Spain by ShuttleCloud Technologies S.L.U.; its hosting, support access and providers must follow that project’s approved arrangements. Other integrations use their applicable approved locations. The Gmail US-hosting statement does not mean that every partner project is hosted in the United States.

Where a transfer from the EEA, UK or Switzerland requires safeguards, we use the applicable lawful mechanism, such as an adequacy decision or appropriate Standard Contractual Clauses, with the relevant UK or Swiss provisions where required. We follow agreed data-location restrictions. The relevant service notice identifies applicable processing countries and transfer arrangements where required. Contact dpo@shuttlecloud.com for the locations, safeguards and a copy of the relevant contractual protections, subject to appropriate redactions. Your source or destination provider’s processing is also governed by its own notice.

12. Privacy rights and regional disclosures

The rights below depend on the law that applies and whether ShuttleCloud acts as controller or as a processor for your provider or organization. These regional provisions supplement the rest of this policy and do not reduce any protections for Google user data.

You can submit a privacy request to dpo@shuttlecloud.com or by post to the address in Section 15. Identify the Service or integration involved and the action you request. You do not need to create an account to make a request. We verify identity only to the extent reasonably needed, using information appropriate to the request; we will not ask you to send an account password. An authorized agent may act with evidence of authority and any verification required by law. If your provider or organization is responsible, we will assist or route the request to it. We explain any refusal or legal exception.

You can decline optional data collection or contact us about your communication preferences. If information is necessary to connect an account or perform a requested job, declining it may make that feature unavailable. Essential service and security notices may be needed to provide the requested Service. We do not discriminate for exercising applicable privacy rights.

European Economic Area and United Kingdom

Where the EU GDPR or UK GDPR applies, you can request confirmation of processing and access to your data; correction of inaccuracies; erasure where applicable; restriction of processing; and a portable, machine-readable copy of eligible data, including transmission to another controller where technically feasible. You can object to processing based on legitimate interests because of your particular situation. You may withdraw consent at any time without affecting earlier lawful processing. These rights have conditions and exceptions under the applicable law.

Section 3 explains our purposes and legal bases, Section 9 explains retention, and Section 11 explains international transfers. You may request information about the safeguards for your transfer and a copy of the relevant contractual safeguards, with appropriate redactions. We do not make solely automated decisions about you that produce legal or similarly significant effects as part of these migration Services.

We normally respond to GDPR requests without undue delay and within one month. If the applicable law permits extra time because of complexity or the number of requests, we may extend by up to two further months and will explain the extension within the initial period. Requests are generally free; any legally permitted fee or refusal will be explained. You may complain directly to the supervisory authority in your EEA country of habitual residence or work, or where an alleged infringement occurred. The European Data Protection Board’s authority directory provides contact details. UK residents may complain to the Information Commissioner’s Office. You do not need to contact us before using these complaint rights.

Switzerland

Where Swiss data-protection law applies, you may request information and access, correction, deletion or restriction, object to unlawful processing, and obtain eligible data in a portable form, subject to legal conditions. Access requests are generally answered free of charge within 30 days; we explain any permitted delay or restriction. You may raise concerns with the Federal Data Protection and Information Commissioner (FDPIC) and pursue available legal remedies. Section 11 explains international processing; you may request the relevant destination countries and safeguards.

California residents — CCPA/CPRA

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, you have rights to know and access the categories and specific pieces of personal information collected about you, obtain a portable copy, correct inaccuracies, and request deletion subject to legal exceptions. You also have applicable rights to opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal treatment when exercising your rights.

Categories and business disclosures. The categories below describe the personal information collected or disclosed for business purposes during the preceding 12 months, as applicable to the Services used. Not every category applies to every user. Section 2 gives further examples; Sections 3, 7 and 9 explain purposes, recipients and retention criteria.

• Identifiers and customer-record information, such as names, email and postal addresses, telephone numbers and account identifiers: received from you, authorized accounts or the partner offering the Service; used for account connections, service delivery, support and business administration; disclosed as needed to the selected destination, the relevant partner and contracted service providers.
• Commercial and business-contact information, such as purchased services, transaction details, organization and job role: received from you or your organization; used for the business relationship, billing and support; disclosed as needed to providers supporting those functions and professional advisers.
• Internet or electronic-network activity, such as IP address, browser information, website interactions, analytics identifiers and job logs: generated through use of the Services; used for operation, website usage measurement, troubleshooting and security; disclosed as needed to infrastructure, analytics, security and support providers, including Google Analytics for website measurement under Section 10, with relevant job-status information supplied to the partner offering the integration.
• Electronic content and sensitive personal information, including selected messages, attachments, contacts, calendar data, private communications and account-access credentials: received through the accounts you authorize or information you supply for support; processed for the selected transfer or download, security and permitted assistance; disclosed only to the selected destination or you, and authorized processors or personnel as described in Sections 5–8. Content may incidentally contain other statutory categories of personal information; we do not extract those details for unrelated profiling.

No sale, advertising sharing or profiling. ShuttleCloud does not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. These restrictions apply whether or not you send a Global Privacy Control or other opt-out preference signal. We do not knowingly sell or share children’s personal information. We do not use sensitive migration information to infer characteristics about you; it is limited to the requested service and permitted support, security and legal functions, subject to provider restrictions.

Use the email or postal request methods above. For requests to know, delete or correct that we handle as a covered business, we acknowledge receipt within 10 business days and normally provide a substantive response within 45 calendar days. Where permitted, we may extend by a further 45 days and notify you of the reason. Applicable opt-out or sensitive-information limitation requests are handled within the required period, generally no later than 15 business days. Verification and authorized-agent rules apply as required; we do not require account creation.

When we act only as a service provider or contractor, we assist the responsible business with your request and do not use the information for our own unrelated purposes. We do not deny services, charge discriminatory prices or otherwise retaliate for exercising rights. If you have a complaint, you may contact the California Privacy Protection Agency or California Attorney General.

Other U.S. states and jurisdictions

Where another applicable privacy law grants rights, you may request confirmation of processing, access, correction, deletion or portability, and exercise applicable rights concerning sensitive data, sale, targeted advertising or profiling with legal or similarly significant effects. We do not sell personal data, use it for targeted advertising or conduct that type of profiling through these migration Services.

If we deny a request and your state provides an appeal right, email dpo@shuttlecloud.com with the subject “Privacy Appeal,” identify the original request and explain why you seek review. We respond within the applicable legal period and explain the outcome. Where required, an unsuccessful appeal response identifies how to contact the relevant attorney general or other authority. Individuals elsewhere can use the same contact methods to exercise rights provided by their local law.

13. Eligibility and information about children

The Services are intended for eligible account holders and authorized organizations under the relevant provider’s rules. They are not directed to children under 13. Where a higher age or parental authorization is required by applicable law or provider rules, that requirement applies. If you believe a child provided information without necessary authorization, contact us so we can work with the relevant provider to investigate and address it.

14. Changes to this policy

We will publish updates here with an effective date and communicate material changes through an appropriate service notice. Before accessing new Google data or using it in a way or for a purpose not previously disclosed, we will update the policy and in-product explanation, notify you and obtain affirmative consent. We will not begin the new access or use before that consent, and it must remain permitted by Google’s rules. We also obtain additional provider or user authorization where other integrations require it. Updating this policy alone does not expand an existing authorization.

15. Contact us

Privacy and deletion requests: dpo@shuttlecloud.com
Service support: support@shuttlecloud.com
Security reports: security@shuttlecloud.com
ShuttleCloud Corp
2093 Philadelphia Pike, Unit 8692
Claymont, DE 19703, United States
Subsidiary: ShuttleCloud Technologies S.L.U., Spain.