1. Who we are
Co-Biz-Manager (the "Service", at https://cobizmanager.app and in our Android app) is operated by Kl8TechGroup ("we", "us", "our") in Australia. The Service is practice-management software for health, beauty and wellness businesses: appointments and online booking, client records, staff, payments, expenses and reports. This policy explains what information we collect, how we use it, and your choices, including for information we receive from Google APIs.
2. Information we collect
- Account information: your name, email address and password (stored as a hash), or, if you use Sign in with Google, your Google name, email address and profile picture.
- Business information you enter: business details, services, staff, bookings, client records, payments, expenses and similar records you or your team add to the Service. For client records, the business using the Service is responsible for having its clients' consent.
- Google Calendar data (only if you connect it): the events in your primary Google Calendar for the date range being viewed.
- Technical information: server logs (IP address, device and browser details, time of request) used for security and troubleshooting.
3. How we use Google user data
Co-Biz-Manager requests access to Google data only for these features, and only when you choose them:
- Sign in with Google (openid, email, profile): to create your account and sign you in. Your email identifies your account; your name and picture are shown in the app.
- Google Calendar (calendar.events): to show your Google Calendar events next to your Co-Biz-Manager bookings so you can see when you are busy and avoid double-booking; and, when you ask it to, to create, update or delete events in your calendar for bookings made in Co-Biz-Manager and for your business trading hours. We do not change or delete events that Co-Biz-Manager did not create unless you choose to do so in the app.
Co-Biz-Manager does not request any other Google scopes. Calendar events are read from Google when you view them and are not kept in our database. We store the OAuth access and refresh tokens (and the list of granted scopes) Google gives us, so the connection keeps working without asking you to sign in again.
4. Google API Services: Limited Use disclosure
Co-Biz-Manager's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We use Google user data only to provide and improve the user-facing features described above.
- We do not sell Google user data.
- We do not use or transfer Google user data for advertising, including retargeting or personalised ads.
- We do not use Google user data to determine creditworthiness or for lending purposes.
- We do not use Google user data to develop, improve or train generalised AI or machine-learning models, and we do not send it to AI services.
- We do not allow humans to read Google user data, unless you give us permission (for example for support), it is needed for security purposes (such as investigating abuse), to comply with the law, or it is aggregated and anonymised for internal operations.
- We transfer Google user data to others only as needed to provide the Service (our hosting provider), to comply with the law, or as part of a merger or acquisition with notice to you.
5. Other uses of your information
- To provide the Service: sign-in, bookings, reminders, receipts, reports and the other features you use.
- To send service emails and messages (for example booking confirmations and reminders) that you or your business set up.
- To process subscription payments through our payment provider (Stripe). We do not store full card numbers.
- To keep the Service secure, prevent abuse and fix problems.
We do not sell personal information.
6. Sharing
We share information only with service providers that help us run the Service (such as our web hosting and database provider, Stripe for payments, and email and SMS delivery providers), when you ask us to (for example by connecting an integration), or when required by law. Google user data is shared only as described in section 4.
7. Storage and security
Data is stored on our hosting provider's servers. All traffic to and from the Service uses HTTPS. Google OAuth access and refresh tokens are kept on our server only, are encrypted at rest (AES-256-GCM) in our database, are never sent to your browser or shown to other users, and access to the database is restricted.
8. Your choices, retention and deletion
- The salon owner or an admin can disconnect Google Calendar at any time in Settings → Connections. Disconnecting revokes Co-Biz-Manager's access at Google and deletes the stored Google tokens from our database straight away.
- You can also remove Co-Biz-Manager's access to your Google account at any time at myaccount.google.com/permissions. After that we can no longer read or change your Google data.
- To have your stored Google tokens, or your whole account and its data, deleted, email ktb@kl8tech.group from the email address on your account. We delete it within 30 days, except where we must keep records by law (for example tax records).
- We keep account and business data while your account is active.
- You can ask us for a copy of your personal information or to correct it.
9. Changes
We will update this page when our practices change and change the "Last updated" date. For significant changes we will tell account holders by email or in the app.