Shapes – Google API Services Disclosure

Last updated: 21 October 2026

This page forms part of our Privacy Policy. It explains how DreamTeam HR Apps Ltd. d/b/a Shapes (“Shapes”, “we”, “our” or “us”) handles data received through Google APIs when a Customer connects our Google Workspace integration. Capitalized terms not defined here have the meaning given in the Privacy Policy. If anything in the Privacy Policy or our Terms of Use conflicts with this page, this page prevails for Google User Data.

1. What the integration does

When a Customer’s Google Workspace administrator connects our Google Workspace integration, we use the following Google scopes, only for that Customer:

admin.directory.user – to create, update and suspend the Customer’s Google Workspace user accounts based on its HR records in the Solution. The integration never deletes Google Workspace users.

admin.directory.group – to list the Customer’s Google groups so its administrator can choose which groups the integration manages, and to add employees to, or remove them from, those groups based on rules the administrator sets in the Solution.

calendar.events – only if the administrator turns this option on, to add a private event covering the approved time away to the calendar of the administrator who connected the integration when an employee’s time away is approved in the Solution, and to invite that employee. We do not read, change or delete any other calendar events.

2. Data we access

“Google User Data” means data we receive through Google APIs for the integration. To run the integration, we read the Customer’s Google Workspace directory: its user accounts (to match them to employees in the Solution), and its groups and group members. We do not access Gmail, Google Drive, Google Contacts or the content of any calendar, and we do not import Google Workspace data into the Customer’s HR records in the Solution.

We store only: (a) the OAuth access credentials and the list of scopes the administrator granted; and (b) the name and email address of each Google group the administrator selects for the integration. Other directory data is used only while a sync runs and is not stored, except that our operational logs may record Google user IDs and the email addresses of group members, so we can monitor and troubleshoot the integration. We process Google User Data as a processor for the Customer, under our Data Processing Agreement with the Customer (the “DPA”).

3. How we use Google User Data

We use Google User Data only to provide and run the integration for the Customer that connected it, including showing the Customer’s administrator its Google groups and monitoring and troubleshooting the integration.

4. AI and machine learning

We do not create aggregated or anonymized data from Google User Data, and we do not use it, or let any third party use it, to develop, improve or train artificial intelligence or machine-learning models.

We share Google User Data only with the Service Providers that host and monitor the Solution, including our cloud hosting and logging providers, acting as our sub-processors (as detailed in our Trust Center), or where applicable law requires.

6. Security

Google User Data is encrypted in transit and at rest, and access to it is restricted on a least-privilege basis with multi-factor authentication. Our information security management system is certified to ISO/IEC 27001:2022. Our Privacy Policy and Trust Center describe our wider security measures.

7. Retention and deletion

When the Customer disconnects the integration, we immediately delete the stored OAuth access credentials, and the integration stops accessing the Customer’s Google Workspace. The names and email addresses of the Google groups the Customer selected remain in our records after disconnection until the Customer asks us to delete them or its account in the Solution is closed. Operational logs are kept for up to 24 months and then deleted. When the Customer’s account in the Solution is closed, whether or not the integration is still connected, we delete the stored OAuth access credentials and the names and email addresses of the selected Google groups within 60 days of termination, in line with the DPA.

The Customer can disconnect at any time in the Solution, under Account Settings > Integrations > Google Workspace > Disconnect. Disconnecting does not revoke the authorization in Google; the Customer can revoke our access at any time from the Google Admin console (Security > Access and data control > API controls). Customers can also ask us to delete Google User Data by contacting [email protected].

8. Limited Use

Shapes’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Contact

For questions about this page or our handling of Google User Data, contact [email protected].