Privacy Policy

Last updated: 22 October 2026 · DriveGate is operated by ElevateX By ZaiD. Questions: support@elevatexbyzaid.com

The short version

DriveGate manages who can open the Google Drive folders you sell. It never downloads, copies, hosts, reads, or sells your files or their contents. Your content stays in your Google Drive, under your Google account, at all times.

What we store

Your DriveGate account: your email address, your name (if you give it), and your password stored only as a salted cryptographic hash — never in plain text.
Your Google connection: if you connect Google Drive, we store an encrypted refresh token so DriveGate can manage sharing permissions on the folders you choose. The token is encrypted at rest and is never shown to anyone, including in our own admin views.
Your products: the names and Drive IDs of folders you register as products, their lock status, and your plan settings.
Your buyers: the email addresses you add as buyers, when their access was granted, when it expires, and whether it was revoked. This is the minimum needed to grant, expire, and revoke their Drive access.
Activity log: a record of access changes (grants, revocations, expirations, lock checks) so you can audit what happened to your folders.
License codes: if you redeem a plan code, we store only a cryptographic hash of the code — never the code itself.

What we never do

We never download, copy, mirror, or host your Drive files.
We never read the contents of your files. DriveGate calls only the Drive permission and file-metadata APIs needed to manage sharing on folders you select.
We never sell, rent, or share your data or your buyers' email addresses with third parties for marketing.
We never use your data to train AI models or for advertising.

Google API disclosure

DriveGate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. DriveGate requests Google Drive access solely to view folder metadata and to create, list, and delete sharing permissions on folders you explicitly select.

Buyers' data

If a creator adds your email address as a buyer, DriveGate stores that email, the product it belongs to, and the access dates — nothing else. The public access checker confirms access status for an email address only against products whose creators registered it; it never reveals folder links or any other information. To have your buyer record removed, contact the creator who sold to you, or email us and we will remove it.

Cookies

DriveGate uses exactly one cookie: a session cookie that keeps you logged in. It contains a random token (only its hash is stored on our servers), it is never used for tracking or advertising, and there are no third-party cookies.

Retention and deletion

Your data is kept while your account exists. If you ask us to delete your account (email support@elevatexbyzaid.com), we delete your account, products, buyer records, and activity log within 30 days. Deleting your DriveGate data never changes the files in your Google Drive itself; Drive sharing permissions you granted through DriveGate remain exactly as they were at deletion time unless you change them in Drive.

You can disconnect Google at any time from your dashboard; that immediately deletes your stored Google token from our database.

Security

Passwords are hashed with PBKDF2 (100,000 iterations — the maximum the platform supports). Google tokens are encrypted at rest. All traffic is served over HTTPS. Login and redemption endpoints are rate-limited. No system is perfect, but protecting this data is the entire point of the product, and we treat it that way.

Changes

If this policy changes materially, we will note the change on this page and update the date above.