Privacy and data use

1. Who this notice covers

Techrace, available at techrace.in, provides account integrations through an API and Model Context Protocol (MCP). This notice covers visitors, people who sign in to Techrace, and people who connect accounts through a customer application. That application decides which supported features to request and has its own privacy responsibilities.

Techrace is being prepared for customer launch. Its legal operating entity and registered address have not yet been confirmed for publication. Those details, applicable regional rights and contractual data-processing terms must be completed before general customer onboarding. This notice describes the current implementation; it is not a statement of provider approval or a security certification.

Signing in and connecting an account are separate steps. Google sign-in is available; individual integrations require separate consent and enablement. The categories below explain what an enabled feature processes, not that every visitor has supplied that data or every integration is currently available.

2. Information we process

Sign-in and workspace information

Google account identifier, email address, verification status and available basic profile details such as name and picture; authentication and MFA records; project names, team memberships and roles; developer-supplied customer identifiers; API-key permissions and connection status. Google sign-in alone does not give Techrace access to your mailbox, channel or advertising account.

Gmail and Outlook, when connected

Mailbox address and identifiers; message and thread identifiers; sender, recipient, subject, date, labels or folders and read state. Selected-message reads can include body text or HTML, attachment information and files when the calling application explicitly requests the corresponding content. Optional draft, reply, forward, send and mailbox-change features also process the recipients, content and instructions supplied for that action. Background synchronization, if enabled, processes change metadata and checkpoints.

YouTube, when connected

Channel identity and owned video identifiers/metadata; the selected channel or video reports, including views, engagement, watch time and available aggregate audience or traffic breakdowns. Separately enabled publishing or engagement features process the media, titles, descriptions, comments and moderation instructions requested by the authorized application. Monetary reports require their separate permission.

Google Search Console, when connected

Authorized website property identifiers and permissions; requested search-performance rows such as queries, pages, dates, countries, devices, clicks, impressions, position and click-through rate; selected URL inspection results. This feature does not provide access to a person's private Google search history.

Google Ads and other connected social accounts

Authorized account or Page identifiers and profile details; selected posts, comments, conversations or messages; requested performance reports. Advertising features process account, campaign, budget, targeting and creative information needed for the selected report or explicitly authorized operation. Availability depends on the provider and permission granted; connecting a mailbox does not authorize advertising use of its contents.

Credentials, uploads and service records

OAuth access/refresh tokens and granted permissions; developer-uploaded media; queued operation inputs and outcomes; event and webhook delivery metadata; request identifiers, status/error codes and security/rate-limit records. Our hosting and authentication services also process network and device information needed to receive requests and protect the service.

3. Why we use it

We use sign-in and workspace information to authenticate people, enforce team and project permissions, and associate a connection with the correct customer. We use provider credentials to perform the features that the account owner authorizes, refresh access where permitted, and stop access when a connection is removed or a revocation is detected.

Connected data is used to return the requested report or mailbox/social result, carry out an authorized action, synchronize requested changes or deliver configured event notifications. Service records support troubleshooting, abuse prevention, operation recovery and connected-account usage accounting. A permission grant does not authorize unrelated access or a new purpose.

4. Who receives it

• Your chosen application and authorized team. API results go to the authorized caller for your developer project and customer record. Configured webhook endpoints receive supported event data. The application's own storage, employees and subsequent processing are governed by its disclosed purpose and privacy notice.
• An AI client you choose. When an enabled MCP workflow is used with an AI application, tool results can become available to that application and its model service. That is an additional recipient, not private processing solely inside Techrace. The developer must identify the recipient and purpose and obtain the required consent before using that workflow. A Google sign-in or ordinary API grant is not blanket permission to send data to any AI service. Google provider data and actions through Techrace's official MCP tools are currently unavailable pending separately consented agentic OAuth support; standard REST access remains subject to independent provider enablement.
• Our current infrastructure services. Render runs the website, API and background application work; Supabase provides authentication and the database; Cloudflare handles incoming traffic, private file storage and queues. They process information needed for those roles. This notice does not list an AI model company as a Techrace infrastructure provider.
• The connected platform. Google, Microsoft or the selected social platform receives the requests and content needed to perform the operation. Sending a message or publishing content makes it available to the recipients or audience you select.

We do not sell connected account data. Access for support or investigation must be limited to the specific need and the permissions described below. Any required legal disclosure or business transfer must respect applicable law and the restrictions on Google data; a business transfer does not automatically authorize a new use of that data.

5. Google data and Limited Use

Techrace's use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including its Limited Use requirements. Gmail information is also subject to the Google Workspace user data and developer policy. These restrictions also cover information derived from Google data.

We limit Google data to the authorized, visible user-facing integration feature. Transfers are restricted to what is needed for that feature with the user's consent, security purposes, applicable legal obligations, or a business transfer with the user's prior explicit consent. Human access to Google data requires specific affirmative user permission, a necessary security investigation, a legal obligation, or a permitted use of appropriately aggregated and anonymized information.

We do not use Gmail or other Google Workspace data to serve or target advertising, sell it to data brokers, determine creditworthiness or train generalized AI models. Techrace has no model-training feature using Google data. Downstream developers and AI clients are not permitted to use the integration to bypass these restrictions. Customer-authorized Google Ads management is a separate feature with separate permissions; mailbox or identity data is not repurposed for it.

6. Storage and protection

Techrace processes data on its server infrastructure and uses HTTPS for its public and provider API traffic. Provider credentials, queued email inputs and mailbox synchronization checkpoints/batches are encrypted by the application with AES-GCM and bound to the relevant account or project. Project permissions, scoped keys, database access rules and MFA protect administrative access. These controls do not mean that every metadata field is individually encrypted or that security incidents are impossible.

Ordinary mailbox and analytics reads return the requested data to the caller without creating a general-purpose searchable archive in Techrace. Requested background sync, queued actions, uploads and operation/event records have separate storage described below. Application error logging uses request IDs and status/error codes rather than raw provider errors, tokens or mail bodies.

The current deployment uses Render and Supabase resources in the United States, with Cloudflare network processing and external platforms operating across locations. We do not promise country-exclusive processing. The browser uses session storage for sign-in and temporary authorization state, and local storage for your motion preference. Authentication and infrastructure providers may use their own necessary cookies or storage.

7. Retention

Retention depends on the record and the feature. The following describes implemented behavior, including its limits:

• Identity, projects and connection metadata: retained while the account or project is maintained, until the applicable deletion process removes it. Disconnecting alone does not erase all historical records.
• Provider credentials: stored for an authorized connection. Disconnect or connection removal deletes active stored credentials through the guarded lifecycle; unresolved operations can require review first. Provider-side consent is a separate control.
• Queued mail content: encrypted input is cleared when an operation reaches a final status. Pending mail operations expire after 24 hours through background cleanup; the status/receipt record can remain.
• Optional mailbox change batches: encrypted batches expire after 24 hours or are removed after consumer acknowledgment. The current synchronization checkpoint is retained while needed for the tracker.
• Integration events and deletion receipts: ordinary events become eligible for cleanup after 30 days; completed customer/project deletion receipts after 90 days. Cleanup runs in bounded background steps, so a backlog or service interruption can delay physical removal. Incomplete deletion receipts remain for repair.
• Audit records, operation receipts and usage records: no general automatic deletion deadline has been finalized for all these records. They can remain until explicit project erasure, subject to separate security or billing records. We do not claim all metadata disappears after 30 days.

Files are removed through the relevant media/customer/project deletion process. Copies already returned to a customer application, data on the connected platform, infrastructure logs and any hosting backups have separate lifecycles. A fixed retention schedule for infrastructure logs and backups has not yet been published; deletion from the active application is not a guarantee of immediate erasure from every copy. These operating limits must be finalized before general customer launch.

8. Your choices and deletion

You can decline a connection request or remove Techrace's authorization in your provider account. For Google, use your Google Account connections. Removing provider access stops future authorized use of that grant; it does not itself erase data already received by Techrace or your chosen application.

Ask the application through which you connected to disconnect your account and delete its customer record. Authorized Techrace administrators can request customer deletion and inspect its progress. Project owners can request project erasure in account settings. A separate sign-in account deletion request is available when enabled and when ownership or unfinished work has been resolved.

Deletion runs in background steps and may require reconciliation of an operation whose outcome is uncertain. An accepted request is not a completed deletion. Techrace deletion does not remove native emails, published posts or ad campaigns, revoke every provider-side grant, or delete copies held by the customer application. Contact us for an access, correction or deletion request if the in-app route is unavailable. We may ask for enough information to verify your identity and locate the relevant project; never send passwords, tokens or authenticator codes.

9. Contact and updates

The designated Techrace privacy contact is ai@techrace.in. Include the application you used, your request and a nonsecret project or customer reference if available. Mailbox delivery and the support handling process are still being verified before customer launch; no guaranteed response time is claimed.

We will update this notice when the operator, retention arrangements or data uses change. A new purpose or recipient that requires consent must be disclosed before that processing begins; updating this page alone does not supply that consent. The date above identifies this version. See access and security documentation for the available account controls.