Privacy Policy for DriveHub

1. Information We Collect

1.1 Google Account Data

When you connect your Google account to DriveHub, we collect the following:

• OAuth Access Token - short-lived credential (1-hour expiry) used to make Google Drive API requests on your behalf.
• OAuth Refresh Token - long-lived credential used to obtain new access tokens automatically. Stored encrypted in your WordPress database.
• Google Account Email Address - collected to identify which Google account is connected. Displayed in DriveHub plugin settings.
• Google Drive File Metadata - file names, IDs, MIME types, and thumbnail URLs retrieved on demand to display file listings. Not permanently stored on your server.
• Google Drive File Content - retrieved or streamed on demand when a configured feature previews, embeds, downloads, or uploads a file. DriveHub does not permanently copy this content to your WordPress server.

1.2 Google Drive OAuth Permission

DriveHub requests the limited https://www.googleapis.com/auth/drive.file OAuth scope. This permission allows DriveHub to see, edit, create, and delete only the specific Google Drive files and folders that the user creates, selects, opens, or otherwise uses with DriveHub.

DriveHub does not request the restricted https://www.googleapis.com/auth/drive scope and does not request unrestricted access to every file in the connected Google Drive account.

DriveHub does not access Gmail, Google Calendar, Google Contacts, or any other Google service.

1.3 DriveHub OAuth Connection Service

When Automatic Connection mode is used, DriveHub connects to https://sovlix.com/drivehub-oauth.php, an OAuth connection service operated by Sovlix.

This service provides the shared Google OAuth client ID and processes OAuth token refresh requests required to maintain the Google Drive connection.

• Client ID lookup: DriveHub sends only the client ID request action. No Google Drive files, file contents, OAuth tokens, or Google account information are included in this request.
• Token refresh: When a new access token is required, DriveHub sends the Google OAuth refresh token and the connected WordPress website URL to the Sovlix OAuth service. This occurs only while maintaining a Google Drive connection authorized by the user.

Google Drive files and file contents are not sent to the Sovlix OAuth service during client ID lookup or token refresh.

The OAuth service processes credentials only to complete the requested OAuth operation.

Users who prefer not to use the Sovlix OAuth service may use Manual Connection mode with their own Google Cloud OAuth credentials, where this option is available.

2. Purpose of Data Collection

Google user data collected by DriveHub is used exclusively to:

• Authenticate API requests to Google Drive on behalf of the connected account.
• Browse, list, and display Google Drive files and folders on your WordPress website.
• Allow file uploads from your website directly to specified Google Drive folders.
• Generate embed links and previews for Drive files displayed on your site.
• Support role-based and user-specific folder access as configured in DriveHub settings.

DriveHub does not use Google data for advertising, profiling, analytics, or any purpose beyond the core file management features above. It does not access Gmail, Google Calendar, Google Contacts, or any other Google service.

3. Google API Services

DriveHub uses Google Drive API Services to enable Google Drive integration on WordPress websites. By using DriveHub to interact with Google Drive, you are also subject to the Google Terms of Service.

DriveHub's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Google Privacy Policy

As DriveHub uses Google Drive API Services, your data may also be subject to Google's Privacy Policy. For more information on how Google collects and processes data, please refer to the Google Privacy Policy.

5. Data Sharing

Sovlix does not sell, rent, or use Google user data for advertising or profiling. OAuth credentials stored by the DriveHub plugin remain in the connected website's WordPress database.

When Automatic Connection mode is used, the Google OAuth refresh token and website URL are transmitted to the Sovlix OAuth service only when a token refresh is required. Google Drive files and file contents are not sent to the Sovlix OAuth service during this request.

6. Data Protection Mechanisms

We take the protection of your sensitive data seriously and have implemented the following security measures:

• Encryption: OAuth refresh tokens are encrypted using industry-standard encryption protocols before being stored in your WordPress database.
• HTTPS: All communication between your WordPress site, the Sovlix OAuth proxy, and Google uses HTTPS (TLS encryption). No credentials are transmitted in plaintext.
• Revocation: You can revoke DriveHub's access to your Google account at any time by visiting myaccount.google.com/permissions or from the DriveHub settings page.

7. Data Retention

Google OAuth credentials are retained in the connected WordPress website's database until the administrator disconnects the Google account or removes the saved connection data.

8. External Services

DriveHub relies on the following external services:

• Google Drive API: Used to connect DriveHub to Google Drive and perform file operations authorized by the user. Google Terms of Service, Google Privacy Policy, and Google API Services User Data Policy.
• DriveHub OAuth Connection Service by Sovlix: Used in Automatic Connection mode to provide the shared OAuth client ID and process OAuth token refresh requests. Terms of Service and Privacy Policy.
• Freemius: Used for optional premium licensing, billing, account services, and plugin updates. Freemius Terms and Freemius Privacy Policy.

9. Updates to the Privacy Policy

We may update this Privacy Policy from time to time. Changes will be reflected on this page with an updated date. Significant changes will be communicated via email to active users.

10. Contact Information

If you have any questions, concerns, or requests related to this Privacy Policy, you can contact us at:
Email: [email protected]
Website: sovlix.com/support