Privacy Policy

1. Introduction

At Cormigra Enterprise ("Cormigra", "we", "us", or "our"), respecting the privacy and confidentiality of corporate enterprise data is the cornerstone of our engineering philosophy. This Privacy Policy describes how we handle information in connection with our managed Google Drive migration services and website (cormigra.com).

2. Compliance with Google API Services User Data Policy

Cormigra's migration tools and automation access Google Workspace environments via the Google Drive API (https://www.googleapis.com/auth/drive).

Cormigra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements:

• We only use access to Google Drive data to provide or improve user-facing features that are prominent in the user interface (specifically, cross-tenant file migration and permission remapping).
• We do not transfer Google Workspace user data to any third-party ad networks, data brokers, or information resellers.
• We do not use Google Workspace data for serving advertisements, including personalized, re-targeted, or interest-based advertising.
• We do not use Google Workspace user data to train or fine-tune generalized machine learning or artificial intelligence models.
• We do not allow humans to read user files unless we have obtained your affirmative agreement for specific debugging, it is necessary for security purposes, or it is required by law.

3. Information We Collect and Process

3.1 Migration Metadata (Processed in Real-Time Only)

To successfully orchestrate file transfers and folder hierarchy recreation, our automated engine queries metadata objects:

• Directory & Path Metadata: File IDs, folder names, nested hierarchy relationships, MIME types, creation dates, and file size byte counts.
• Access Control Lists (ACLs): User email addresses, sharing roles (organizer, editor, commenter, viewer), and link-sharing permission states.
• Verification Checksums: SHA-256 and MD5 cryptographic hashes generated by Google to verify byte-level transfer integrity.

Note: This metadata is indexed in an encrypted local state ledger during active migration to ensure state persistence and resumability, and is delivered to Customer as the final migration handover ledger.

3.2 Business & Contact Information

When you request a quotation or communicate with our engineers, we collect:

• Full Name and Job Title (e.g. IT Administrator, CTO)
• Corporate Work Email Address and Phone Number
• Company / Organization Name
• Source and Destination Google Workspace Domain Names (e.g. oldcorp.com and newcorp.com)
• Approximate data volume (GB/TB) and user counts

4. Authentication Credentials & Service Account Security

For managed migrations, Customer creates an authorized Google Cloud Service Account with restricted Google API scopes.

• Encrypted in Transit and at Rest: Service account credentials are encrypted using AES-256 and stored in an isolated, sandboxed environment accessible only to the assigned migration team.
• No Passwords Collected: We never request, store, or process individual user account passwords.
• Permanent Deletion: Upon project sign-off and completion of the warranty period, service account credentials are permanently scrubbed from our systems. We instruct the Customer's administrator to delete the authorized Client ID in their Google Admin Console.

5. Zero Data Retention Architecture

Traditional migration tools download files to intermediate virtual machines or cloud storage buckets before uploading them to the destination.

In contrast, Cormigra utilizes a direct cloud-to-cloud transfer architecture. Data moves directly between Google Workspace environments across Google's high-speed internal backbone. At no point do file bytes stream to or reside on Cormigra hardware or third-party servers.

6. GDPR, HIPAA, and International Data Protection

GDPR Compliance: For European Union and UK customers, Cormigra acts as a Data Processor under Article 28 of the GDPR. We execute Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) upon request.

HIPAA Alignment: For healthcare and covered entities, we sign Business Associate Agreements (BAAs) confirming that all electronic Protected Health Information (ePHI) processed via Google APIs meets HIPAA technical safeguards.

7. Website Analytics and Cookies

Our website uses minimal, privacy-friendly session cookies to ensure proper site navigation, interactive audit state retention, and anonymous traffic aggregation. We do not use intrusive cross-site tracking pixels or sell website visitor behavior to advertising networks.

8. Data Subject Rights

Under applicable global data protection regulations (including GDPR and CCPA/CPRA), you have the right to:

• Request access to business contact data we hold about you.
• Request correction or deletion of your business contact information.
• Object to or restrict processing of your commercial data.
• Withdraw consent at any time without affecting prior lawful processing.

9. Contact Our Data Protection Officer (DPO)

If you have questions, concerns, or requests regarding this Privacy Policy or our Google API security compliance, please contact our Data Protection Officer: