Athena Privacy Policy

Effective date: October 1, 2026

This Privacy Policy describes how Athena accesses, uses, stores, and protects information obtained through Google APIs and other authorized data sources.

Athena is a privately operated AI and document-management system used by its private owner. It is not offered as a public consumer service.

1. Google Data Athena Accesses

Athena may access the following Google account information after explicit authorization by the account owner.

Google Drive

Athena may access Google Drive files, folders, metadata, file contents, identifiers, revisions, and related information.

Athena may also create, rename, move, update, trash, restore, or delete Drive objects when authorized.

Gmail

Athena accesses Gmail using read-only permission.

This may include:

• email message content;
• message metadata;
• message headers;
• attachments;
• mailbox information necessary to retrieve authorized messages.

Athena's Gmail OAuth permission does not authorize Athena to send, edit, or delete Gmail messages.

2. How Google Data Is Used

Google user data is used only to provide Athena's private document-management and information-management functions.

These functions may include:

• document ingestion;
• document synchronization;
• canonical document preservation;
• file organization and naming;
• version and revision tracking;
• duplicate identification;
• document classification;
• indexing and search;
• email and attachment ingestion;
• information retrieval;
• AI-assisted document analysis;
• integrity checking;
• backup, archival, and provenance tracking.

Google user data is not used for advertising.

Google user data is not sold.

3. Storage

Information retrieved through Google APIs may be stored on privately controlled Athena infrastructure.

Stored information may include:

• canonical document copies;
• historical versions;
• document hashes;
• metadata;
• provenance records;
• indexes;
• extracted text;
• email or attachment content required for authorized ingestion and retrieval.

Athena may retain historical information where necessary to maintain document history, provenance, integrity, or archival records.

4. Data Sharing and Transfer

Athena is privately operated for the authorized account owner.

Google user data is not sold to third parties.

Athena does not transfer Google user data to third parties for advertising, marketing, or unrelated commercial purposes.

Any processing of Google user data is limited to operating, maintaining, securing, and improving the functionality requested by the authorized account owner.

Athena's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

5. AI Processing

Authorized data may be processed by AI models operating as part of Athena for tasks such as classification, retrieval, summarization, document analysis, and organization.

Such processing is performed to provide functionality requested by the account owner and is not used to build advertising profiles or sell user information.

6. Security

Athena uses technical and operational safeguards intended to restrict access to authorized systems and users.

These safeguards may include:

• authenticated access;
• encrypted transport;
• restricted credential permissions;
• local credential storage;
• file-integrity verification;
• audit records;
• controlled write authority;
• least-privilege policies where practical.

No system can guarantee absolute security.

7. OAuth Credentials

Google OAuth credentials and refresh tokens are treated as private security credentials.

They are not intentionally exposed publicly.

Athena uses OAuth credentials only to access Google services within the permissions granted by the account owner.

8. Data Retention

Athena may retain canonical documents, historical versions, metadata, and provenance records for as long as they are needed for the owner's document-management and archival purposes.

Temporary or redundant data may be deleted when no longer required.

The account owner controls Athena's retention policies.

9. Revoking Google Access

The account owner may revoke Athena's access to Google account data at any time through the Google Account permissions and connections settings.

Revoking access prevents Athena from making new authorized Google API requests with the revoked credentials.

Locally retained canonical or historical data is governed separately by the owner's Athena retention policies.

10. User Control

Athena operates under the authority of the account owner.

The account owner determines:

• which Google account is connected;
• what OAuth permissions are granted;
• how Drive content is organized;
• what information is retained;
• what information is archived;
• when data is deleted;
• when Google authorization is revoked.

11. Changes to This Policy

This Privacy Policy may be updated if Athena's functionality, data access, or data-handling practices change.

The current version will be published at:

https://pila.ltd/athena/privacy

12. Contact

Questions about this Privacy Policy or Athena's handling of Google user data may be directed to:

dwpedd@gmail.com

PILA Investments Ltd.