This policy describes how Candid Digital's Google-connected SaaS tools (Reporting and CandidAI Scanner) access, use, store, and protect data obtained from Google APIs. This page is linked from our Google OAuth consent screen and satisfies Google's disclosure requirements.
analytics.readonly — Fetches GA4 performance metrics (sessions, users, pageviews, bounce rate, conversions, traffic channels, top pages) for properties the client explicitly connects.
webmasters.readonly — Fetches search performance data (queries, clicks, impressions, average position, query-page mapping) for properties the client explicitly connects.
analytics.manage.users — Used only to let a client add our team's email ([email protected]) as a Viewer, Analyst, or Administrator on their GA4 property from within our tool's settings screen. This eliminates the need for the client to manually navigate Google Analytics to invite us. We do not use this scope to remove or alter any other user's access — only to add the access the client explicitly requests through our UI.
We access only properties the client explicitly connects via OAuth. We cannot see other properties in their Google account.
To generate the client's marketing performance dashboard and monthly reports inside the Reporting tool. Each data point maps directly to a visible metric card, chart, or table in the client's dashboard. No data is accessed speculatively or for purposes beyond displaying reports to the authenticated client.
We may also process stored report data to extract performance insights, identify trends, and surface actionable recommendations specific to the client's property — such as highlighting keyword opportunities, traffic anomalies, or month-over-month growth patterns. These insights are generated exclusively for and displayed only to the same client whose data is being analysed.
Report data fetched from Google APIs is never shared with, sold to, or transferred to any third party. It is displayed only to the authenticated client who granted access.
spreadsheets — Creates and appends rows to a single dedicated spreadsheet ("CandidAI Scanner - Contacts") in the client's Google Drive. Used to store extracted business card data as a structured contact list.
documents — Creates a follow-up notes document for each scanned contact, containing the contact's details and a checklist of follow-up actions. One document per card scan, stored in the client's Drive.
contacts — Syncs extracted contact information (name, email, phone, company, designation) into the client's Google Contacts, so the scanned lead is immediately available in Gmail, Android, and other Google services.
drive.file — Uploads the scanned business card image to a dedicated folder ("CandidAI Scanner Cards") in the client's Drive. This scope limits access to only files and folders created by our app — we cannot read, modify, or delete any other files in the client's Drive.
We do not access the client's entire Google Drive, existing documents, or pre-existing spreadsheets. The drive.file scope restricts our access exclusively to files our application creates.
Each API powers one specific step of the card-scan-to-CRM workflow:
Business card data processed by CandidAI is never shared with, sold to, or transferred to any third party. The AI extraction runs on our servers and the results go directly to the client's own Google account. Card images are not used for model training or any purpose beyond the immediate extraction task.
Candid Digital's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Only the authenticated user who granted OAuth access can view their data within our tools. Candid Digital team members (administrators) may access data solely for technical support purposes when explicitly requested by the client.
We may update this policy to reflect new tools, changed scopes, or updated Google requirements. Material changes will be communicated via the email address associated with the client's account. The effective date at the top of this page will be updated accordingly.
For questions about this policy, data deletion requests, or privacy concerns: