Google API Services User Data

1. What Booksolut is and why Calendar is used

Booksolut is appointment-scheduling software for service businesses (salons, clinics, gyms, professional practices, and similar). An owner or administrator can connect Google Calendar so Booksolut appointments appear on their Google agenda and update when they are rescheduled or cancelled.

• The connection is optional and starts only when the user clicks “Connect Google Calendar” in their dashboard.
• Booksolut does not access any calendar until Google shows the consent screen and the user grants permission.
• Each business authorizes its own Google account. Booksolut does not use a shared account to read customer calendars.
• The same flow exists for business administrators. Staff or clients connect their calendar only if the business enables that feature and they accept it.

2. OAuth scope requested

Booksolut requests a single sensitive Calendar scope:

https://www.googleapis.com/auth/calendar

This scope is required because the Calendar API needs calendar (not only calendar.events) to list the user’s calendars and let them choose where Booksolut appointments are written. Specifically we use:

• GET /calendar/v3/users/me/calendarList — list calendars so the user can pick a destination.
• GET /calendar/v3/calendars/{calendarId}/events — read events on the chosen calendar for two-way sync.
• POST / PUT / DELETE .../events — create, update, or delete the event that corresponds to a Booksolut appointment (new booking, reschedule, cancellation).
• OAuth 2.0 with access_type=offline to obtain a refresh token so sync can continue without asking the user to sign in for every appointment.

We do not request or use Gmail, Google Drive, Google Contacts, YouTube, or other Google products. We do not read unrelated event content to train models, serve ads, or profile users.

3. Google user data we receive

After consent, Google provides OAuth tokens and, through the Calendar API, the minimum data needed for the agenda feature:

• Calendar identifiers and names (summary) so we can show the calendar picker.
• Events on the chosen calendar: title, time, time zone, description, and the eventId Booksolut stores to update or delete that event later.
• OAuth access and refresh tokens, stored encrypted on our servers and tied to the business or user who connected.
• We do not request the contents of calendars the user did not select as the sync destination, other than listing them so they can choose.

4. Limited Use commitments

Booksolut’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

• We do not use Google user data to serve ads. We do not run advertising, remarketing, ad personalization, or sell audiences built from Calendar data or Google tokens.
• We do not transfer Google user data except: (a) to provide or improve user-facing features (appointment sync); (b) for security; (c) to comply with applicable law; or (d) as part of a merger, acquisition, or sale of assets, with notice to affected users.
• Humans do not read Google user data unless: the user gave affirmative agreement for specific messages; it is necessary for security or abuse investigation; it is required by law; or use is limited to internal operations on aggregated or anonymized data.
• Feature-only use. Calendar data is not used for credit scoring, insurance, employment, housing, or to train general-purpose or third-party AI models.
• No resale. We do not sell information received from Google APIs.
• Subprocessors. Tokens and sync metadata are hosted on Booksolut infrastructure (servers and database). They are not sent to ad networks. Hosting/backup providers may process them only as processors, under contract, to operate the service.

This disclosure supplements our Privacy Policy.

5. Storage and security

We treat Google tokens and event identifiers as sensitive credentials:

• Refresh tokens are stored encrypted in the tenant database, not in plaintext logs or the browser.
• Access to those records is limited to sync processes and platform administrators with an operational need (incidents, support the user requested).
• Communication with Google uses HTTPS. The OAuth callback is https://{domain}/api/google/callback.
• If sync fails, we log operational errors (HTTP status, API message), not the full calendar contents.

6. How to revoke access and delete Google data

The user controls the connection at all times:

• In Booksolut: Settings → Google Calendar → Disconnect. That deletes stored tokens and stops creating or modifying events.
• In Google: myaccount.google.com/permissions → remove Booksolut. Tokens will stop working.
• Events Booksolut already created remain in Google until the user deletes them there or uses Booksolut’s option to remove synced events, if available.

To delete the rest of a Booksolut account, see Data Deletion.

7. Contact

Questions about this disclosure, Limited Use, or data received from Google: