“Do you attest that you will retain data collected through your Zoom integration only for as long as necessary to perform your Zoom integration’s functions or other purposes you have disclosed? If not, explain why.”
What does this question mean?
What does “as long as necessary” mean?
If a user uses Google OAuth sometimes, and Zoom OAuth other times, do we need to wipe their data when they remove our app from their Zoom apps? What if they intended to continue using as a Google user?
Data should only be retained for as long as necessary to perform the service. This question is intended to confirm this with the developer by asking them to attest that this is accurate for their app offering. If a developer cannot attest, we ask them to explain why they retain data for longer than is necessary for the use case described.
‘As long as necessary’ to perform the app’s functions and other purposes the developer has disclosed.
If an app is removed by the user and the associated data is no longer required to perform the service, the data should be removed and handled in line with what the app developer discloses to its users in its privacy statement and/or other documentation.
The questions are intended to be specific as possible yet broad enough to cover the range of app submissions we may receive
Please let me know if you have further questions or suggestions for clarity.
Hi Abe,
Thank you for the reply, but I’m still a bit confused.
We are a standalone Meeting SDK app, that offers Zoom, Google and Microsoft OAuth as login options.
Our users are primarily organized as teams/companies, but you can also be an individual without a team.
The data we obtain from Zoom is the user’s names and emails, for identifying them.
We offer users the option to delete their data by explicit request, but we cannot consider removing our Zoom integration from their Zoom account as an explicit request, because they can also use our app via Google/Microsoft OAuth and the user is often part of a team, where the manager of the team needs to retain stats and user-generated data that is useless without names attached to it.
So, considering the above:
Should we answer “Yes” to question 12 ? If not, can you please recommend a sensible approach.
You can answer ‘Yes’ to question 12, so long as your privacy statement or other documentation makes it clear to the user that there is a separate method of requesting account termination and you confirm that you delete their data at that point.