Privacy policy

Business OS is a private calendar and business tool run by IT Designer for the people on its team. Access is by invitation only. This page explains what information it handles and why.

What we collect

• Your email address and name, so you can sign in and teammates can recognise you.
• If you connect Google: your Google account email, and the permissions you grant (below). We store an encrypted refresh token so the app can keep working without asking you to sign in to Google again.
• A copy of events from the Google calendars you choose to show, kept up to date so the calendar loads quickly.
• Who you have shared your calendar with, at what level, and a log of sharing changes and event changes made through the app.

What we use Google access for

• Calendar (view and edit events, list calendars, free/busy): to show your chosen calendars, to add, change or delete events you or your authorised teammates make in Business OS, and to show calendars shared with you as free/busy.
• Gmail (send only): to email you when a teammate you have given edit access changes your calendar. Business OS cannot read, search or delete any of your email.

Business OS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features described here. It is not sold, not used for advertising, and not used to train AI or machine-learning models. People can read it only as described under “Sharing”.

Sharing

Only you choose who on your team can see your calendars, at one of five levels (from free/busy only up to full editing). Events you mark private in Google are only ever shown to others as “Busy”. Platform administrators can manage who has an account but cannot read your calendar through the app unless you share it with them. We do not share your information with anyone else, other than the service providers that run Business OS (hosting and database), who process it on our behalf.

How it is protected

• Google tokens are encrypted at rest and never sent to your browser.
• Connections use HTTPS. Access is checked on the server for every request.
• Event details a person is not allowed to see are never sent to their browser.

Keeping and deleting your data

You can disconnect Google at any time under Settings. That revokes Business OS's access in your Google account and deletes the stored token and the cached copy of your events. You can also remove access in your Google Account settings. To close your account or have other data deleted, contact us below.

Contact

Questions or requests: eyal@itdesigner.com.au.