Privacy policy

1. App developer, responsible organization, and scope

SpeedZone OS, also called SpeedZone Store OS, is the business management application for SpeedZone Convenience. MGC Convenience Corp is the organization responsible for its development, publication, and operation, and for personal information processed through the app. In this policy, “we,” “us,” and “our” mean MGC Convenience Corp.

The app helps authorized owners, partners, managers, and staff track sales, cash and bank activity, bills, vendor purchases, employee payments, and monthly closeouts. This policy covers the website, installed web app, sign-in, connected services, uploaded documents, and optional Store AI. It explains the information we access, collect, use, store, share, and delete.

This policy is specific to this application and business. It is available without signing in at speedzoneconvenience.com/privacy-policy and is linked from the homepage, sign-in screen, and app account menu.

2. Google user data we access and permissions we request

When you choose Continue with Google and authorize sign-in, Google supplies basic account information to Supabase, our authentication service. The sign-in permissions are identity (openid), email (email), and basic profile (profile). They identify your account; they do not grant access to the contents of your Google services.

We do not request Gmail messages, Google Drive files, Google Contacts, Google Calendar, browsing history, or other Google Workspace content. We do not receive your Google password; you enter it directly with Google if asked. A phone number or address is not requested through this Google integration.

Google data is obtained through the sign-in flow you initiate. Supabase holds the linked identity and authentication profile; the app receives the verified account information needed for store access. This connection does not provide ongoing access to your mailbox or documents.

3. How and why we use Google user data

We use Google-derived information to complete your requested sign-in, recognize your store account, check whether it is approved, apply its permissions, maintain a session, prevent unauthorized access, and resolve account problems. Authorized administrators use account identifiers and email addresses to approve, support, or disable membership.

Google sign-in does not automatically grant access to the business. Store approval and permission checks still apply. Google sign-in opens a separate sign-in window and finishes in your original SpeedZone app. A short-lived handoff expires after ten minutes and is removed when used. Session cookies remember your sign-in across app launches; signing out clears the local session.

These account and security functions are the purposes of the Google connection. Google data is not used to calculate sales, make payroll decisions, assess credit, or enrich unrelated databases. We request only permissions needed for sign-in. Any future feature needing other Google data would require a separate explanation and your authorization before access.

4. Other information collected, its sources, and purposes

Authorized users enter business records, and connected services supply information within the connection they authorize. Records may contain personal information about employees, suppliers, partners, or people identified in transactions and documents.

Bank authentication takes place through Plaid or the financial institution; our own forms do not ask for a bank password. Bank and Square connections are separate from Google sign-in and do not provide Google Workspace access. Users should supply only information they are authorized to provide and that is relevant to the store task.

5. Sharing, transfers, and recipients

We disclose information for the functions described here, authorized administration and support, security, and applicable legal obligations. The recipients and purposes are:

Specifically, Google-derived sign-in data is processed by Supabase and the app's hosting infrastructure for account functionality. Authorized administrators may access the identifier and email needed to manage membership. Bank and Square synchronization does not send your Google profile to those providers.

Necessary information may be disclosed to comply with applicable law or valid legal process, investigate abuse, or protect users and the service. We do not authorize providers to use Google data for unrelated advertising, resale, credit decisions, or generalized AI training. Google data restrictions also apply to personnel, contractors, and successors responsible for the app. A transfer of Google user data in an ownership transaction would require prior explicit consent where Google's policy requires it.

Providers may process information in the United States and other countries where they operate. Their notices explain their independent services: Google, Supabase, Cloudflare, OpenAI, Square, and Plaid. These supplement, rather than replace, this explanation of our app.

6. Google Limited Use commitments and prohibited purposes

Our use and transfer of Google API information follows the Google API Services User Data Policy and its Limited Use requirements. We restrict Google user data to providing and securing the account features described here.

We do not sell or rent Google data, disclose it to data brokers or information resellers, use it for targeted, personalized, interest-based, or retargeted advertising, or use it to determine creditworthiness or for lending. We do not transfer it for those purposes, build unrelated databases from it, or use or transfer it to develop, improve, or train generalized, non-personalized artificial intelligence or machine-learning models.

SpeedZone OS does not use Google Workspace APIs to develop, improve, or train non-personalized AI or machine-learning models. Its Google integration is limited to basic sign-in and does not request Google Workspace content.

Human access to Google-derived information is limited to authorized account administration described at sign-in, assistance you request, security investigation, or legal requirements. Staff are not permitted to browse it for unrelated purposes. If a different use requires permission, we will explain the specific information and purpose and obtain the required consent first.

7. Optional Store AI

When you use Store AI, OpenAI processes your message, relevant recent conversation history, attached images or PDFs, and relevant ledger information supplied to answer the request or propose an action. This may include names, employee payments, invoice details, and other personal information in store records. Conversations and proposed or completed actions are stored for review and continuity.

AI lookup uses store records. It does not retrieve your Google profile, Gmail, Drive, Contacts, or Calendar through Google APIs. Google authentication credentials are not part of ordinary AI requests. Information you type or upload yourself can contain personal information; do not include passwords, security codes, or unrelated sensitive information.

Regular forms and reports work without Store AI. The restrictions in section 6 apply regardless of whether you use this optional feature.

8. Storage and data protection mechanisms

Supabase stores authentication accounts, linked Google identities, and authentication profile metadata. Membership associations, business records, and audit history are stored in the app's Cloudflare D1 database; uploaded documents are stored in Cloudflare R2. Your device holds session cookies and app preferences.

HTTPS/TLS protects transmission. Storage providers encrypt information at rest: Supabase describes AES-256 protection for customer data, and Cloudflare automatically encrypts D1 database data and R2 files using provider-managed encryption. Authorized processing still requires access to usable information.

The app uses secure HTTP-only session cookies, server-side approved-account and role checks, origin checks on protected mutations, PKCE verification for Google sign-in, and limits on repeated sign-in starts. Private API responses carry no-store controls. Retrieving business documents requires an authorized account. Administrative access should be removed when duties change.

You can optionally enable device unlock with a passkey after Google sign-in. Your device handles Face ID, Touch ID, or passcode verification; SpeedZone does not receive your face, fingerprint, or device passcode. Supabase stores the passkey's public credential and verifies its signed responses. SpeedZone stores session-bound lock records and temporary unlock proofs to protect records when the app locks. Reopening the app requires device verification; your browser may require tapping Unlock. Turning off the app lock does not delete the passkey from your password manager or Supabase account.

These measures protect Google data and business records against unauthorized access, alteration, and disclosure. No system is risk-free. Report suspected unauthorized access to mgcconveniencecorp@gmail.com for investigation and appropriate action.

9. Cookies, device storage, and installed apps

Essential cookies complete authentication and maintain sessions. Device storage remembers preferences such as language and viewing choices. The installed web app also uses browser caching to load its interface. We do not use these app cookies for targeted advertising.

Clearing cookies and site data can sign you out and reset preferences. It does not delete server-held accounts or records. Removing the app from your Home Screen likewise does not delete stored business information.

10. Data retention and disposal

We retain personal information for the time needed for the purposes below, including applicable recordkeeping requirements. Retention depends on account status, record type and age, continuing business need, unresolved disputes or security incidents, and legal obligations. There is no single automatic deletion period for every category.

When information is no longer needed and no applicable retention obligation remains, we delete it or remove identifying details. Deletion involves administrative review; it does not happen automatically when you sign out. Backup or security copies may remain under provider retention processes after active-system deletion. We explain relevant exceptions in our response and do not reuse retained Google data for unrelated purposes.

11. Access, correction, export, and deletion requests

Email mgcconveniencecorp@gmail.com with the subject SpeedZone privacy request to request access, correction, an available copy or export of your personal information, removal of store access, account deletion, or deletion of Google-derived and other personal data.

1. Identify your account email, the action requested, and the information involved. You can request deletion of your entire account or particular data. Do not send passwords, authenticator codes, or API keys.
2. We verify your identity and, if acting for someone else, your authority before disclosing or changing information.
3. We identify relevant authentication, membership, document, conversation, and business records and review accounting, security, legal, or other people's rights that may require retention.
4. We provide applicable access or a copy, make corrections, or remove eligible information. Account deletion includes coordinating removal from the authentication service and app membership records as appropriate.
5. We explain the outcome, any retained information and reason, and relevant limits such as backup retention. We respond within applicable legal time limits.

MGC Convenience Corp handles these requests through administrative review. Deleting a login does not necessarily erase invoices, payroll, payments, or audit records the business must retain. You can raise concerns about data use or request review of our response at the same email. Additional rights may apply under the law where you live.

12. Withdraw authorization or revoke Google access

You can remove SpeedZone's Google connection in your Google Account connections settings. This revokes Google's authorization; it does not automatically delete information already received by Supabase or the business. Future Google sign-in may require authorization again.

Signing out, revoking Google authorization, disabling membership, and deleting information are separate actions. To end store access and remove eligible stored data, request both through section 11. We can also help with requests to disconnect a bank or other service; previously recorded transactions may remain for the stated retention purposes.

13. Business users and children

SpeedZone OS is intended for authorized business users. It is not directed to children under 13, and we do not knowingly collect their personal information through registration. If you believe a child has supplied information, contact us so we can investigate and remove it where appropriate.

14. Policy updates, new uses, and contact

We keep this policy current and update its effective date when it changes. Material changes to how Google data is accessed, used, stored, or shared will be notified to affected users through a prominent in-app notice or an email to their account address before the new use begins. Where additional consent or Google permissions are required, we will explain the change and obtain authorization first.

For privacy questions, requests, or concerns, contact MGC Convenience Corp, developer and operator of SpeedZone OS / SpeedZone Store OS, at mgcconveniencecorp@gmail.com. Our homepage is https://speedzoneconvenience.com/.