Privacy Policy

We collect the following types of Google user data when you use our add-on:

1.1 Google Forms Data

What we collect:

• Form title and description
• Question text and field types (text, multiple choice, checkboxes, dropdowns, scales, dates, grids, etc.)
• Answer options and choices
• Page breaks and form structure
• Help text and field descriptions

Why we collect it: To convert your Google Form structure into WhatsApp Flow format.

Scope used: https://www.googleapis.com/auth/forms.currentonly

1.2 User Email Address

What we collect: Your Google account email address

Why we collect it: To identify your account for API key management and service usage tracking based on your subscription tier.

Scope used: https://www.googleapis.com/auth/userinfo.email

1.3 What We DO NOT Collect

We use the collected Google user data for the following purposes ONLY:

2.1 Providing Core Functionality

• Form Conversion: We process your Google Form structure to generate equivalent WhatsApp Flow JSON format
• Preview Display: We show you a preview of your form with statistics (question count, page count) in our sidebar interface
• API Communication: We send the form data to our secure conversion API at bcdr.sa to process the conversion

2.2 Service Management

• Account Identification: We use your email address to associate your API key with your account
• Usage Tracking: We track the number of conversions you perform to enforce subscription tier limits (e.g., 10 free conversions per month)
• Customer Support: We use your email to provide technical support when you contact us

2.3 Improving Our Service

• We may analyze aggregated, anonymized usage statistics to improve the add-on's performance and features
• We do NOT use your specific form content or personal data for analytics or AI training

3.1 We DO NOT Sell Your Data

We do not and will never sell your Google user data to third parties.

3.2 Service Providers

We share data only with essential service providers who help us operate the add-on:

• Cloud Hosting: Your form data is temporarily processed on our servers hosted by certified cloud providers (e.g., AWS, Google Cloud)
• API Processing: Form structure is sent to our bcdr.sa API for conversion processing
• Payment Processing: If you subscribe to paid tiers, payment information is handled by Stripe/PayPal (we never store credit card details)

Important: These providers are contractually obligated to:

• Use data only for providing services to us
• Maintain appropriate security measures
• Not use data for their own purposes

3.3 Legal Requirements

We may disclose your information if required by law, such as:

• Responding to valid legal process (subpoenas, court orders)
• Protecting our rights, property, or safety
• Preventing fraud or security threats

3.4 No Transfer for Advertising

We implement industry-standard security measures to protect your Google user data:

4.1 Encryption

• In Transit: All data transmission uses HTTPS/TLS encryption
• At Rest: API keys are stored encrypted in Google's PropertiesService
• API Communication: All API calls to bcdr.sa use encrypted channels

4.2 Access Controls

• Form data is only accessible to you and our authorized processing systems
• Employee access is restricted on a need-to-know basis
• We use role-based access controls (RBAC)

4.3 Infrastructure Security

• SOC 2 compliant cloud infrastructure
• Regular security audits and vulnerability assessments
• Automated security monitoring and incident response

4.4 Limited Data Scope

• We only request access to the current form you're editing (forms.currentonly scope)
• We cannot access other Google Drive files, emails, or personal data

5.1 How Long We Keep Your Data

• Form Structure Data: Retained temporarily during conversion (typically less than 60 seconds), then automatically deleted
• Email Address: Retained for the duration of your account activity
• API Keys: Stored in your Google account (under your control) until you delete them
• Usage Statistics: Aggregated, anonymized data retained for 12 months for service improvement
• Converted WhatsApp Flows: Stored in your BCDR dashboard until you delete them

5.2 When Data is Deleted

Your data is automatically deleted when:

• Form conversion processing is complete (immediate deletion)
• You revoke access to the add-on in your Google account
• You delete your BCDR account
• You explicitly request data deletion
• Your account is inactive for 24 months

5.3 How to Request Data Deletion

You can request deletion of your data by:

1. Revoking Add-on Access:
   • Go to Google Account Permissions
   • Find "WhatsApp Flow Converter"
   • Click "Remove Access"
2. Contacting Support: Email support@bcdr.sa with subject "Data Deletion Request"
3. Dashboard Settings: Use the account deletion option in your BCDR dashboard at bcdr.sa/bcdr/m/settings

Timeline: Data deletion requests are processed within 30 days. Some data may be retained in backups for up to 90 days for disaster recovery purposes.

You have the following rights regarding your personal data:

6.1 Access

You can request a copy of the personal data we hold about you by contacting support@bcdr.sa

6.2 Correction

You can update your email address or account information through your BCDR dashboard

6.3 Deletion

You can request deletion of your data as described in Section 5.3 above

6.4 Revoke Permissions

You can revoke the add-on's access to your Google account at any time through Google Account Permissions

6.5 Portability

You can export your created WhatsApp Flows in JSON format from your BCDR dashboard

6.6 Objection

You can object to data processing by discontinuing use of the add-on and revoking permissions

We may update this Privacy Policy from time to time to reflect:

• Changes in our data practices
• New features or functionality
• Legal or regulatory requirements
• User feedback and best practices

How We Notify You of Changes

When we make material changes to this Privacy Policy, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to your registered email address
• Display a notice in the add-on interface for 30 days
• Require re-acceptance of the updated policy for continued use

Your continued use of the add-on after the updated policy becomes effective constitutes your acceptance of the changes.