ShuttleCloud Corp (“ShuttleCloud,” “we,” “us” or “our”) provides the import service integrated into consumer Gmail through its partnership with Google (the “Service”). You access it in Gmail under Settings → Accounts and Import → Import mail and contacts. This policy explains how ShuttleCloud handles personal information when you use that feature to import email and contacts from another email account, including another Gmail account, into your consumer Gmail account, including continued email forwarding if you select that option.

It covers information processed for the migration, information received through Google authorization, and information collected through the Service’s website and support channels. It does not replace Google’s privacy policy or the policies of your source email provider.

Migration information. We process the source and destination email addresses, email messages and attachments, message headers, timestamps, read/unread status, and folder or label information needed to perform your selected migration. If you select contacts migration, we also process the contact fields supported by that feature, such as names, email addresses and telephone numbers.

Google account and authorization information. We process the Google account information needed to identify the Gmail accounts you select for the import, together with OAuth access tokens and, where issued, refresh tokens needed to carry out the authorized migration. For Gmail-to-Gmail imports, we access and process existing messages, attachments and associated message and label information in the source Gmail account as needed to copy the data you select into the destination account. When importing from another provider into Gmail, we add the imported messages without reading messages already in the destination Gmail inbox. We process account and organizational information needed to deliver and organize the imported data.

Source-account credentials. Depending on your source provider, you may authorize access through that provider or supply credentials needed to connect to the source account. Google OAuth authorization does not require you to give ShuttleCloud your Google password.

Service and support information. We may process migration status, message counts, error reports, IP addresses, browser and device information, and information you provide when contacting support. Email content and credentials are treated as migration information, not as ordinary website analytics data.

The Service uses OAuth authorization and requests full Gmail access (https://mail.google.com/). This permission permits reading, composing, sending and permanently deleting email. We use the authorized access to import the email you select into your consumer Gmail account and organize it as supported by the import feature. When you select continued email forwarding, we also use the access needed to carry out that feature. The breadth of the permission does not authorize us to use your information for unrelated purposes.

We use only the access needed for the import features you select. Importing contacts requires authorization for the relevant Google Contacts access. We explain the access requested in the import flow and access account data only after your affirmative authorization.

You can decline access or withdraw it later. Without the permissions needed for a selected feature, that feature may not work or an ongoing migration may stop.

We use information to authenticate the selected accounts; carry out and organize the migration; preserve supported message and folder attributes; report progress and completion; diagnose failures; provide requested support; protect the Service; and meet applicable legal obligations.

Google user data is used only for the authorized migration and permitted supporting activities. We do not use it for unrelated profiling, advertising, credit assessment, lending, or marketing other products. Any separately collected website or business-contact information used for communications is handled separately from Google user data.

ShuttleCloud’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

We do not sell Google user data, disclose it to data brokers or information resellers, or use it to serve advertising, including personalized advertising or retargeting. We do not use or transfer Google user data to develop, train or improve generalized or non-personalized artificial intelligence or machine-learning models.

We permit human access to Google user data only where Google’s rules allow it: with your documented affirmative agreement to access specific data for support; when necessary for security investigations or legal compliance; or for internal operations using aggregated and anonymized data as permitted by applicable law. Access is limited to authorized personnel with a need to perform that permitted activity.

These restrictions apply to Google-derived data and to employees, contractors and service providers handling it. If another provision of this policy could be read more broadly, this section governs our handling of Google user data.

The Service transfers the information you select from your source account to your chosen Gmail account. Google and the source provider handle information under their own applicable terms and privacy policies.

We may use service providers for hosting, infrastructure, security and support. They may process information only as needed to provide those services on our behalf, subject to appropriate confidentiality, security and use restrictions. Transfers of Google user data to provide or improve permitted user-facing features require your consent and must comply with Google’s Limited Use requirements.

We may disclose information where necessary to comply with applicable law or to investigate and address security incidents or abuse. Google user data will not be transferred in connection with a merger, acquisition or sale of assets without your explicit prior consent. A notice or opportunity to opt out alone does not constitute that consent.

You may request the current list of service providers and information about their roles by contacting dpo@shuttlecloud.com.

We protect information in transit using encryption and encrypt stored credentials and OAuth tokens at rest. Access controls limit access to authorized personnel. ShuttleCloud is ISO 27001 certified and undergoes annual third-party security audits as part of Google’s verification requirements.

No system can guarantee absolute security. Our security information is available at https://www.shuttlecloud.com/security.

ShuttleCloud never stores your email messages or contact content. We process that content to transfer it from your source account into Gmail; we do not retain mailbox copies or create downloadable archives as part of this Service.

Source-account credentials, OAuth access tokens and OAuth refresh tokens are deleted immediately when the import is complete. If you select continued email forwarding, the credentials, access tokens and refresh tokens needed for that feature are retained for 45 days from the start of the import and then deleted. Operational logs and support records, which do not contain stored email messages or contact content, are retained only as necessary for troubleshooting, security, support and applicable legal obligations.

You may request deletion of information held by ShuttleCloud by contacting dpo@shuttlecloud.com. We may need to verify your identity. We delete information no longer required for the Service, subject to applicable legal obligations, and explain any information that must be retained. The credentials deletion schedule above applies to the credentials retained for the import or forwarding feature.

Deleting information from ShuttleCloud does not delete email or contacts already copied into Gmail or held by your source provider. You control those copies through the relevant provider.

To stop an import or continued forwarding, use the controls available for the import in Gmail’s Accounts and Import settings, or contact dpo@shuttlecloud.com for assistance. Where ShuttleCloud appears in your Google Account’s third-party connections settings, you can also remove the authorization there. Revoking access may stop an unfinished import or forwarding.

Disconnecting Google access does not itself remove information already processed or retained by ShuttleCloud. Contact us separately if you also want that information deleted.

ShuttleCloud does not use advertising cookies or its own analytics tools in this consumer Gmail integration.

Google operates Gmail and may use its own cookies or similar technologies under Google’s privacy and cookie policies. Those practices are separate from ShuttleCloud’s processing under this policy. We do not use or disclose Google user data obtained through this integration for advertising or remarketing. For information about Google’s practices and your choices, see https://policies.google.com/privacy and https://policies.google.com/technologies/cookies.

The Service runs on Google Cloud Platform infrastructure in the United States, where information is processed for the import. This may involve transferring personal information from your country to the United States. Where applicable data-protection law requires safeguards for international transfers, we use an appropriate lawful transfer mechanism, such as an adequacy decision or applicable standard contractual clauses. You can contact dpo@shuttlecloud.com for information about the safeguards relevant to your data.

Depending on applicable law and our role in processing your information, you may have rights to request access, correction, deletion, restriction or portability of your personal information, and to object to certain processing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may also complain to the relevant data-protection authority.

We process information as necessary to provide the Service you request, to pursue legitimate interests such as security and support where permitted, to meet legal obligations, or on the basis of consent where required. Where we process information on behalf of another organization, we act under its applicable instructions and may refer a request to that organization. Contact us to exercise your rights or clarify our role.

For individuals in the European Economic Area, we rely on performance of a contract for the requested Service where applicable, legitimate interests for proportionate security and support activities, legal obligations for required compliance, and consent where required. We assess legitimate interests against your rights and freedoms. Where consent is the basis, you can withdraw it at any time. Contact dpo@shuttlecloud.com to exercise these rights or request information about transfer safeguards.

Where the California Consumer Privacy Act, as amended, applies to our processing, California residents may request access to the categories and specific pieces of personal information collected, the sources, purposes and categories of recipients; request deletion or correction; and exercise applicable rights to opt out of sale or sharing and limit certain uses or disclosures of sensitive personal information. We do not discriminate against individuals for exercising these rights.

The categories described in section 2 include identifiers and contact information, internet or electronic-network activity, and email and contact content. Account-access credentials and private communications may constitute sensitive personal information. Sources include you, the accounts you authorize and your interaction with the Service. Purposes, recipient categories and retention criteria are described in sections 4, 6 and 8.

We do not sell personal information. We do not sell or share Google user data for cross-context behavioral advertising, and do not use it to infer characteristics about you. We use sensitive migration information only to provide the requested Service and for other purposes permitted by applicable law and Google’s policies.

Send requests to dpo@shuttlecloud.com. We may verify your identity using information appropriate to the request. An authorized agent may submit a request with evidence of authority, and additional verification may be required. We respond within applicable statutory time limits and explain any lawful exception. Where we act solely as a service provider for another organization, we assist that organization in responding as required.

The Service is not directed to children under 13. If you believe a child has provided personal information to us without appropriate authorization, contact us so we can investigate and take appropriate action.

Links to third-party services are governed by those services’ own privacy policies. This policy describes ShuttleCloud’s practices.

We may update this policy to reflect changes to the Service, our practices or applicable requirements. We will publish the updated policy and effective date at this location. Before accessing a type of Google user data not previously disclosed, or using Google user data in a new way or for a different purpose than originally disclosed, we will update this policy and the relevant in-product disclosures, notify you and obtain your affirmative consent to the changes. We will not begin that access or use before obtaining your consent. Any new access or use must also comply with Google’s applicable data-use restrictions. We will keep our Google OAuth disclosures consistent with this policy.

For privacy questions or to exercise your rights, contact our data-protection team at dpo@shuttlecloud.com.

ShuttleCloud Corp
2093 Philadelphia Pike, Unit 8692, Claymont, DE 19703, United States