Privacy Policy

1. Information we collect

We collect the following categories of information to operate the Service:

Account information

When you sign up or log in, including through Google Sign-In or Microsoft Sign-In, we receive your name, email address, profile picture (if available), and a unique account identifier from the provider. We use this to create and secure your account and to identify you within your organization.

Organization and content data

When you use the Service, you create and upload content such as organizations, team members, playlists, schedules, media files (images and videos), device names, and widget configurations. This content is stored so we can deliver it to the digital signage devices you manage.

Connected third-party data

If you connect an integration (for example, the Google Calendar widget), we access data from that third-party account so we can display it on your signage screens. See Google user data & API Services for the specifics.

Device and usage data

We collect technical information generated by your use of the Service, including log data, IP address, browser and device type, and the status and activity of the signage devices enrolled in your organization. This helps us operate, secure, and troubleshoot the Service.

2. Google user data & Google API Services

Gecko Signage integrates with Google APIs so you can sign in with your Google Account and display Google Calendar events on your signage screens. We only access Google user data after you explicitly authorize it on Google’s OAuth consent screen, and only for the purposes described in this section. This section applies to all data we receive from Google APIs (“Google user data”).

2.1 What Google user data we access

Our access is read-only. We never create, edit, or delete calendars or events. We do not read event attendee lists, attachments, or conferencing details, and we do not access your Gmail, Google Drive, Google Contacts, or any other Google service.

2.2 How we use Google user data

• Sign-In data is used only to authenticate you and to create or access your Gecko Signage account.
• Calendar list data is used only to show you your calendars in the dashboard so you can pick the one to display.
• Calendar event data is used only to (a) show a live preview of the calendar widget in the dashboard while you configure it and (b) render the calendar widget on the signage screens in your organization that you assign it to.
• OAuth tokens are used only by our servers to fetch the calendar data above on your behalf, so screens stay up to date without you having to sign in again.

We do not:

• sell Google user data;
• use or transfer Google user data for advertising, including personalized, retargeted, or interest-based advertising;
• use Google user data to determine credit-worthiness or for lending purposes;
• use Google user data to build user profiles or for any purpose unrelated to the calendar display feature you enabled; or
• use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

No person at Red Gecko reads your Google user data unless (a) you give us explicit permission to do so for a support request, (b) it is necessary for security purposes, such as investigating abuse, (c) it is required to comply with applicable law, or (d) the data is aggregated and anonymized and used for internal operations.

2.3 How we share, transfer, or disclose Google user data

We do not sell, rent, or trade Google user data, and we do not share it with third parties for their own purposes. Google user data is shared, transferred, or disclosed only as follows:

• Your organization and your screens. A Google account connected for calendar display is connected at the organization level. Members of your Gecko Signage organization can select its calendars when configuring calendar widgets, and the selected calendar’s events are shown on the signage screens you assign the widget to. Those screens may be visible to anyone at their physical location, so choose a calendar that is appropriate to display publicly.
• Infrastructure provider. Our backend runs on Google Cloud (Firebase Cloud Functions and Cloud Firestore), which processes and stores this data on our behalf under its data processing terms. Google user data is not sent to any other service provider.
• Legal requirements. When required by applicable law, regulation, legal process, or enforceable governmental request, or to protect against fraud, abuse, or security threats.
• Business transfers. As part of a merger, acquisition, or sale of assets of Red Gecko, only after obtaining your explicit prior consent.

2.4 How we protect Google user data

We treat OAuth tokens and calendar data as sensitive data and protect them with the following measures:

• Encryption in transit. All traffic between your browser, our servers, Google APIs, and signage devices uses HTTPS (TLS).
• Encryption at rest. OAuth tokens are stored in Google Cloud Firestore, which encrypts all data at rest (AES-256).
• Server-only token storage. OAuth tokens are stored in a database location that our security rules block from all client access. They can be read only by our backend Cloud Functions, are never sent to web browsers or signage devices, and are never shared between organizations.
• Protected credentials. Our Google OAuth client secret is held only in server-side configuration and is never included in client or device code.
• Access control. Calendar data can be requested only by authenticated members of your organization or by signage devices enrolled in your organization. Every request is checked server-side.
• Least privilege. We request read-only calendar access only, and access to production systems is limited to authorized Red Gecko personnel who need it to operate the Service.

2.5 Retention and deletion of Google user data

• OAuth tokens are retained only while your Google account is connected. When you click Disconnect on a calendar widget’s settings page, we immediately revoke the tokens with Google and permanently delete them from our database.
• Calendar list and event data are not stored in our database. Our servers fetch them from Google on demand and discard them after returning the response.
• On signage devices, the events for each assigned calendar widget are cached locally so screens keep working during short network outages. The cache is replaced with fresh data about every five minutes, and it is deleted from the device at its next sync (within about five minutes) after the widget is removed from the device or the Google account is disconnected or revoked.
• Sign-In data (name, email, profile picture) is kept for as long as your account exists, and is deleted when you ask us to delete your account.
• Revoking from Google. You can also remove Gecko Signage’s access at any time at myaccount.google.com/permissions. Revoked tokens stop working immediately.
• Deletion requests. To request deletion of all Google user data associated with your account or organization, email support@geckosignage.com. We will complete the deletion within 30 days and confirm by email.

3. Microsoft account data

If you sign in with Microsoft, we request the User.Read permission to obtain your basic profile (name and email address) for the sole purpose of authenticating you and creating or accessing your Gecko Signage account. We do not access your Microsoft mail, files, or other data.

4. How we use information

We use the information we collect to:

• Provide, maintain, and secure the Service and your account;
• Deliver the content and widgets you configure to your signage devices;
• Display data from integrations you connect (such as Google Calendar events);
• Authenticate you and enforce organization roles and permissions;
• Communicate with you about your account, billing, security, and support requests;
• Monitor, troubleshoot, and improve the reliability and performance of the Service; and
• Comply with legal obligations and enforce our terms.

5. Protected Health Information (PHI)

Gecko Signage is not designed or configured by default to receive, store, or process Protected Health Information (“PHI”) as defined under the Health Insurance Portability and Accountability Act (“HIPAA”). Users should not upload or transmit PHI to the Service unless Red Gecko has entered into a Business Associate Agreement (“BAA”) with the applicable organization. See our Terms of Use for additional detail on PHI and BAA requirements.

6. How we store & protect information

The Service runs on established cloud infrastructure. Account and content metadata is stored in Google Cloud Firestore; media files are stored in Amazon Web Services (AWS) S3. Data is encrypted in transit using TLS and encrypted at rest by our infrastructure providers. OAuth tokens for connected integrations are stored server-side and are never exposed to the signage devices or other organizations.

Access to data is restricted through Firebase Authentication, organization-level access rules, and server-side authorization checks so that members can only access data belonging to their own organization. No method of transmission or storage is completely secure, but we work to protect your information using industry-standard safeguards.

7. How we share information

We do not sell your personal information. We share information only in these limited circumstances:

• Service providers. We use trusted infrastructure providers, including Google (Firebase and Google Cloud), Amazon Web Services, and Microsoft, that process data on our behalf to run the Service.
• Within your organization. Content and integration data you configure is visible to other members of your organization and is displayed on the signage devices you manage.
• Legal reasons. We may disclose information if required by law, regulation, legal process, or a governmental request, or to protect the rights, property, or safety of Red Gecko, our users, or the public.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

8. Data retention

We retain your information for as long as your account is active or as needed to provide the Service. When you disconnect an integration, we delete the associated OAuth tokens. When you delete content, an integration, or your account, we delete the associated data from our active systems, except where we are required to retain it for legal, accounting, or legitimate business purposes. Backups are purged on a rolling schedule. Retention and deletion of Google user data is described in section 2.5.

9. Your rights & choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can exercise many of these directly in the dashboard, or by contacting us at support@geckosignage.com. We will respond consistent with applicable law.

10. Revoking access & deleting data

You can stop our access to your connected data at any time:

• Disconnect an integration in Gecko Signage. Click Disconnect on any calendar widget’s settings page. We revoke the connection with the provider (where the provider supports it) and permanently delete the stored OAuth tokens.
• Revoke access from your Google Account. Visit myaccount.google.com/permissions and remove Gecko Signage to revoke all Google API access.
• Delete your account. Contact us at support@geckosignage.com to request deletion of your account and associated personal data.

11. Children’s privacy

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us so we can delete it.

12. International users

We operate in the United States, and your information may be processed and stored in the United States and other countries where our service providers operate. By using the Service, you understand that your information may be transferred to and processed in jurisdictions that may have different data protection laws than those in your country.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us at support@geckosignage.com.

Red Gecko LLC
Columbus, Ohio, United States