Who we are
PunchOp publishes punchop.com and operates the application at app.punchop.com. This policy covers both.
To ask a question or request deletion, write to privacy@punchop.com.
Privacy
Privacy policy
PunchOp reads delivery evidence that an administrator already has, in order to explain one email. It does not sell Google data, and it does not use it for advertising.
Updated 5 November 2026.
Google account
Sign-in uses OpenID Connect. We receive the Google subject, the email address, the profile name and the hosted domain. We store the subject, the email and the domain so we can open the right organisation and keep a session.
The session is a signed cookie on app.punchop.com. Signing out clears it.
Workspace administrator proof
Connecting an organisation asks a super admin to grant two read-only Directory scopes:
- https://www.googleapis.com/auth/admin.directory.user.readonly — confirm that the signed-in account is a super admin, and count users. The count requests only the user id, 500 per page.
- https://www.googleapis.com/auth/admin.directory.domain.readonly — read the verified domains of that Workspace customer.
Reports API
An optional second consent adds https://www.googleapis.com/auth/admin.reports.audit.readonly. PunchOp uses it to read Gmail audit events: actor, time, message id, event type and the fields Google includes, which can contain a subject line.
The refresh token is encrypted before it is stored. The admin chooses whether the synced rows are written in the PunchOp project or in a table in their own Google Cloud project.
BigQuery export
If the admin connects a Workspace log export, PunchOp reads the tables they grant. Those logs are Google’s audit records: addresses, message ids, SMTP responses and IP addresses. They are not the mailbox and not the full message.
The export stays in the dataset location the customer already uses. That location can be outside the European Union.
The investigation reading
A discovery report, and a later analysis when one is included, sends the text needed for that reading to Google Cloud Vertex AI in the EU, so the report can be written. The discovery report shown before a subscription hides addresses, message ids and IP addresses. Domains stay readable.
PunchOp’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell this data, we do not use it for advertising, and we do not transfer it except to the processors below, for security, to comply with the law, or with the administrator’s agreement.
People at PunchOp do not read a customer’s Google data except for security, to comply with the law, or when that administrator asks for help on a specific case.
Where the records live
Organisation, membership and billing records are in Cloud Firestore, EU multi-region (eur3). The application and this website run on Cloud Run in europe-west1. Payment is handled by Stripe. The form at /pilot/ is stored in Cloud Storage in the European Union.
We keep an organisation’s records while the account exists. Write to privacy@punchop.com to ask for deletion of the organisation, the sealed token and the rows we stored from a sync.
This website
punchop.com is separate from the application. The form at /pilot/ asks for a name, a work email, a role and an outline. Do not send credentials, raw logs or message bodies.
The site can load Google Analytics with IP anonymisation. That measurement is not Google Workspace data.