← Back to login

Privacy Policy

Last updated: September 2, 2026

Overview

ITPA (IT Personal Assistant) is an internal productivity tool built and operated by Takeshi Nakagawa. It is not a public service. Access is limited to invited members of the IT engineering team.

This policy explains what data the application accesses, how it is used, how it is stored, and what rights you have over your data.

Legal Basis for Processing

ITPA processes your data based on your explicit consent, which you provide when you first sign in and accept the data processing terms. You may withdraw consent at any time by deleting your account from the Settings page.

Processing is limited to what is necessary to provide the productivity features you have opted into (calendar sync, email triage, Slack status, etc.).

Data We Access

ITPA connects to the following services. All non-Google connections are optional and initiated by you from the Settings page.

Google Account

  • Profile: Name, email address, and profile picture for account identification.
  • Google Calendar: Read and create events. Used for schedule display, focus/lunch block scheduling, conflict detection, color coding, Slack status sync, PTO handoff coordination, and calendar analytics.
  • Gmail (optional): Read, label, and send emails. Used for inbox triage, email analytics, thread summarization, reply/forward, label and filter management, and unsubscribe audits.
  • Google Drive (optional): Read-only access, used for two things. Meeting notes: “Notes by Gemini” documents inside your “Meet Recordings” folder and its per-meeting subfolders, for meeting-notes display. ITPA Academy source material: when a trainer pastes a Google Docs or Drive link as a course reference, that one file is opened by its file ID and its text extracted — a Google Doc, Google Sheet, PDF, or plain-text/Markdown/HTML file, on your own Drive or on any shared drive you can view. It is read with your access, so nothing you cannot already open is reachable, and the file must be linked by hand.
  • Google Contacts (optional): Read-only access. Used solely for email address autocomplete when composing replies or adding senders to preference lists.
  • Google Sheets (optional, Bulk Sender): Read and write access to spreadsheets you open with the Slack Bulk Sender. The recipient list is read from the sheet you choose, and the app adds a tab to that same sheet and writes back what each person answered. No other spreadsheet is touched.

Slack (optional)

  • Status sync: Reads and updates your Slack profile status based on your calendar events.
  • Auto-responder: Reads incoming DMs and sends automatic replies when you are OOO or after hours. No DM content is stored.
  • Channel sync (opt-in per channel): Reads messages from channels you explicitly map to a Jira ticket (e.g. purchasing channels prefixed with purchasing-) and posts AI-summarized updates back to the linked Jira ticket. Only mapped channels are read.

Atlassian Jira (optional)

  • Tickets and comments: Read assigned and watched issues; read ProForma intake form fields via Jira custom-field mirrors. Used for ticket overview, purchasing workflow, hardware request workflow, and assistant follow-ups.
  • AI-generated comments: The purchasing and follow-up agents post comments back to Jira on your behalf. Every AI-authored comment is prefixed with an [AI] attribution tag.

Atlassian Confluence (optional)

  • Page content: Read-only access to specific Confluence pages you reference. Used by the ITPA Academy to fetch linked training pages for AI summarization.

BambooHR (admin-configured)

  • Org data: Employee directory, reporting structure, work email, job title, location, and time-off records. Used for the team roster, org chart, and PTO handoff workflows. Sensitive HR data (compensation, performance, personal contact) is never accessed.

Snipe-IT (admin-configured)

  • Hardware inventory: Asset records (model, serial, status, assigned user, location) for the AMER Hardware laptop-inventory feature and the purchasing-workflow reorder formula.

Anthropic Claude API

  • Short previews of calendar events, email snippets, Jira ticket descriptions, Slack messages from mapped channels, and Confluence page text are sent to the Claude API for analysis (triage, action-item extraction, thread summarization, purchasing-workflow planning, Academy summarization).
  • ITPA Academy course generation is the one exception to “short previews”: the text of every source a trainer references — Confluence pages, public web pages, and Google Docs, Google Sheets, PDFs and text files read from Google Drive — is extracted and sent to the Claude API as the material the course is drafted from. Each source is capped at 50,000 characters and the concatenated result at 12,000 before the call. The extracted text is used for that request only and is not stored; what is kept is the reference link and any text the trainer typed themselves.
  • All other inputs are length-capped (email body 300 chars, calendar description 200, Jira description 600, Slack message 800) and untrusted text is wrapped in clearly-marked sections with a prompt-injection notice.
  • Full email bodies are not sent unless thread summarization is explicitly triggered by the user.
  • Anthropic does not retain data between requests per its API data policy. API requests are not used for model training.
  • A global kill switch and per-feature toggles let administrators disable any AI feature instantly; per-feature hourly volume caps prevent runaway automation.

Privacy Boundaries

  • Manager-facing features (team roster, org chart, handoffs, meeting notes) use only org-visible data sources (BambooHR, calendar, public/private channels the user is already in). They never read individual users’ personal Gmail inboxes or Slack DMs.
  • Slack channel sync only reads channels you have explicitly mapped to a Jira ticket. No global channel listening.
  • Google Drive is never browsed or enumerated as a whole, but it is read in two distinct ways and neither is limited to one folder. Meeting notes are found by filename: the app asks Drive for documents named “Notes by Gemini” across everything you can see, then keeps only the ones inside your “Meet Recordings” folder and its subfolders. The names of other documents matching that title come back in the search result and are discarded; nothing outside the folder is opened, and nothing from the search is stored. An ITPA Academy course reference reads exactly the one file its link names, by file ID — anywhere in your Drive or on any shared drive you can view, with no folder restriction. Both use your own read-only access, so the app can never open a file you could not open yourself, and the Academy case requires somebody to paste that specific link.
  • Every AI-generated external write (Jira comment, Slack message, email) requires a per-target opt-in and is rate-capped.

Data We Store

The following data is stored in the application database:

Stored

  • Account info: Google profile (name, email, picture), role, creation date, and consent timestamp.
  • OAuth tokens: Google, Slack, Jira, and Confluence tokens, encrypted at rest using Fernet symmetric encryption (AES-128 + HMAC). Used to make API calls on your behalf.
  • Calendar event cache: Event metadata (title, time, attendees, organizer) for up to 12 months. Used for analytics and scheduling without live API calls.
  • Email metadata cache: Sender, recipient, date, read status, and label IDs for up to 12 months. Used for email analytics. No email subject, body, or attachment content is stored.
  • Team data cache: Mirrored BambooHR roster (name, work email, title, manager, location, time-off windows) for the team roster, org chart, and PTO handoff features.
  • Hardware inventory cache: Mirrored Snipe-IT asset records (model, serial, status, assigned user) used by the AMER Hardware feature and the purchasing reorder formula.
  • Channel-to-ticket mappings: Slack channel IDs you have explicitly mapped to Jira tickets for the channel-sync feature.
  • Meeting notes references: Pointers to Google Drive Meet Recordings (file ID, title, date). Note bodies are fetched live, not cached.
  • Purchasing & assistant workflow state: Plan turns, assignee handoff records, follow-up timers, and auto-execution flags for the purchasing and follow-up agents. AI-generated draft text is stored only until posted to Jira.
  • User preferences: Working hours, lunch/focus settings, starred/muted senders, priority/ignored topics, Slack status mappings, color coding preferences.
  • API usage logs: Claude token counts and external API call counts per user, for monitoring, cost tracking, and per-feature rate caps.
  • Bulk Sender campaigns: For each campaign, its message, buttons, approval trail, and one row per recipient holding that person’s email address, name, resolved Slack user ID, timezone, delivery status, and which button they pressed. Recipients are named by whoever built the campaign and are usually not users of this app.
  • Slack workspace directory cache: Display name, real name, email address, and timezone for members of the workspaces you connect, refreshed monthly. Used to resolve a recipient to a Slack account and to send at their own local time.
  • Audit logs: Actions performed in the app (login, sync, settings changes, AI external writes) for security and debugging.

Not Stored

  • Email body content, attachments, or full subjects
  • Slack DM content (only event-driven auto-responder actions are tracked)
  • Slack channel message history beyond what is needed to compose the next AI summary
  • Google contact details (queried live for autocomplete, never cached)
  • Calendar event descriptions or attachments
  • Google Drive file contents. Meeting notes are kept only as a reference (file ID, title, date), and the text an ITPA Academy reference is drafted from is discarded after the request — the saved course is Claude’s draft plus whatever a trainer typed or edited, not the source file.
  • BambooHR compensation, performance, or personal contact information

Data Security

  • The application runs on Google Cloud Run with HTTPS enforced and HSTS (Strict-Transport-Security) enabled.
  • Database is hosted on Google Cloud SQL (PostgreSQL) in the us-central1 region, encrypted at rest.
  • OAuth tokens are encrypted using Fernet symmetric encryption (AES-128 + HMAC-SHA256) before storage.
  • Secrets (API keys, client secrets, signing keys) are managed via Google Cloud Secret Manager.
  • CSRF protection, rate limiting, CORS restrictions, Content Security Policy, and Permissions-Policy headers are enforced.
  • Session cookies are signed, HttpOnly, Secure, SameSite=Lax, and expire after 7 days.
  • The application container runs as a non-root user following the principle of least privilege.
  • All admin actions are logged in an immutable audit trail.

Data Retention

Data is retained only as long as necessary for its stated purpose. The following retention periods are enforced automatically:

  • Calendar and email caches: Refreshed on each sync. Automatically purged for users inactive for more than 90 days.
  • Gmail mark-as-read undo cache: Expires after 24 hours.
  • API usage logs (Claude and external): Automatically deleted after 90 days.
  • Audit logs: Automatically deleted after 1 year.
  • Slack auto-reply deduplication logs: Automatically deleted after 30 days.
  • Denied access requests: Retained until manually reviewed by an administrator.

A daily automated retention job enforces these periods. You may also request immediate deletion at any time (see Your Rights below).

Third-Party Services

The following third-party services process your data as described above:

No data is sold to or shared with third parties for advertising, marketing, or any purpose beyond operating this application.

Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15): You can view what data is stored about you in the Settings page.
  • Right to data portability (Art. 20): You can download all your data as a JSON file from Settings > Your Data > Download My Data.
  • Right to erasure (Art. 17): You can delete your account from Settings > Your Data > Delete My Account. This action is immediate and irreversible. It removes your account, your preferences, your cached calendar and email metadata, your action items, your API usage logs, and the feedback and bug reports you filed. Records that describe shared work rather than you alone are kept and still carry your user ID — Bulk Sender campaigns and their recipients, channel-to-ticket mappings, team and training records, resourcing items, and invitations you sent — as are audit logs, which are retained deliberately for security. Ask an administrator if you need those purged too.
  • Right to withdraw consent: You can withdraw consent at any time by deleting your account. You can also disconnect individual services (Gmail, Drive, Slack, Jira, Confluence) from the Settings page.
  • Right to rectification (Art. 16): Account data (name, email, picture) is synced from your Google account. Update it there to update it here.
  • Admin users can also purge individual user data via the Data & Privacy admin panel.

All data subject requests are processed immediately through self-service. If you need additional assistance, contact the administrator.

Contact

For questions about this policy or your data, contact Takeshi Nakagawa.