Privacy notice

Who operates this service

The service operator and contact instructions are listed at the bottom of this page.

Information used for Google sign-in

Google sign-in requests basic identity access: your account identifier, email and profile. The service extracts and stores your Google account identifier and email, and uses Google's email verification status. It does not store your Google profile name or picture.

This sign-in flow does not request access to Gmail messages, Google Drive files, contacts or calendars. Bastos Auth does not receive your Google password. The Google access token is used during sign-in to retrieve your identity; it is not saved in the linked-account database.

Account and security information

Bastos Auth stores an internal account identifier, application membership, roles, account timestamps and email verification information. Depending on the sign-in method and application, it also processes session identifiers, token hashes, IP addresses, browser information, sign-in timestamps and security audit events.

If you enable passkeys or two-factor authentication, the service stores the credential data needed to verify future sign-ins. Passkey biometric checks take place on your device; the service receives no fingerprint or face scan.

Why this information is used and shared

This information is used to identify your account, establish sessions, enforce application permissions and investigate security events. The application you sign in to receives the account information needed for authentication, such as your internal identifier, email, verification status and roles. In the connected tools' identity response, the display-name field uses your email address.

Configured application integrations may also receive account and security events. Authorized administrators can manage memberships and review security records. Google processes the Google sign-in step under its own privacy policy.

Storage and retention

Account records and linked Google identities remain stored until removed by the service administrator. Sessions, token records and security audit records do not currently have an automatic database deletion schedule. Token expiration or access revocation prevents use of a credential; it does not itself delete the corresponding record.

Temporary sign-in state and short-lived connection codes expire automatically. Retention in infrastructure logs and backups is managed separately by the service operator; this notice does not specify a fixed deletion period for those systems.

Access, correction and deletion requests

Use the contact instructions below to request a copy, correction or deletion of your account data. Identify the application concerned and the email associated with your account. Do not send your password or authentication codes. The administrator may need to verify your identity before acting on a request.

You can also remove the Google connection from your Google account settings. Removing that connection does not automatically delete your Bastos account or data held by connected applications.

These public pages

The information pages do not set cookies or load analytics, advertising scripts or external fonts. The hosting infrastructure may keep access logs, including connection metadata.