This privacy notice is a frozen-safe draft (CA-24). It is published noindex so Google OAuth verification work can start; it is not a ratified GDPR Art. 13/14 notice until legal sign-off.
Smartedtech SL intends to act as controller for SafeUs service metadata (resource inventory, access decisions, approval records, evidence refs/hashes). Identity, consent, audit and billing truth remain with SET Core (M4/M8, L7, M10, M12). SafeUs does not store mail bodies, file contents, prompts or OAuth tokens — only secret_ref and discovery metadata on an allowlist.
Google API Services User Data Policy — Limited Use (draft statement, not yet submitted): SafeUs's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Microsoft Graph delegated permissions are the minimum set in connector_contracts/microsoft365.json.
Household profiles do not store age. Age band and guardian_of come from M4/M8. LOPDGDD 14 is documented in the DPIA (CA-26/CA-28) when that memo exists.
Partner programme: partners never see customer protected content. Commission figures are projections of M12; SafeUs is not the ledger.