Privacy Policy — Connective Labs
Last updated: 3 September 2026
Who we are. Connective Labs Pte Ltd ("Connective Labs", "we", "us") is an AI consultancy incorporated in Singapore. We build and operate software tools, including internal developer command-line tools such as gws-axi, that connect to Google Workspace services on behalf of an authorised user. This policy explains what personal data we collect, including data obtained from Google APIs, and how we access, use, store, share, retain and delete it.
Scope. This policy covers (a) data you give us through this website (for example via our contact form), and (b) Google user data that our applications access through Google APIs after you grant permission on Google's OAuth consent screen.
Google user data we access
When an authorised user connects a Google account, our applications request only the following OAuth scopes, and only to deliver the features described:
| Google scope (API) | Why we need it |
|---|---|
openid, email, profile | To identify which Google account is connected. |
gmail.modify (Gmail API) | To read, label, and manage Gmail messages at the user's request (for example triaging mail, drafting replies, applying labels). |
gmail.settings.basic | To read and update Gmail settings such as filters and send-as aliases at the user's request. |
calendar (Calendar API) | To view, create, and update calendar events at the user's request. |
documents (Google Docs API) | To read and edit Google Docs at the user's request. |
spreadsheets (Google Sheets API) | To read and edit Google Sheets at the user's request. |
presentations (Google Slides API) | To read and edit Google Slides at the user's request. |
drive (Drive API) | To read, create, and organise files in Google Drive at the user's request. |
drive.activity.readonly | To see recent file activity so we can show the user what changed in their Drive. |
We request the narrowest scope needed for each feature, and we do not request access to data our features do not use.
How we use Google user data
Google user data is used solely to provide and improve the user-facing features of our applications at the direction of the authorised user — for example, reading an email the user asked us to summarise, or editing a document the user asked us to update. We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalised AI or machine-learning models. Our employees and contractors do not read Google user data except: with the user's affirmative agreement (for example when the user asks us to investigate a specific problem they reported), for security purposes (for example investigating abuse or a bug), to comply with applicable law, or where the data is aggregated for internal operations in accordance with applicable law.
Limited Use disclosure
Connective Labs Pte Ltd's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Storage and security
OAuth access and refresh tokens and any Google user data our tools temporarily process are stored only on the authorised user's own workstation and our secured cloud infrastructure, encrypted in transit (TLS) and at rest. Access is limited to personnel who need it to operate and support the applications, and all such personnel are bound to comply with the Google API Services User Data Policy.
Sharing and transfers
We do not sell, trade, or share Google user data or other personal data with third parties, except: to provide or improve the user-facing features of our applications with the user's consent; for security purposes; to comply with applicable law; or as part of a merger, acquisition, or sale of assets, after obtaining the user's explicit prior consent. We do not transfer Google user data to advertising platforms, data brokers, or information resellers.
Retention and deletion
We keep Google user data only as long as needed to provide the feature that required it, or as long as the user keeps the account connected, whichever is shorter; temporary caches and logs are deleted within 30 days. An authorised user can revoke our access at any time from their Google Account permissions page, after which we delete the associated tokens and cached data within 30 days, or earlier on written request to our contact address below.
Your rights (including Singapore PDPA)
Subject to applicable law, including Singapore's Personal Data Protection Act 2012, you may ask us to access, correct, or delete the personal data we hold about you, and withdraw consent to our processing of it, by writing to the contact address below. Withdrawing consent may end our ability to provide features that depend on the affected data.
Website data
When you contact us through this website, we collect the name, email address, company name, and requirements you give us, and use them solely to respond and provide our consulting services. We do not sell, trade, or share this information with third parties except as necessary to provide our services or as required by law. We implement appropriate security measures to protect it against unauthorised access, alteration, disclosure, or destruction.
Changes to this policy
We will update this page whenever our data practices change and revise the "Last updated" date above.
Contact
Questions about this Privacy Policy: leon@connective-labs.com, Connective Labs Pte Ltd, Singapore.