Privacy policy
This policy explains how Flowbit S.r.l. ("we"), registered at Piazzale Marcellino Champagnat,2, 00144 Roma (RM), Italia, VAT IT18622241000, processes personal data in the SMS Appointment Reminder Italia service (web dashboard and Google Calendar™ add-on). The Italian version is the legally binding one; this translation is provided for reference and for Google's OAuth verification review.
1. Controller and processor
For account data (the user who signs up) we are the data controller. For end-customer data (names and mobile numbers entered by the business) the business is the controller and we act as data processor under Article 28 GDPR, as set out in our Terms of Service. Privacy contact: privacy@flowbit.it.
2. What Google user data we access
This is the complete list of Google Account data the service accesses, the OAuth scope that makes it available, and why it is needed. We access no other Google data.
| Google user data | OAuth scope | Why it is needed |
|---|---|---|
| Google Account identifier, email address and display name | openid, userinfo.email, userinfo.profile | sign-in, identifying your account and contacting you about the service |
| The list of your Google calendars: identifier, name, time zone, access role | calendar.calendarlist.readonly | letting you choose which calendar holds your customer appointments |
| For the calendars you connect only: event identifier, title, start and end date-time, time zone, status (confirmed, tentative, cancelled) and recurring-series identifier | calendar.events.readonly | scheduling the SMS reminder, writing its text, and rescheduling or cancelling it when the event changes |
| The event currently open in Google Calendar™, while the add-on panel is running | calendar.addons.current.event.read, calendar.addons.execute | showing that appointment's reminder status in the side panel |
| OAuth access and refresh tokens | — | keeping the connection to Calendar working; stored encrypted (AES-256-GCM) and never sent to the browser |
We do not access, under any circumstances:
- event description, location, guests/attendees, attachments and conferencing details
- calendars you have not connected
- Gmail™, Google Drive™, Google Contacts or any other Google service
Access to Google Calendar™ is read-only: the service never creates, modifies or deletes events, calendars or any other content in your Google Account.
2a. Other data we process (not from Google)
- End-customer data entered by the business: name and mobile number. The same data forms the business's address book, used to re-use a customer already entered. The address book is never written to Google and is never populated with data read from Google.
- Text, timing and outcome of the SMS messages sent.
- Business data: name, country, time zone, phone; subscription and billing data.
- Technical security logs (no tokens, keys or calendar content).
3. Purposes and legal bases
- Providing the SMS reminder service: performance of a contract (Art. 6(1)(b) GDPR).
- Security, abuse prevention and service continuity: legitimate interest (Art. 6(1)(f)).
- Tax and accounting obligations: legal obligation (Art. 6(1)(c)).
4. Use of Google user data
Google Calendar™ data is used only to show your appointments in the dashboard and in the add-on panel, and to schedule, update and cancel the SMS reminders you configure. We do not use it for any other purpose.
Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not use Google user data to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models.
5. Who we share Google user data with
We share data only with the providers listed below, which act as our data processors (Art. 28 GDPR) under a contract and solely to deliver the service. No other party receives your data.
| Recipient | Role | Data received |
|---|---|---|
| Hetzner Online GmbH (Germania) | hosting and database infrastructure | all service data, including the calendar data listed above, stored on our behalf |
| BulkGate s.r.o. (Repubblica Ceca) | sending the SMS messages | the customer's mobile number and the message text, which contains the appointment date and time taken from your calendar. Nothing else. |
| Stripe Payments Europe Ltd (Irlanda) | subscription payments | your billing details. It receives no Google user data and no calendar data. |
Beyond these: we do not sell Google user data, do not share it with data brokers, do not transfer it to other applications, and do not use it for advertising or profiling. We may disclose data to an authority only where compelled by a valid legal order, and to a buyer of the business, who would remain bound by this policy.
6. Retention
Appointments and SMS history are kept for at most 13 months from the appointment date and then deleted automatically; address-book contacts no longer in use are deleted on the same basis. When an account is deleted, all data is removed immediately and the Google authorization is revoked, except billing records kept to meet legal obligations.
7. Your rights
You may exercise your rights of access, rectification, erasure, restriction, portability and objection (Arts. 15-22 GDPR). From the Account page you can export your data as JSON and delete your account yourself, which also revokes our access to your Google Account. You may also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
8. Security
Encrypted connections (HTTPS), OAuth tokens encrypted at rest (AES-256-GCM) and never exposed to the browser, per-business data isolation, secure session cookies, rate limiting and security event logging.
9. Cookies
We use only strictly necessary technical cookies (login session and security). Details in our Cookie policy.