1. Who uses the utility
The utility is for the business account owner and authorized Noir Boutique administrators. It is not offered as a general-purpose service to the public. An administrator must have authority to process and back up the business records they select.
2. Data and Google permissions
The Google Drive connection requests https://www.googleapis.com/auth/drive.file. This permits operations on files created by this application or explicitly made available to it, rather than unrestricted access to every file in the account.
Within that scope, the utility handles backup file contents and metadata such as file and folder identifiers, names, sizes, timestamps and checksums. It uses OAuth access and refresh tokens to perform authorized operations without requesting the Google account password.
Depending on the configured backup job, source data may include customer names, contact information and addresses; sales and return records; products, prices, inventory and images; employee account records; and application configuration, which may contain operational secrets. These records originate in the private POS system, not from visitors to this website.
The utility does not request Gmail, contacts or Google Photos access. Google account authentication and consent are handled by Google.
3. How data is used and disclosed
Data is used only to prepare, upload, verify, retain, retrieve and restore the business's backups and to diagnose backup failures. This includes creating, listing and reading backup objects and deleting obsolete objects under an administrator-approved retention policy.
Backup data is stored with Google Drive in the account authorized by its owner. Source data, credentials and temporary backup files are processed on the operator-controlled server, which is hosted by the operator's infrastructure provider. Authorized administrators may access business data for maintenance or recovery.
The utility does not sell Google user data, use it for advertising, or use it to train general-purpose AI models. It does not publish backups or share their contents with visitors to these pages. Disclosures may also be made where required by applicable law.
The utility's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements where applicable.
4. Storage and security
The intended Restic backup workflow encrypts backup contents and names before upload. The encryption password is held by the operator and should be kept separately from the backup server. Google OAuth tokens and other credentials must be stored in files restricted to authorized server users, not in public website files or source repositories.
Source files and temporary staging data on the private server are not necessarily encrypted by Restic at rest. Backup logs may contain technical identifiers, file paths, timestamps and error messages; administrators must restrict access to these logs and avoid logging tokens or record contents.
Encryption does not eliminate all risks. Recovery depends on preserving the encryption password, valid access to the storage account and usable backup data. Administrators must test their backup and restore process.
5. Retention, revocation and deletion
The account owner controls the backup schedule and retention policy. No universal retention period is imposed by this utility. Backups and local copies remain until removed under that policy or by an authorized administrator.
You can revoke the application's Google authorization in Google Account connections and remove its stored credentials from the backup server. Revocation prevents future authorized access but does not itself delete backup objects already stored in Drive.
For selective data removal, ask the authorized administrator to apply the appropriate retention and deletion procedure to the source system, snapshots and local copies. Do not manually delete individual Restic repository objects: snapshots may share encrypted data, and arbitrary deletion can make recovery impossible. Google Drive trash and account-level retention are controlled separately by Google and the account owner.
6. These public information pages
These pages have no sign-in form, file upload, customer database, advertising code or application analytics scripts. They do not connect to the private POS system or the backup repository.
The hosting provider may process ordinary web request information, such as IP addresses, requested URLs, browser details and access times, for delivery, security and operational logging. External Google and documentation links are governed by their respective providers' policies.
7. Contact and policy changes
Operator: Noir Boutique. For privacy, authorization or deletion questions, contact the authorized POS administrator through your established business support channel, or use the support email displayed on this application's Google consent screen.
Material changes to the utility's use of Google data will be reflected here. If a change requires new permission or consent, that must be obtained before the new use begins. The effective date above identifies this version.