Google Contacts Privacy Policy

Last updated: 18 August 2026

1. Controller and operator

PROCESSLOGIX SRL, Strada Fabricii, bl. 7, ap. 13, Simeria, Hunedoara County, Romania, Trade Register no. J2021000463350, tax identification number (CUI) 43676538, operates DEVS-AVAX and is the controller for the processing described in this policy. Privacy or integration enquiries can be sent to contact@process-logix.com.

2. Google access requested

When an operator chooses to connect a Google account, DEVS-AVAX requests the standard Google identity scopes openid and email, together with the Google Contacts scope https://www.googleapis.com/auth/contacts.

The openid scope is used to obtain the stable Google account identifier needed to keep durable AVAX contact links isolated between different Google accounts. The email scope is used to obtain account email metadata that can be displayed to the operator; the email address is not used as the durable account key. These identity scopes do not provide DEVS-AVAX with access to Gmail, Google Drive or Google Calendar content.

The Google Contacts scope lets the feature read Google contact data required for exact matching, linking, synchronization and change detection, including contact names, email addresses, phone numbers, organization information, and Google resource or metadata values needed to identify and synchronize the contact. It also permits the explicitly confirmed contact creation, contact update and personnel-photo synchronization functions described below.

DEVS-AVAX uses information received from Google APIs only for the user-visible Google Contacts synchronization feature and its account-isolation behavior described on the DEVS-AVAX application page.

3. Why Google user data is used

Google account identity metadata is used to show the connected account where available and to prevent a durable contact link created under one Google account from being silently reused under another Google account. Google contact data is used to search for an existing contact by approved exact email or phone identifiers, let the operator select and link the correct contact, compare the linked contact with the corresponding AVAX personnel data, detect whether a change is required, and perform a confirmed synchronization. Name alone is never treated as a match.

4. AVAX data that may be sent to Google Contacts

After the operator explicitly confirms a contact creation or synchronization, DEVS-AVAX may send the following AVAX personnel information to Google Contacts when available and relevant:

• structured name;
• company/work email;
• personal email when present;
• personal phone;
• work phone numbers;
• company or organization;
• department;
• main role or job title;
• authoritative AVAX personnel photo when available.

DEVS-AVAX does not export address, date of birth, CNP or identity-card data, contracts, camp/accommodation data, access-card identifiers, or unrelated internal HR/operational identifiers through this Google Contacts feature.

5. Operator control over Google changes

Connecting or changing the Google account is an explicit operator action. Creating a new Google contact requires explicit operator confirmation. Synchronizing an existing linked Google contact also requires explicit operator confirmation. The current feature does not delete Google contacts.

6. Data protection and security mechanisms

Access to the Google Contacts synchronization feature is limited to a normal authenticated AVAX user session whose user has been granted the dedicated people.googlecontacts.sync permission. Generic access to People records does not by itself authorize Google Contacts synchronization.

Communications with Google OAuth/OpenID and Google People API services use HTTPS. The OAuth authorization-code flow uses PKCE with the S256 challenge method and a cryptographically random state value that is validated when the authorization response returns to DEVS-AVAX.

OAuth access and refresh token state retained locally for the Windows user is protected using Windows Data Protection API (DPAPI) with the CurrentUser protection scope. OAuth access and refresh tokens are not stored in the AVAX SQL database. AVAX SQL retains only the synchronization and correlation metadata required for account-specific durable contact linking and change detection. These controls are used to reduce unauthorized access, disclosure, or misuse of Google user data.

7. Synchronization metadata

AVAX stores non-secret synchronization and correlation metadata needed to maintain account-specific durable links and no-change detection. This can include the AVAX user/person association, stable Google account identity, Google contact resource identity, ETag information, and synchronization/hash metadata. Google account email is display metadata and is not the durable account key. Public documentation does not expose private database identifiers or implementation secrets.

8. Retention, disconnect and link removal

Google OAuth authorization remains available locally until it expires, is revoked, or the operator disconnects the Google account. Disconnecting revokes or removes the local OAuth authorization state. Durable AVAX synchronization/link metadata may remain until the operator removes the AVAX link so that the application's link state can be managed separately from Google authorization.

Removing the AVAX link removes the AVAX-side association according to the application's link-management behavior; it does not delete the Google contact. The current V1 feature does not implement Google contact deletion.

9. Sharing and transfers

Google identity metadata is returned from Google to the DEVS-AVAX desktop application for connected-account display and account-specific link isolation. When the operator confirms a create or synchronization operation, the selected AVAX contact fields are transmitted to Google through the Google People API so Google can provide the requested Google Contacts functionality. Google contact data is returned from Google to DEVS-AVAX for the matching, linking and synchronization functions described above. We do not disclose Google user data to unrelated third parties as part of this feature.

10. Prohibited and unrelated uses

Google user data used by this feature is not sold, used for advertising, provided to data brokers, used for credit or lending decisions, used for unrelated profiling, or used to train AI or machine-learning models.

11. Google API Services User Data Policy

Process Logix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Questions and privacy requests

For questions about this policy, the Google Contacts integration, or privacy requests relating to DEVS-AVAX, contact contact@process-logix.com. The general public website Privacy Notice remains available at /privacy for website/contact-form processing.