Privacy Policy / Política de Privacidad
Last updated / Última actualización: February 1, 2026 / 1 de febrero de 2026
📋 Google User Data Disclosure — Quick Navigation
This privacy policy complies with the Google API Services User Data Policy and Google APIs Terms of Service. Jump directly to:
1. Data Controller / Responsable del tratamiento
The data controller for personal data collected through this platform is BePlanner (hereinafter, "we" or "the company"). / El responsable del tratamiento de los datos personales recogidos a través de esta plataforma es BePlanner (en adelante, "nosotros" o "la empresa").
- Titular / Owner: Juan Manuel Garrido Aguilera
- DNI: 73433769J
- Domicilio fiscal / Registered address: Paseo Buztintxuri 22 3ºD, 31012, Pamplona, Navarra, España
You can contact us at / Puede contactar con nosotros en: privacidad@beplanner.app
2. Data We Collect / Datos que recopilamos
We collect the following types of information / Recopilamos los siguientes tipos de información:
- Registration data / Datos de registro: name, email address, encrypted password / nombre, correo electrónico, contraseña cifrada.
- Business data / Datos del negocio: business name, tax ID, address, phone / nombre comercial, CIF/NIF, dirección, teléfono.
- Client data / Datos de clientes: information about clients you manage through the platform / información de los clientes que gestione a través de la plataforma.
- Usage data / Datos de uso: access logs, actions performed on the platform / registro de accesos, acciones realizadas en la plataforma.
- Technical data / Datos técnicos: IP address, browser type, device used / dirección IP, tipo de navegador, dispositivo utilizado.
3. Google User Data Disclosure
This section provides a comprehensive disclosure of how BePlanner collects, uses, stores, and protects Google user data when you connect your Google account for Google Calendar integration. This disclosure complies with the Google API Services User Data Policy and the Google APIs Terms of Service.
📥 3.1 Data Accessed
When you connect your Google account to BePlanner, we request access to and collect the following specific types of Google user data:
| Data Type | Description | Purpose |
|---|---|---|
| Google Account Email | Your Google account
email address, retrieved from Google's UserInfo API endpoint (https://www.googleapis.com/oauth2/v2/userinfo)
|
To display which Google account is connected to your BePlanner profile |
| OAuth Access Token | Short-lived authentication token issued by Google OAuth 2.0 | To authenticate API requests to Google Calendar on your behalf |
| OAuth Refresh Token | Long-lived token used to obtain new access tokens without re-authorization | To maintain persistent calendar synchronization without requiring repeated login |
| Calendar List | List of calendars associated with your Google account (IDs, names, metadata) | To allow you to select which calendar to synchronize with BePlanner |
| Calendar Events | Event data from your BePlanner-designated calendar: event IDs, titles/summaries, start/end times, status, and synchronization tokens | To enable two-way synchronization between BePlanner appointments and Google Calendar |
🔐 OAuth Scope — Limited Access
We request the following OAuth scope:
https://www.googleapis.com/auth/calendar.app.created
This scope restricts access only to calendars created by BePlanner. We cannot read, modify, or delete your personal calendars, work calendars, or any pre-existing events. This is the most restrictive scope available for calendar integration functionality.
⚙️ 3.2 Data Usage
We use, process, and handle Google user data exclusively for the following purposes:
Authentication & Authorization
To verify your identity and establish a secure, authenticated connection between BePlanner and your Google account using OAuth 2.0 protocol with PKCE security.
Calendar Selection
To retrieve and display available calendars so you can choose which calendar to use for BePlanner appointment synchronization.
Two-Way Event Synchronization
To create, read, update, and delete events in your designated calendar, enabling seamless synchronization between BePlanner appointments and Google Calendar. This includes processing sync tokens to efficiently detect and apply changes.
Connection Status Display
To show you which Google account is currently connected within the BePlanner interface, displaying your Google email address for confirmation.
🚫 We Do NOT Use Google User Data For:
- Advertising, marketing, or promotional purposes
- User profiling, behavioral tracking, or analytics
- Selling, renting, or monetizing in any way
- Training machine learning or AI models
- Any purpose unrelated to the calendar synchronization functionality described above
🔗 3.3 Data Sharing
✓ We Do NOT Share Google User Data with Third Parties
Your Google data remains within BePlanner's secure infrastructure and is never sold, rented, or disclosed to external parties for any purpose.
Limited exceptions required for service operation:
| Recipient | Data Shared | Purpose |
|---|---|---|
| Google LLC | OAuth tokens, API requests | Required to perform OAuth authentication and Calendar API operations. Data is transmitted directly to Google's servers to execute the operations you request. |
| Amazon Web Services (AWS) | Encrypted data at rest | Our infrastructure provider. Data is stored encrypted on AWS servers in the EU (eu-south-2 region). AWS acts as a data processor under our instructions and has no access to decrypted data. |
Explicit Declarations:
- ✗ We do NOT sell Google user data to anyone
- ✗ We do NOT share Google user data with advertisers or ad networks
- ✗ We do NOT share Google user data with data brokers or resellers
- ✗ We do NOT use Google user data for personalized advertising
- ✗ We do NOT transfer Google user data to any entity not listed above
- ✗ We do NOT allow human employees to access your Google data except in rare cases for technical support with your explicit consent
🔒 3.4 Data Storage & Protection
We implement comprehensive security measures to protect your Google user data:
🔐 Encryption at Rest
OAuth tokens (access tokens and refresh tokens) are stored in an encrypted PostgreSQL database. Sensitive fields use industry-standard encryption algorithms. Database is hosted on secure AWS infrastructure with encryption enabled at the storage level.
🌐 Encryption in Transit
All data transmission uses HTTPS/TLS 1.2+ encryption. Connections to Google APIs are made over secure HTTPS. No unencrypted data is ever transmitted over public networks.
👥 Access Controls
Strict role-based access controls limit data access. Only automated synchronization processes can access OAuth tokens programmatically. Human access requires explicit justification and is logged.
🖥️ Infrastructure Security
Servers hosted on AWS (Amazon Web Services) in EU region (eu-south-2). Regular security updates and patches. Network firewalls and intrusion detection. Automated security monitoring.
🔑 Authentication Security
User authentication via Keycloak (OpenID Connect/OIDC). OAuth 2.0 with PKCE (Proof Key for Code Exchange) for Google authorization. CSRF protection using state parameters.
📊 Minimal Data Collection
We only store the minimum data necessary: OAuth tokens, selected calendar ID, sync tokens, and connection metadata. No unnecessary Google data is retained.
📍 Data Location
All Google user data is stored on servers located in the European Union (AWS eu-south-2 region, Spain). Data is processed in compliance with GDPR and applicable EU data protection regulations.
🗑️ 3.5 Data Retention & Deletion
📅 Retention Period
- Active Integration: Google OAuth tokens and calendar connection data are retained only while your integration remains active and your BePlanner account exists.
- Disconnected Integration: When you disconnect Google Calendar, all OAuth tokens are immediately and permanently deleted from our systems. We may retain your calendar selection preference (calendar ID only) to restore your choice if you reconnect.
- Account Deletion: When you delete your BePlanner account, all associated Google data is automatically and permanently deleted through database cascade operations.
- Inactive Tokens: Tokens that fail authentication (e.g., revoked by user via Google) are flagged and become non-functional immediately.
🗑️ How to Delete Your Google Data
You have multiple options to delete your Google user data from BePlanner:
Self-Service Disconnection (Recommended)
Navigate to Settings → Calendar in your BePlanner account and click "Disconnect Google Calendar". This immediately deletes all OAuth tokens and Google connection data from our systems. Instant deletion, no waiting period.
Email Request
Send an email to privacidad@beplanner.app with subject "Delete Google Data" including your BePlanner account email. We will process your request and confirm deletion within 30 days as required by GDPR.
Account Deletion
Delete your entire BePlanner account. All associated Google integration data (tokens, calendar selections, sync metadata) is automatically and permanently deleted through cascading database operations.
Revoke via Google Account
You can revoke BePlanner's access to your Google account at any time by visiting Google Account Permissions and removing BePlanner. This immediately invalidates all tokens we hold, making them non-functional.
✓ Deletion Guarantee
When you request deletion through any of the methods above, we guarantee that all your Google user data (OAuth tokens, refresh tokens, calendar selections, and sync metadata) is permanently removed from all our systems, including backups, within the specified timeframes. We do not retain any Google user data after deletion.
📜 3.6 Google API Services Limited Use Disclosure
BePlanner's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we confirm that:
- We only use Google user data for the purposes described in this privacy policy
- We do not use Google user data for serving advertisements
- We do not allow humans to read Google user data unless required for security, legal compliance, or with user consent
- We do not transfer Google user data to third parties except as described herein
4. Finalidad del tratamiento
Utilizamos sus datos personales para:
- Gestionar su cuenta de usuario y proporcionar acceso a la plataforma.
- Prestar los servicios contratados de gestión de negocios.
- Enviar comunicaciones relacionadas con el servicio (actualizaciones, mantenimientos).
- Procesar pagos y facturación.
- Mejorar nuestros servicios y la experiencia del usuario.
- Cumplir con obligaciones legales aplicables.
5. Base legal del tratamiento
El tratamiento de sus datos se fundamenta en:
- Ejecución del contrato: para prestar los servicios que ha contratado.
- Consentimiento: cuando nos autoriza expresamente (ej: comunicaciones comerciales).
- Interés legítimo: para mejorar nuestros servicios y prevenir fraudes.
- Obligación legal: para cumplir con la legislación fiscal y mercantil.
6. Conservación de datos
Conservaremos sus datos personales mientras mantenga su cuenta activa o sea necesario para prestarle nuestros servicios. Una vez finalizada la relación, conservaremos los datos durante los plazos legalmente establecidos para atender posibles responsabilidades (generalmente entre 5 y 10 años según la normativa fiscal y mercantil española).
7. Destinatarios de los datos
Sus datos podrán ser comunicados a:
- Proveedores de servicios: hosting, pasarelas de pago, servicios de correo electrónico.
- Autoridades públicas: cuando exista obligación legal.
No vendemos, alquilamos ni cedemos sus datos personales a terceros para fines comerciales.
8. Derechos del usuario
Tiene derecho a:
- Acceso: conocer qué datos personales tratamos sobre usted.
- Rectificación: corregir datos inexactos o incompletos.
- Supresión: solicitar la eliminación de sus datos cuando ya no sean necesarios.
- Oposición: oponerse al tratamiento en determinadas circunstancias.
- Limitación: solicitar la limitación del tratamiento.
- Portabilidad: recibir sus datos en un formato estructurado y legible.
Para ejercer estos derechos, puede contactarnos en privacidad@beplanner.app.
También tiene derecho a presentar una reclamación ante la Agencia Española de Protección de Datos (AEPD) si considera que sus derechos no han sido respetados.
9. Seguridad de los datos
Implementamos medidas técnicas y organizativas adecuadas para proteger sus datos personales contra el acceso no autorizado, la alteración, divulgación o destrucción. Estas medidas incluyen cifrado de datos, control de acceso, copias de seguridad regulares y formación del personal.
10. Cookies
This platform uses only essential technical cookies required for its operation. / Esta plataforma utiliza únicamente cookies técnicas esenciales necesarias para su funcionamiento.
Types of cookies we use / Tipos de cookies que utilizamos:
- Session cookies: To maintain your login session and authentication state.
- Security cookies: To protect against cross-site request forgery (CSRF) attacks.
- Preference cookies: To remember your settings and preferences within the application.
What we do NOT do with cookies:
- We do NOT use third-party tracking cookies.
- We do NOT share cookie data with third parties.
- We do NOT use cookies for advertising or marketing purposes.
- We do NOT use analytics cookies from third-party providers.
11. Modificaciones de esta política
Nos reservamos el derecho a modificar esta política de privacidad para adaptarla a novedades legislativas o jurisprudenciales. Cualquier cambio será notificado a través de la plataforma o por correo electrónico.
12. Contacto
Si tiene cualquier pregunta sobre esta política de privacidad o sobre el tratamiento de sus datos personales, puede contactarnos en:
Email: privacidad@beplanner.app