How workshop information is used.

This policy describes B9 Workshop, operated by Omar Salah, and its optional Google Drive connection. Effective 17 October 2026.

Information processed

The application stores account and access records, employee business profiles and contact details, company/job/location references, approved photos and external links, inventory definitions and media, operations, participants, quantities, settlements, supporting documents and activity records. Optional profile information is supplied by employees or management. Authentication is handled through Supabase; credentials and tokens are separate from readable business data.

Google Drive access and purpose

The owner authorizes a designated Google account using the https://www.googleapis.com/auth/drive.file scope. The integration uses files created by or explicitly authorized for this OAuth client, rather than scanning the whole Drive account. It creates a workshop folder when requested, uploads selected operation photos/documents, reads file contents and metadata for display/download, and permanently deletes registered files following authorized removal. It does not request Gmail, contacts, calendars or unrelated Drive contents.

Operation file bytes are stored in the connected Google Drive account. Supabase stores attachment metadata and registered file identifiers. OAuth refresh credentials are stored encrypted in Supabase Vault and used on the server to obtain short-lived Google access tokens; saved credentials are not returned to ordinary application users. Google data is used to provide the requested workshop attachment features, not advertising, sale, profiling or training a general-purpose AI model.

Who receives or can view information?

Flutter provides the interface; Cloudflare hosts the web application, Supabase provides database, authentication and server functions, and Google stores connected Drive attachments. Requests necessarily pass through these providers and their infrastructure. Their own service policies also apply.

All active signed-in workshop accounts may read business records, including approved attachments and the current activity log. Management roles control changes. If the owner enables public viewing, visitors can read the business projections and approved media exposed by that setting. A creator-issued share link grants anonymous access to one operation and its attachments. Pending employee photo/link proposals have their separate approval visibility rules. Credentials, invitations and session controls remain restricted.

Connecting the workshop Drive account authorizes the application to serve its registered workshop files to the audience described above. Do not upload documents you are not authorized to share with that audience. Anyone who receives a downloaded copy may retain it after access is revoked.

Retention and deletion

Operation history and linked identities are retained for stock consistency and responsibility records until an applicable management cleanup policy removes them. The current activity log has a configurable rolling limit. Employee retirement cleanup reviews eligibility after two calendar months and defers deletion while operational references remain.

Removing an operation revokes its share and app access to its main/proof attachments. Physical deletion from Drive is queued, normally checked every minute, and retried after failures. Inventory deletion queues its photos, thumbnails and files in Supabase Storage. Unapproved profile photos expire after one hour. Provider outages, revoked authorization or quotas may delay physical cleanup. Previously issued profile-photo signed links may remain valid until their short expiry. Provider backups and separately downloaded copies may remain under their respective policies.

Browser storage and security

Remember me optionally keeps the login session in browser local storage; otherwise session storage is used. Theme and navigation preferences may be stored locally. Reference/filter caches are held in memory. The app does not intentionally persist company records or media in its application-shell service-worker cache. HTTPS, role/session validation and server-side file authorization protect access, but no system can guarantee complete security. Hosting and service providers may process technical request logs.

Your choices and requests

Contact omarsalah1987amd@gmail.com to request access, correction, removal or help with your information. Some operational history must remain while needed for shared responsibility and linked records; management will explain applicable limits. The Google account owner may revoke access through Google Account connections. Revocation stops future Google file requests and may interrupt pending cleanup; existing workshop records are not automatically deleted. Contact the operator to arrange deletion or reconnection.

Google API Limited Use

B9 Workshop's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Policy updates

Material changes to Google-data use will be disclosed before applying the new use, with renewed consent where required. The current policy is available here and from the application. Contact: omarsalah1987amd@gmail.com.