Google API Services — Limited Use Disclosure

Last updated: June 2026

SalonBot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access

SalonBot accesses two Google Calendar API scopes:

calendar.events.freebusy — to read busy/free intervals from a master's (beauty specialist's) calendar and prevent double-bookings with external platforms (Booksy, Fresha, etc.).
calendar.events.owned — to create, update, and delete booking events in a master's personal Google Calendar.

How we use the data

Freebusy data is used solely to check master availability before offering time slots to clients.
Calendar events are created to synchronise SalonBot bookings with the master's calendar.
We do not use Google data for advertising, marketing, or profiling.
Google user data is not used to develop, improve, or train generalised artificial intelligence or machine learning models.

How we store the data

OAuth refresh tokens are encrypted with Fernet (AES-128-CBC + HMAC-SHA256) in our PostgreSQL database hosted in the EU.
Freebusy data is cached in Redis for 10 minutes, then automatically deleted.
Only the Google event ID (a string identifier) is stored in our database, linked to the booking record. Event content is not stored separately.

How to revoke access

Masters can revoke SalonBot's access at any time:

Via the SalonBot admin panel (Settings → Disconnect Google Calendar).
Via Google account settings: myaccount.google.com/permissions.

Upon revocation, the refresh token is immediately deleted from our database.

Contact

For questions about our use of Google API data: