The Sun Company Report Collector
Privacy policy
This policy explains how The Sun Company (Horsham) Limited operates its private Report Collector and the public information pages describing it. The contact for this tool is mark@gumpright.co.uk.
1. Purpose and users
The collector is used by the business owner to retrieve authorised Salon Tracker reports and store them in the owner’s Google Drive for business reporting. These public pages do not provide a sign-in form or allow visitors to connect a Google account.
2. Information the collector handles
- Salon Tracker reports: downloaded exports may contain sales, payments, products, service usage, registration information and, depending on the selected report, customer or staff personal information.
- Google authorisation: an OAuth refresh token, OAuth client ID and client secret are used to obtain short-lived access tokens for the authorised Google account.
- Drive files and metadata: the collector handles report contents, its completion records, file and folder identifiers, names, sizes and checksums for files available to the app.
- Salon login credentials: the owner supplies a Salon Tracker username and password so the collector can use the normal sign-in process.
- Operational records: execution times, fixed status and error codes, report dates, validation results, file identifiers and checksums may be recorded in cloud logs.
3. Google permissions and use
The collector requests https://www.googleapis.com/auth/drive.file. This permits creating new Drive files and working with files created by or otherwise made available to the app. The collector uses this permission to find or create its dedicated folder, detect existing exports, create or update report files, and verify upload metadata. It does not request broad access to all Google Drive files.
Google account access is used to deliver and check the business’s requested reports. Google user data is not sold or used for advertising. The collector does not use Google user data to train general-purpose artificial intelligence or machine-learning models. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
4. Storage and security
The collector runs in Google Cloud Run. Credentials and the refresh token are stored in Google Cloud Secret Manager with access granted to the collector’s runtime service account. Downloaded exports are processed in a temporary container directory and are removed when normal processing ends; that directory is not intended as permanent storage. Reports and completion records are retained in the owner’s Google Drive. Operational logs are held in Google Cloud Logging.
The public website contains no embedded report data or credentials. It has no account login, analytics scripts, advertising pixels or forms. These pages do not set application cookies. Firebase Hosting and Google may process technical request information, such as IP addresses, to deliver and secure the site under Google’s privacy policy.
5. Access and sharing
Google provides the cloud processing, hosting, secret storage and Drive storage services. Salon Tracker supplies the authorised source reports. The business owner and people the owner authorises may access retained reports through the business’s accounts and sharing settings. The collector does not publish reports to this website.
The owner may separately choose to provide reports to a reporting or analysis service, including ChatGPT. Such a transfer is a separate action or integration governed by the permissions and privacy terms of that service; hosting these information pages does not itself make that transfer.
Cloud services may process data in locations described in their applicable service terms and privacy information. The collector job is configured in Google Cloud’s London region; that does not imply that every associated service stores all data only in the UK.
6. Retention and deletion
Report files and completion records remain in Drive until the owner removes them under the business’s retention requirements. Operational logs follow the applicable Google Cloud Logging retention settings. Secret versions remain in Secret Manager until disabled or destroyed by the owner; disabling a version stops its use but does not erase its stored value.
To remove retained information, the owner must delete the relevant Drive files, empty the Drive bin where appropriate, and manage stored secrets and logs separately. Revoking Google authorisation does not automatically delete reports already saved.
7. Revoking access
The owner can revoke the collector’s Google authorisation in Google Account connections. Revocation prevents further authorised Drive API access once Google invalidates the applicable tokens. To stop the entire collection process, the owner should also pause any configured schedule and stop active job executions. Salon Tracker credentials and existing report copies must be managed separately.
8. Questions, requests and changes
For questions about the tool or requests concerning personal information in reports, contact mark@gumpright.co.uk. The business will review the request in light of applicable obligations and any retention requirements. This policy will be updated when the tool’s data practices change; the effective date above identifies the current version.