XRAI Cloud Manager Privacy Policy

This privacy policy governs the XRAI Cloud Manager (“Service”) developed by XRAI Inc. (“we,” “us,” or “our”), detailing how we handle authentication data across cloud and local Hyper-V deployments.

Introduction

Deployment Modes

The Service operates through two distinct authentication frameworks:

1. Cloud Deployment: Uses OAuth 2.0 with scopes compute.provision and cloudplatformprojectlist.readonly to provision resources.

2. Local Hyper-V Deployment: Relies on third-party login providers (e.g., Microsoft Account) for user authentication.

No personal identifiers (names, emails) or credentials are retained beyond active sessions.

Information Collection

Cloud Deployment (OAuth)

When deploying to cloud environments, we request:

OAuth Scopes and Purpose

• Temporary Tokens: Short-lived credentials (15-minute validity) for API operations.

• Project Metadata: Non-sensitive identifiers for targeting deployments.

Local Deployment (Login Providers)

For Hyper-V installations:

• Authentication Data: Name and email from login providers (e.g., Microsoft Entra ID).

• System Specifications: Hardware details for compatibility validation.

Use of Information

When you use Google Login to access our app, we only collect the information you authorize Google to share with us. This typically includes your name, email address, and profile picture, and may also include additional data if you grant explicit permission.

Scope-Specific Data Handling

Cloud Scopes in Practice

• compute.provision:

  • Used solely to provision virtual machines with user-specified configurations, including network interfaces and storage volumes.

• cloudplatformprojectlist.readonly:

  • Used exclusively to list projects for validation of user permissions, without accessing project contents or sensitive metadata.

Universal Restrictions

• No Behavioral Tracking: Credentials and data obtained from Google are never used for analytics, advertising, or behavioral tracking.

• No Cross-Scope Escalation: Tokens and permissions are strictly limited to the scopes you authorize and cannot access other resources such as storage buckets or databases.

Data Sharing Policies

We do not share, sell, or disclose any data obtained from Google Login with any third parties, partners, or affiliates, for any reason. All information received from your Google account is used exclusively to provide and maintain the functionality of our app as described above. We will never transmit, sell, or distribute your Google account data to anyone outside our organization, under any circumstances.

Security Framework

OAuth Security Protocols

Scope Minimization

• Least Privilege Design: compute.provision limited to:

  • Creating/deleting VM instances.

  • Attaching pre-authorized storage volumes.

• Read-Only Enforcement: cloudplatformprojectlist.readonly prevents modifications to project settings.

Technical Safeguards

• Token Binding: Session tokens restricted to:

  • Originating IP address.

  • Pre-registered client IDs.

• Ephemeral Storage: Credentials stored in memory-protected buffers with automatic zeroization after 900 seconds.

User Controls

Scope Management

Cloud Users

• Revocation: Terminate active sessions via cloud provider IAM consoles.

• Permission Adjustment: Narrow scope access using custom roles (e.g., limit compute.provision to specific regions).

Audit Capabilities

• Session Logs: Metadata-only records of:

  • Scope usage timestamps.

  • API methods invoked.

• Export Format: JSON logs available on request for compliance audits.

Compliance and Transparency

We comply with all applicable privacy laws and only use your data as described in this policy. Any changes to our data handling practices will be reflected in this Privacy Policy, and we will seek your consent if required.

Your privacy and the security of your Google account data are our top priorities. If you have any questions about how your information is handled, please contact us using support@xrai.glass.

Regulatory Compliance

Privacy Law Alignment

Policy Updates

Version Control

• Change Notifications: Email alerts for scope-related policy modifications.

• Grace Period: 30-day transition window for deprecated scopes.