Privacy Policy

Smart Booking Page ("we", "us", "our") provides online booking pages, dashboards, and appointment tools for service businesses. This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have — including specific commitments about how we handle data accessed through Google APIs.

This policy applies to business owners who use our dashboard and to customers who book appointments through a Smart Booking Page public booking page.

Account information — name, email address, password (stored hashed), business profile details, service and availability settings.

Booking and customer information — when a customer books an appointment, we collect the customer's name, email, phone number, appointment details, notes, and booking status.

Google account information — if you choose to connect Google Calendar or sign in with Google, we receive the specific information described in the *Google User Data* section below.

Billing information — subscription plan and status. Card and payment details are collected and processed directly by Stripe; we do not store full card numbers.

Usage and support information — messages you send to support, and basic technical data (such as browser type and IP address) used for security and troubleshooting.

We use the information above to:

• Operate booking pages, dashboards, availability, and service management.
• Send booking confirmations, pending-request notices, cancellations, owner notifications, and appointment reminder emails.
• Synchronize availability and events with Google Calendar when you choose to connect it.
• Process subscription billing through Stripe.
• Respond to support requests.
• Maintain the security, integrity, and reliability of the service.

We do not use your data to build advertising profiles, and we do not sell personal data.

If you connect Google Calendar, Smart Booking Page requests the following Google API scopes, and only those scopes:

• Calendar list readonly (`calendar.calendarlist.readonly`) — to let the business owner view and select which Google Calendar should receive booking events.
• Calendar free/busy (`calendar.freebusy`) — to check existing calendar availability so we can avoid scheduling conflicts and double-booking.
• Calendar events (`calendar.events`) — to create, update, or remove booking-related appointment events in the selected Google Calendar when customers book, reschedule, or cancel appointments through Smart Booking Page.

If you sign in with Google, we separately request only your basic profile (`openid`, `profile`, `email`) to authenticate your account. These sign-in scopes are not used to read or modify your calendar.

How Google user data is used: Google Calendar data is used only to provide user-facing booking and calendar-synchronization features that a business owner has explicitly enabled. This includes selecting a calendar, checking availability, preventing scheduling conflicts, creating appointment events, updating appointment events after approved reschedules, and cancelling/removing appointment events after cancellations.

We never sell Google user data. We do not share Google user data with advertisers, data brokers, or unrelated third parties. We do not use Google user data for advertising, lending, data brokerage, unrelated analytics, or unrelated product features.

We only access what you authorize. Google Calendar access is only active while a business owner has explicitly connected a calendar. You can disconnect Google Calendar at any time from your dashboard settings, which stops future calendar access and removes or deauthorizes the stored calendar access connection as described below.

Our use and transfer of information received from Google APIs to any other app adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Smart Booking Page protects Google Calendar data, OAuth tokens, and other sensitive user data using administrative, technical, and operational safeguards.

• HTTPS/TLS in transit — data transmitted between users, Smart Booking Page, and supported service providers is protected using HTTPS/TLS.
• Secure token handling — Google OAuth access and refresh tokens are stored securely and are not exposed on public booking pages, customer portal pages, or client-side browser code.
• Restricted application access — access to Google Calendar data is limited to authorized application processes that are required to provide calendar sync, availability checking, appointment event creation, appointment updates, and appointment cancellation.
• Production access controls — access to production systems is restricted to authorized personnel or service providers who need access for operations, maintenance, support, security, or legal compliance.
• Server and database protections — Smart Booking Page uses server-side access controls, database access controls, environment configuration protections, and operational safeguards appropriate for the size and scope of the service.
• Customer privacy separation — customers who book appointments cannot access the business owner's Google Calendar data, Google Calendar tokens, or internal dashboard information.

No method of transmission or storage is 100% secure, but we work to protect Google user data and other sensitive information using measures consistent with industry standards.

Smart Booking Page retains Google Calendar connection data only for as long as needed to provide booking, availability, and calendar sync features, maintain security, comply with legal obligations, resolve disputes, or enforce agreements. Google Calendar OAuth tokens are retained only while the Google Calendar connection remains active for the business. Business owners can disconnect Google Calendar from their dashboard settings at any time. When Google Calendar is disconnected, Smart Booking Page stops accessing that Google Calendar and deletes or deauthorizes the stored OAuth access token and refresh token from active systems immediately or within 30 days. Users may request deletion of account data or Google Calendar-related data by contacting [support@innovatetechglobal.com](mailto:support@innovatetechglobal.com). After a verified deletion request, Smart Booking Page will delete or deidentify applicable Google Calendar-related data from active systems within 30 days, unless retention is required by law, security, fraud prevention, accounting, backup integrity, or dispute resolution. Booking records created inside Smart Booking Page may remain as business appointment records while the business account is active because they support appointment history, customer service, dispute resolution, and business recordkeeping. If deletion is requested and deletion is legally and operationally permitted, related booking records will be deleted or deidentified from active systems within 30 days. Residual copies of deleted or deidentified data may remain in routine encrypted backups for a limited period. Backup copies are not used for normal business operations and are removed as backups expire, generally within 90 days. When the applicable retention period expires, Smart Booking Page deletes, deidentifies, or destroys Google Calendar-related data unless continued retention is required by law, security, fraud prevention, accounting, backup integrity, or dispute resolution.

We apply safeguards to protect account, business, booking, customer, billing-status, and support data:

• Encrypted transmission — all traffic to and from Smart Booking Page is encrypted in transit using HTTPS/TLS.
• Secure storage — passwords are stored using one-way hashing; Google and calendar access tokens are stored securely and are never exposed to public booking pages.
• Limited access — only authorized personnel who need access to operate or support the service can access production systems, and access to customer booking data is scoped to the business that owns it.
• Ongoing diligence — we keep dependencies and infrastructure up to date and follow secure-development practices appropriate for the size and scope of the service.

No method of transmission or storage is 100% secure, but we work to protect your information using measures consistent with industry standards.

We retain account, business, and booking data for as long as your account is active, because that data powers your booking pages, dashboard, customer portal, calendar sync, and appointment history.

When you delete your account, your account and business data are removed from active systems where legally and operationally permitted. Residual copies may briefly remain in routine backups until those backups age out, after which they are also removed.

You are in control of your data:

• Disconnect Google Calendar at any time from your dashboard's calendar settings. This deletes or deauthorizes the stored calendar connection and access token so we cannot access your Google Calendar again unless you reconnect it.
• Delete your account from your account settings when available, or request deletion by contacting support.
• Request deletion by email — contact us at support@innovatetechglobal.com and we will process verified deletion requests for your account and associated data, including Google-connected data, unless retention is required by law, security, fraud prevention, accounting, backup integrity, or dispute resolution.

Smart Booking Page does not sell Google user data.

Smart Booking Page does not share Google user data with advertisers, data brokers, or unrelated third parties.

Google user data may be shared only with service providers necessary to operate, secure, host, maintain, or support the app, and only for those limited purposes. Google user data may also be disclosed if required by law, legal process, security, fraud prevention, or to protect rights and safety.

Smart Booking Page's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Smart Booking Page does not use Google Workspace API data to train, develop, or improve generalized artificial intelligence or machine learning models.

Smart Booking Page does not transfer Google Workspace API data to third-party artificial intelligence or machine learning services for model training.

We use a minimal set of cookies:

• Essential cookies — required for login sessions, security (CSRF protection), and remembering basic preferences like cookie consent. These cannot be disabled without breaking core functionality.
• No third-party advertising cookies — we do not use advertising or cross-site tracking cookies.

You can control cookie preferences from the cookie notice shown on our public pages, and you can clear cookies at any time from your browser settings.

We rely on a small number of trusted third-party services to operate Smart Booking Page:

• Google Calendar API — used only for the calendar list selection, free/busy availability checks, and event sync described in *Google User Data* above.
• Google OAuth / Sign-In — used only to authenticate your account when you choose to sign in with Google.
• Stripe — used to process subscription billing. Stripe handles and stores payment card details under its own privacy policy and PCI-compliant infrastructure; we never see or store full card numbers.

Each provider only receives the minimum information required to perform its specific function, and each is bound by its own privacy and data-handling terms.

Depending on your location, you may have rights to:

• Access the personal data we hold about you.
• Correct inaccurate information via your dashboard or by contacting support.
• Delete your account and associated data (see *General Data Deletion* above).
• Export your business and booking data by request.
• Withdraw consent for optional integrations such as Google Calendar at any time by disconnecting them.
• Object to or restrict certain processing by contacting us.

To exercise any of these rights, contact us using the details below. We will respond within a reasonable timeframe.

Questions about this Privacy Policy or your data can be sent to support@innovatetechglobal.com.

We will update this policy from time to time; the "Last updated" date at the top of this page reflects the most recent revision.