Google user data policy

Linuxit.it di Giacomo Santamaria – P.IVA IT04450430659, Via G. Palermo 2, 84129 Salerno (SA)
Application: Revolution Sell
Contact: security@revolutionmarketing.it
Version 1.0 – 31 October 2026

1. Scope

This policy covers the information that Revolution Sell, the e-commerce platform that Linuxit.it di Giacomo Santamaria provides to its merchant customers, receives from Google APIs (“Google Data”) when a merchant connects their Google account with the “Connect Google” button in the store’s admin panel. It supplements the general privacy policy and the Revolution Sell terms of service.

2. Permissions requested

openid and email: to know which Google account was connected and show its address in the admin panel.
https://www.googleapis.com/auth/content: to manage, through the Merchant API, the Google Merchant Center account the merchant selects.

We do not request access to Gmail, Drive, Calendar, Contacts, Google Cloud or any other Google service.

3. Data we access

Only after the merchant’s explicit consent, and only on the Merchant Center account they select:

Accounts: the list of Merchant Center accounts the Google account can access (name and ID), so the merchant can pick the store’s one;
Products: inserting, updating and deleting the store’s products (title, description, price, availability, images, identifiers) in a data source created by the platform, and reading their status (approved, pending, disapproved and reasons);
Data sources: creating, listing and deleting the platform’s data sources;
Settings: reading and writing the store’s shipping settings and return policies, and turning off automatic product collection from the website (Autofeed) when the merchant chooses direct upload;
Reports: clicks and impressions per product and market benchmark prices (price competitiveness report) for the store’s products.

We do not access any shopper personal data through Google APIs.

4. How we use Google Data

We use Google Data solely to provide the Revolution Sell features the merchant sees in the admin panel: publishing the store’s catalog on Google, keeping it in sync, showing product status and disapproval reasons, showing clicks, impressions and price comparison on each product page, and setting up shipping and returns.

We do not use Google Data for advertising, profiling or marketing, we do not sell it, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

5. Limited Use

Revolution Sell’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

we only use Google Data to provide or improve user-facing features that are prominent in the application;
we only transfer it to others when necessary to provide those features, for security purposes, to comply with applicable law, or as part of a merger or acquisition, with the merchant’s consent;
we do not use or transfer it for serving ads, including retargeting, personalized or interest-based advertising;
no human reads it unless we have the merchant’s explicit consent for a support request, it is necessary for security purposes (such as investigating abuse), it is required by law, or the data is aggregated and anonymized for internal operations.

6. Storage and security

Access tokens: Google refresh and access tokens are stored encrypted (AES-256) only in a dedicated authorization service; the store receives a short-lived (1 hour) access token through a signed request each time it needs one, and does not keep it.
Data in the store: product status, clicks, impressions and market prices are kept in the store’s own instance and database, separate from other customers and visible only to its authorized staff.
Location and transport: servers operated by OVH in France; all communication with Google and with the admin panel uses HTTPS with TLS 1.2 or higher.
Staff access: named accounts with two-step verification, role-based permissions and an access log; the full set of measures is described in our Amazon data handling policy (in Italian), which applies in the same way.

7. Sharing

We share Google Data only with the merchant who owns the account and their authorized staff, and with OVH, which hosts the infrastructure without accessing the data. We do not share it with any other third party.

8. Revoking access and deletion

From the admin panel: on the Merchant Center setup page, “Disconnect Google account” immediately revokes the token at Google and deletes it from the authorization service.
From Google: the merchant can revoke access at any time at myaccount.google.com/permissions; from then on the platform can no longer access the Merchant Center account.
Data in the store: product status and reports already downloaded can be deleted on request at security@revolutionmarketing.it; when the merchant’s contract ends they are deleted with the rest of the instance within 30 days, unless the law requires otherwise. Backups are deleted automatically after 30 days.

9. Review

This policy is reviewed at least once a year and whenever the requested permissions or the features using Google Data change.