PRIVACY & DATA PROTECTION
GOOGLE API LIMITED USE COMPLIANT
Privacy Policy
This Privacy Policy explains how Asher Portfolio & Services (UnrealEmo, “we”, “us”, or “our”), operating at https://unrealemo.space, collects, uses, stores, and protects your personal information when you visit our portfolio, register an account, submit service desk tickets, schedule meetings using our Google OAuth and Google Calendar integrations, send email from your own Gmail account through the Email Composer, import your Google contacts or Gmail signature into the Email Composer, or chat with a store through Facebook Messenger.
Google API Services Limited Use & Terms Compliance
Asher Portfolio & Services (UnrealEmo) complies with the Google APIs Terms of Service and the Google API Services User Data Policy, including the Limited Use requirements. We never sell Google user data, never use it for advertising, and do not generate, process, or facilitate AI-generated Non-Consensual Intimate Imagery (AI NCII).
1. Information We Collect
We collect only the minimum information necessary to provide account authentication, technical consulting ticket management, and meeting scheduling:
Account & Profile Data
When you register an account or sign in, we collect your username, email address, display name, encrypted password hash (for email/password accounts), and assigned access roles.
Google OAuth & Google Calendar Data
When you sign in with Google or explicitly connect your Google Calendar in
/meetings, we receive your Google account email address, basic profile identifier, OAuth tokens, Free/Busy availability intervals, and calendar event metadata for meetings scheduled through UnrealEmo.Service Tickets & Meeting Bookings
When you submit a service inquiry or book a meeting (such as via
/book/[username]), we collect the topic, description, selected time slot, timezone, and participant contact details required to coordinate the session.Email Composer & Gmail Sending
When you connect Gmail in the Email Composer (
/email-composer), we receive your Google account email address, the scopes you granted, and an OAuth refresh token. We store the drafts you write (subject, sender name, recipients, HTML body, and attachments) and, for each message you send, its recipients, subject, size, send time, and the message and thread IDs Gmail returns, so you can find it in your Sent history.Google Contacts (Email Composer)
Only when you choose Import from Google in the Email Composer's Contacts tab, we read, for each of your Google contacts, their names, email addresses, organizations (company), and the labels they belong to. We store each contact that has an email address in your Email Composer contacts (address, name, first name, last name, and company), if you ask for it, turn your labels into contact lists, and keep the Google identifiers of the imported contacts and labels and a sync token, so a later import copies only what changed.
Gmail Signature & Send-As Addresses
Only when you choose to import them in the Email Composer's Settings tab, we read the signatures and the extra “From” (send-as) addresses set up in your Gmail settings, and store them as your Email Composer signatures and sender addresses.
Facebook Messenger Conversations
When you message a store's Facebook Page that is connected to UnrealEmo, we receive from Meta your Page-scoped ID, your Facebook display name, and the messages, quick replies, and button taps you send. If you link the chat to an UnrealEmo account to place an order, we also store the email address you give, the linked account, your shopping bag, and the orders placed from the chat.
Technical & Session Data
We record essential security logs, including session identifiers, IP addresses, user-agent headers, and verification token timestamps, to protect accounts against unauthorized access.
2. How We Use Your Information
We process collected information strictly for the following operational purposes:
Authentication & Identity Verification: Verifying your identity via email verification links, password reset tokens, or Google OAuth 2.0 sign-in, and enforcing Role-Based Access Control (RBAC) across workspace routes.
Meeting Scheduling & Free/Busy Availability: Querying Google Calendar Free/Busy intervals for connected hosts to prevent double-booking and calculate real-time available time slots.
Google Meet & Calendar Event Provisioning: Creating, updating, or cancelling user-authorized Google Calendar events with automatically generated Google Meet conference links when a meeting is confirmed, rescheduled, or cancelled.
Sending Email From Your Gmail: Sending, from your own Gmail account, only the messages you write in the Email Composer and choose to send, and keeping a record of them in your Sent history.
Sending to Your Own Contacts: Using the contacts you import from Google, and the lists made from their labels, only as recipients and personalization values (such as a first name or company) of the emails you choose to send from your own Gmail account.
Using Your Gmail Signature & Addresses: Adding the signature you import to the emails you write, and offering the send-as addresses you import as “From” addresses.
Store Conversations on Facebook Messenger: Answering your questions in Messenger with the store's assistant, keeping your shopping bag, placing the orders you confirm, and emailing you order updates, because Facebook allows a Page to message you only within 24 hours of your last message.
Service Desk & Transactional Communication: Sending transactional email notifications regarding ticket updates, meeting confirmations, account invitations, and security verifications.
Security & Abuse Prevention: Monitoring session integrity, revoking compromised tokens, and protecting our infrastructure against automated abuse.
3. Google API Services User Data Policy & Limited Use Disclosure
UnrealEmo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, when you grant UnrealEmo access to your Google Account, Google Calendar, Gmail, or Google Contacts scopes (
openid, email, profile, https://www.googleapis.com/auth/calendar.readonly, https://www.googleapis.com/auth/calendar.events, https://www.googleapis.com/auth/gmail.send, https://www.googleapis.com/auth/gmail.settings.basic, and https://www.googleapis.com/auth/contacts.readonly):• Strictly Scoped Calendar Operations: Calendar access is used exclusively to check Free/Busy busy-time intervals and to create, update, or cancel meeting events that you explicitly host or book on UnrealEmo.
• Send-Only Gmail Access: The
gmail.send scope is requested only when you connect Gmail in the Email Composer or send without a connection; signing in never requests it. It is used solely to send messages that you composed and chose to send. UnrealEmo cannot and does not read, list, modify, or delete any message in your mailbox, and from Gmail it keeps only the sent message's ID and thread ID for your Sent history.• Gmail Settings Read Only for Your Signature: The
gmail.settings.basic scope is requested only when you choose to import your Gmail signature and send-as addresses in the Email Composer's Settings tab. It is used solely to read those signatures and addresses; UnrealEmo never changes your Gmail settings, and this scope gives no access to your messages.• Read-Only Contacts Access: The
contacts.readonly scope is requested only when you choose Import from Google in the Email Composer's Contacts tab; signing in and connecting Gmail never request it. UnrealEmo reads only your contacts' names, email addresses, organizations, and label memberships, and the names of your labels. It never adds, changes, or deletes anything in your Google Contacts. Imported contacts are visible only to you in your own Email Composer workspace and are used only as recipients and personalization values of the emails you choose to send; they are never shared with other users, other apps, or any third party.• No Advertising or Data Monetization: We never sell, rent, license, or trade Google user data to third parties, and we never use Google Calendar, Google Contacts, Gmail, or OAuth data for targeted advertising, profiling, or creditworthiness evaluation. We never use your imported contacts to email anyone you did not choose to send to.
• No Unauthorized Human Access: No human reads your Google Calendar data or imported Google contacts unless you explicitly request technical support for a specific booking issue and provide consent, or where strictly required for security/legal compliance.
• No AI/ML Use or Transfer: We never transfer Google user data (including raw, aggregated, anonymized, or derived data) to any artificial intelligence or machine learning service, and we never use it to develop, improve, or train generalized or non-personalized AI or ML models. Google user data is processed only to provide the sign-in, meeting-scheduling, email-sending, and contact-import features described above. Contacts imported from Google are never sent to an AI provider. The emails you write in the Email Composer are your own content; a draft is sent to an AI provider only when you ask the Email Composer's assistant to work on it (section 5), and if you added a signature imported from Gmail to that draft, the signature is sent with it as part of the draft.
• Google APIs Terms of Service & AI NCII Prohibition: Asher Portfolio & Services complies with the Google APIs Terms of Service and strictly prohibits generating, processing, or distributing AI-generated Non-Consensual Intimate Imagery (AI NCII).
• Restricted Token Storage: OAuth refresh and access tokens are stored only in our access-controlled backend database (the Gmail refresh token encrypted with AES-256-GCM), are never sent to your browser, and are transmitted solely over TLS-encrypted connections to Google's official OAuth, Calendar, Gmail, and People API endpoints.
4. Data Sharing & Third-Party Service Providers
We do not sell your personal information. We share data only with essential infrastructure providers required to operate the platform:
• Google LLC: For Google OAuth 2.0 authentication, Google Calendar Free/Busy checks, Google Meet link generation, sending the Email Composer messages you choose to send through the Gmail API, reading the Gmail signature and send-as addresses you choose to import through the Gmail API, reading the contacts you choose to import through the Google People API, and Google Analytics anonymous traffic measurement.
• Meta Platforms (Facebook Messenger): When you chat with a store's connected Facebook Page, the store assistant's replies, product cards, payment QR images, and links are delivered to you through Meta's Messenger Platform, and the conversation's tags are applied as labels in that Page's inbox, visible to the Page's managers.
• Transactional Email Delivery: SMTP / mail relay providers used strictly to deliver account verification links, ticket replies, and meeting invitations.
• AI Model Providers: Google (Gemini API) and OpenRouter (routing to OpenAI), used only for the AI assistants and only with the chat data described in section 5. They never receive Google user data.
• ipwho.is (IP Geolocation): When a page is opened and our hosting provider has not already supplied the visitor's location, the visitor's IP address is sent to ipwho.is to look up an approximate country, region, and city, as described in section 6.
• Legal & Safety Requirements: When required by applicable law, regulation, or valid legal process to protect the rights, property, or safety of UnrealEmo and its users.
5. AI Assistants & Third-Party AI Providers
The demo store (“Unrealemo Supply”) includes an AI shopping assistant that answers questions about the store's products, and an AI setup assistant that helps store owners edit their catalog. When you use either assistant, the following is sent to a third-party AI provider to generate the reply: the store's catalog information, the messages you type, files you attach in the chat, and the shopping preferences you share in the chat (such as budget, sizes, and colours). The same shopping assistant answers customers who message a store's connected Facebook Page; then your Messenger messages and your Facebook display name are sent in the same way.
The Email Composer includes an assistant that edits and checks the email open in your editor. When you message it, your messages and the subject, sender name, attachment names, and HTML of that draft are sent to the AI provider. It never receives your recipients' addresses, your Gmail data, or your OAuth tokens.
• Google User Data: Your Google profile, OAuth tokens, Google Calendar data, meeting records, and contacts imported from Google are never included in any AI request. The only data received from Google that can reach the Email Composer's assistant is a signature imported from Gmail, and only when you added it to the draft you ask the assistant to work on.
• Providers: Requests are processed by the Google Gemini API (paid tier) and by OpenRouter (pay-as-you-go), which routes requests to OpenAI. We do not operate self-hosted or offline AI models.
• Training: We use only paid API services and no free-tier models. Under these providers' API terms, chat content is not used to train their AI models.
• Chat Retention: Chat transcripts, including Messenger conversations and Email Composer assistant conversations, are stored by UnrealEmo for 90 days after the last message so that store owners (for their store's conversations) and site administrators can review them, and are then deleted together with their attachments.
6. Page Visit Analytics
Each time a person opens a page of this site (the portfolio, the store, the blog, the booking pages, the sign-in pages and the signed-in workspaces), signed in or not, we store a visit record so that view counts are accurate, blog owners can understand their readership, and site administrators can see how the site is used. Each visit record contains:
• The Page & Time: The page's path (without its query string), the part of the site it belongs to, the blog post when it is one, when it was opened, and whether the visit counted toward the post's view total (only a browser's first open of a post each day counts).
• Your Account: The signed-in account that opened the page, if you were signed in.
• Network & Device: Your IP address, your browser's user-agent header, and the browser, operating system, and device type (desktop, mobile, or tablet) read from it.
• How You Arrived: The page that linked to it (the referrer, which after moving between pages of this site is the previous page) and any UTM campaign tags (
utm_source, utm_medium, utm_campaign) in the page's address.• Preferred Language: The first language your browser asks for.
• Approximate Location: Country, region, and city derived from your IP address, never from your device's location services. We use the location our hosting proxy attaches to the request when it provides one; otherwise, a few minutes after the visit, your IP address is sent to ipwho.is, a third-party IP geolocation service, and its answer is cached for 30 days so each address is looked up at most once a month. Private and local network addresses are never looked up.
• Visitor ID & Fingerprint: The random ID in the
site_visitor cookie described in section 8, and a fingerprint: a keyed SHA-256 hash of your IP address, user-agent header, and preferred language. The fingerprint is used only to tell whether two visits likely came from the same browser. For each visitor ID we also keep when it was first and last seen, how many visits it made, the linked account if any, and its latest IP address and device.Who Sees Visit Records: Site administrators see visit records for every page, including full IP addresses, and a live view of the newest visits as they happen. A blog owner sees the visit records of their own blog's posts, including the username of signed-in readers and the same live view for those posts, with IP addresses masked on our servers before they are sent (for example
113.161.x.x; an IPv6 address shows only its first 48 bits).Retention: Visit records are stored in monthly blocks, and each block is deleted once all of its records are more than 180 days old, so a record is kept for at least 180 days and is deleted within the following month. Visitor IDs not seen for 180 days are deleted daily. After that we keep only daily totals: views and unique visitors per page and per day, counts per day by referrer site, device, browser, operating system, country, region, city, and hour, and each blog post's view counts. These totals contain no IP addresses, accounts, or visitor IDs.
Automated Traffic: Requests that send no user-agent header or identify themselves as crawlers, link previewers, headless browsers, or HTTP libraries do not create visit records and never count toward view totals. Crawlers are counted only as daily totals per page and crawler name, without their IP address or user-agent header.
7. Data Retention, Revocation & Account Deletion
We retain account, ticket, and meeting records for as long as your account remains active or as needed to fulfill scheduled services and maintain security audit trails.
Disconnecting Google Calendar & Revoking Access: You may disconnect your Google Calendar integration at any time directly from the Meetings Dashboard (/meetings) using the Disconnect Calendar control, which removes your stored Google Calendar OAuth tokens from our active connection records. You can also revoke UnrealEmo's access at any time from your Google Account Security & Third-Party Access Settings.
Disconnecting Gmail: In the Email Composer's Settings tab, Disconnect asks Google to revoke UnrealEmo's access and deletes the stored Gmail token. Your drafts and Sent history stay until you delete them or your account.
Google Contacts Data & Deletion: You can select and delete imported contacts at any time in the Email Composer's Contacts tab; deleting a contact also deletes its link to Google. Disconnecting the Google account in the Settings tab revokes UnrealEmo's access to your contacts and deletes the account's stored Google contact identifiers, label links, and sync token; contacts already imported stay in your Email Composer contacts until you delete them or your account. Imported signatures can be deleted in the Settings tab, and imported send-as addresses are deleted when you disconnect that Google account.
Facebook Messenger Data & Deletion: You can unlink a Messenger chat from your UnrealEmo account at any time on your Account page. To have your Messenger conversations, Page-scoped ID, display name, and shopping bag deleted, email admin@unrealemo.space with the store's Facebook Page name and your Facebook display name; verified requests are processed within 7 business days. Orders you placed are kept as order records unless you also request deletion of your account. You can also remove the conversation in Messenger, which does not delete our copy.
Account & Personal Data Deletion: You may request complete deletion of your account, profile data, OAuth links, and associated records at any time by contacting us at admin@unrealemo.space. Verified deletion requests are processed within 7 business days.
8. Cookies & Session Security
UnrealEmo uses HTTP-only, cryptographically signed JWT access cookies and hashed refresh session tokens to maintain your authenticated session securely across pages. These cookies are strictly necessary for authentication, Role-Based Access Control (RBAC), and cross-request security validation. We also use standard anonymous analytics cookies (Google Analytics) to understand aggregate portfolio page performance.
When you open any page, we set a first-party, HTTP-only
site_visitor cookie holding a random ID. It lasts about one year, is sent only to our visit-recording endpoint, and is used only to tell repeat visits apart, as described in section 6. It is not shared with third parties.9. Your Rights & Contact Information
Depending on your jurisdiction, you have the right to access, correct, export, or delete the personal information we hold about you, as well as the right to withdraw consent for optional integrations at any time.
Data Controller & Privacy Contact
Platform: Asher Portfolio & Services / UnrealEmo (Le Thanh Trung / Asher)
Website: https://unrealemo.space
Email: admin@unrealemo.space