💼 FFT Daily Log — an internal operations application built, owned, and operated by FFT Asia for its own staff. This policy describes exactly how this specific application (not any template or generic example) handles data, including any data obtained through Google APIs.

Privacy Policy

FFT Daily Log (https://dailylog.fft.asia) — Last updated: 17 September 2026

FFT Daily Log ("the System", "the App") is an internal operations tool built and operated by FFT Asia ("we", "us", "our") for use by our own staff to record daily work activity, sales inquiries, invoices, and delivery/service requests. The System is not a public-facing consumer product — access is restricted to authorized FFT Asia staff, each with an individual login. This policy is current as of the date above; if we materially change how the App uses Google user data, we will update this page and the "Last updated" date, and will notify affected users through the App's interface before the change takes effect.

1. Who this policy covers

This policy applies to (a) FFT Asia staff members who use the System, and (b) the limited personal information of FFT Asia's customers and business contacts that staff enter into the System in the course of normal business (e.g. logging a sales inquiry or scheduling a delivery).

2. Information we collect

Staff account data: username, display name, role/access level, and (for the delivery/service-request approval workflow) a work email address used solely for internal notification emails. Login sessions and key actions are recorded in an internal audit log, visible only to management, so it's clear who logged or changed a given entry.
Customer/business contact data entered by staff: for Sales Inquiries and Delivery/Service Requests, staff record details a customer has already given them directly (e.g. by phone, LINE, or in person) — typically name, phone number, email address, LINE ID, company name, and a delivery/service address. This is standard order/service record-keeping, not data collected directly from the public via this site.
Work records: daily work logs, invoices, job/project details, and photos of completed work, organized by department and employee.
Location data: when staff use the address search field on the Delivery/Service Request form, the typed address (and, optionally, map coordinates if a pin is placed) is sent to the Google Maps Platform to look up and display the location — see "Google user data" below.

3. Google user data — what we access, how, and why

This section specifically addresses data obtained through Google APIs, as required for our Google API OAuth verification.

3.1 What Google user data the App accesses

Google API	Scope / access	What is accessed
Google Drive API	`drive.file` (non-sensitive, per-file access — the App can only see files and folders it itself created)	Work-progress photos and other work-record files that FFT Asia staff upload through the App. The App connects to a single Google account owned and controlled by FFT Asia (`fftdailylog@gmail.com`) for this storage — the App does not ask individual staff members or customers to sign in with their own Google account, and does not access any files, folders, photos, or data in that Drive account other than what the App itself created and organized (a folder tree of Department → Employee → Product/Job, containing only files uploaded through the App).
Google Maps Platform (Places API, Maps JavaScript API)	API key (not OAuth / not "Google user data" in the account-access sense)	Address text a staff member types into the Delivery/Service Request Location field is sent to Google to retrieve matching places and display a map; optional map pin coordinates the staff member places. This is a Maps Platform API call, not access to any Google user account data.

Historical note for transparency: prior to 16 September 2026, the App also used the Gmail API (via OAuth, scope gmail.send) to send its own internal notification emails. This has been fully retired and replaced with a plain SMTP connection authenticated by a Gmail App Password — the App no longer requests or holds any Gmail API OAuth scope, and does not read, access, or process any Gmail account data (sent, received, or otherwise) for any account.

3.2 How we use Google user data

The Drive data described above (staff-uploaded work photos) is used exclusively to provide the App's own core file-storage feature: letting FFT Asia staff attach photographic evidence of completed work to their daily work-log entries, and letting other authorized staff view those photos later inside the App. We do not use this data for advertising, do not build user profiles from it, do not use it to train any machine-learning or AI model, and do not use it for any purpose unrelated to providing or improving this specific App feature.

3.3 Who we share Google user data with

We do not share, sell, rent, transfer, or disclose any Google user data described above to any third party. The only "transfer" involved is the data's storage inside Google Drive itself (i.e., Google acting as our chosen storage infrastructure provider) — no other company, advertiser, data broker, or unrelated third party ever receives this data. Internally, the photos are visible only to FFT Asia staff with an authorized login and appropriate department access within the App.

3.4 Data protection for Google user data

The OAuth refresh token that lets the App connect to the Drive account is stored server-side only, in a restricted-permission file on our private server — it is never sent to, or accessible from, any user's browser.
All traffic between staff browsers and the App, and between the App and Google's APIs, is encrypted in transit via HTTPS/TLS.
Access to view uploaded photos inside the App is restricted to logged-in, authorized FFT Asia staff, scoped to their department/role permissions.
The Drive scope used (drive.file) is itself a data-protection measure: by design, it prevents the App from ever seeing any Drive content beyond what it created, even if the token were somehow misused.

3.5 Retention and deletion of Google user data

Uploaded work photos are retained in Google Drive as part of FFT Asia's normal business/work records, for as long as those records are operationally useful (there is no automatic time-based deletion). Staff with appropriate permissions can delete individual uploaded files/entries through the App at any time, which removes them from Drive. If FFT Asia's use of the App ends entirely, the connected Drive account and its contents remain under FFT Asia's own control and can be deleted by FFT Asia directly in Google Drive. Any individual (staff or otherwise) who wants a specific photo/file reviewed or removed can request this via the contact below.

3.6 Limited Use disclosure

FFT Daily Log's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Other third-party services we use

Google Drive — described in full above.
Gmail SMTP (App Password) — sends internal notification emails (e.g. notifying the relevant staff member when a delivery/service request needs review, invoice reminders). This is a plain outbound-email connection, not an OAuth connection to any Gmail account's data — no Gmail user data is read or accessed.
Google Maps Platform — described in full above.

We do not use any advertising, analytics-for-marketing, or data-broker services within the System.

5. Data retention (general)

Work records, inquiries, and delivery/service requests are retained as part of FFT Asia's normal business records. Staff accounts are removed or disabled when no longer needed. Customers or business contacts who wish to have their information reviewed, corrected, or removed from our internal records may contact us using the details below.

6. Your rights (Thailand PDPA)

If you are an individual whose personal data appears in our records (e.g. as a contact person on a sales inquiry or delivery), you may request access to, correction of, or deletion of that data, subject to our legitimate business record-keeping needs (such as active orders or legal/accounting requirements), by contacting us below.

7. Contact

Questions about this policy, or requests regarding your data (including any Google user data described in Section 3), can be sent to: info@fft.asia