OSAM Bookings is a WordPress booking plugin made by OSAM Websites LTD. Businesses can connect their Google Calendar to it through our connector service at connect.osamweb.com. When a business connects a Google account, we access:
- the Google account’s email address, to show which account is connected;
- the list of calendars in the account (names and IDs), so the business can choose which calendars to use;
- calendar events. We create, update and delete events for the business’s own bookings. We also read only the start and end times of events in the calendars the business chooses, so those times can’t be booked. We don’t store the titles, descriptions, attendees or locations of those events.
This data is only used to provide the calendar sync. We don’t sell it or use it for advertising, and we don’t share it with anyone except the business’s own website. We don’t use it to develop, improve or train artificial intelligence or machine learning models. OSAM Bookings’ use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
How we protect Google user data
- All data sent between Google, our connector and the business’s website goes over encrypted HTTPS (TLS) connections.
- Access to the calendar is kept as a refresh token, stored encrypted (AES-256) in the business’s own WordPress database. Access tokens are short-lived (about an hour) and are never shown in web addresses or in the browser.
- Our connector service doesn’t store any calendar data. During sign-in it holds the tokens encrypted for up to 5 minutes, until the business’s website collects them, and then deletes them. Only allowed websites can use the connector.
- Only administrators of the business’s website and authorised OSAM staff can access the connection settings. Our servers are kept updated and access to them is restricted.
How long we keep Google user data and how to delete it
- The busy times read from Google Calendar are refreshed about every 10 minutes and deleted automatically after no more than 24 hours.
- The encrypted token, the connected email address and the IDs of calendar events created for bookings are kept only while the calendar stays connected.
- When a business clicks Disconnect in OSAM Bookings, we revoke the access at Google and delete the token and all cached calendar data straight away. Uninstalling the plugin deletes all of its data.
- Anyone can remove access at any time at https://myaccount.google.com/permissions. The connection then stops working and the data is deleted when the business disconnects or removes the plugin.
- Our connector keeps a short log of connections (the website’s domain, the provider and the time, with no calendar data). Only the latest 200 entries are kept.
- To ask us to delete any data, email techteam@osamweb.com. We’ll delete it within 30 days and confirm when it’s done.