Process only what the event path needs.

Webhook URLs are credentials.Do not publish them, expose them in screenshots, or send them in support messages.

What FlowIngress processes

FlowIngress processes OAuth authorization credentials associated with the Google authorization used to start the configured Google Workspace Studio trigger. For an active configuration, this includes a refresh token used to maintain that authorization.

FlowIngress processes opaque webhook route identifiers, a stable configuration identifier, an opaque management credential, the Workspace Studio trigger identifier and notification URI, active-state information and relevant timestamps.

When an external system sends an event, FlowIngress processes the incoming webhook content together with operational information such as timestamps, event identifiers and error information needed to receive, route and troubleshoot the event.

How the information is used

FlowIngress uses this information to receive an incoming HTTPS POST, identify the intended active configuration, maintain the user's authorized Google connection, start the configured Workspace Studio trigger, operate webhook lifecycle controls, and support basic troubleshooting.

Google authorization

FlowIngress currently requests the dedicated Workspace Studio trigger permission needed to start the user's configured trigger and the Apps Script external-request permission required for HTTPS requests used for OAuth token exchange, token refresh and trigger delivery.

FlowIngress does not currently request Gmail, Drive, Calendar, Contacts or other broad Google Workspace data scopes.

Webhook content and event retention

FlowIngress does not intentionally persist incoming webhook request bodies as application records. The received body is forwarded to Workspace Studio as rawBody.

FlowIngress also generates and forwards aneventId and receivedAt value. Application code may record operational metadata such as an event identifier, route reference, HTTP status or error information. It does not intentionally log the raw webhook body.

Google and Google Apps Script infrastructure may separately retain service, execution or platform logs under Google's own policies. FlowIngress does not represent that infrastructure-level logging as being controlled by FinnStack Group.

Configuration and credential retention

The current validation-stage implementation stores active configuration information and credentials in Google Apps Script ScriptProperties so the configuration can continue receiving events asynchronously.

Temporary OAuth setup state is short-lived and is cleaned after authorization or expiry.

Active configuration information is retained while needed to operate that configuration. FlowIngress does not promise a fixed time-based retention period for all non-content configuration metadata.

Rotate webhook URL

A user can rotate a webhook credential. Rotation immediately invalidates the previous webhook URL and creates a different replacement URL for the same active configuration.

Disconnect this webhook

Disconnect removes the FlowIngress-held refresh-token authorization for that configuration and invalidates its webhook route.

Disconnect is terminal for that configuration in the current MVP. To reconnect, create and authorize a new FlowIngress Incoming webhook starter configuration. Same-configuration reauthorization is not supported in the current MVP.

Credential handling

An opaque webhook URL must still be treated as a credential. Anyone who obtains a valid active URL may be able to send events to that route. Keep webhook URLs and other lifecycle credentials confidential and restrict access to systems or logs that contain them.

Data sent to Google services

The incoming event body and generated event values are sent to the Google Workspace Studio trigger explicitly configured by the user. OAuth token operations and trigger delivery also use Google services and Google Apps Script infrastructure as required to operate the configured event path.

Sharing and disclosure

FinnStack Group does not sell, rent or disclose Google user data to advertisers, data brokers, information resellers or unrelated third parties. FlowIngress sends information to Google services and Google Apps Script infrastructure only as needed to operate the user-configured event path described on this page.

Information may also be disclosed when required by law or when reasonably necessary to protect users, the service or legal rights.

Data protection

FlowIngress uses HTTPS for network communications. OAuth refresh tokens and active configuration credentials are stored in Google Apps Script ScriptProperties rather than in public client-side storage. Access is limited to the OAuth permissions and application functions needed to operate FlowIngress.

Webhook routes and management values are opaque credentials and must be kept confidential. FlowIngress does not request or store a user's Google password, and application logging is designed not to intentionally persist raw webhook request bodies.

Retention and deletion

FlowIngress retains active Google authorization and configuration information while needed to operate the connected configuration. Disconnect removes the FlowIngress-held refresh-token authorization for that configuration and invalidates its webhook route.

FlowIngress does not intentionally persist incoming webhook request bodies as application records. Privacy or deletion requests for data controlled by FinnStack Group may be sent tohello@finnstackgroup.com. Information may be retained where reasonably necessary to comply with law, protect security, prevent abuse or resolve disputes.

Google API Services User Data Policy

FlowIngress's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Google relationship

Google Workspace is a trademark of Google LLC. Google Workspace Studio is a Google service. FlowIngress is developed and operated by FinnStack Group and is not endorsed by Google.

Contact

Privacy questions or requests:hello@finnstackgroup.com.