Google API disclosure

Version of 26 October 2026

INFIOO is an operations tool for service businesses: customer messages, bookings, quotes and invoices in one place, with an AI assistant, Fioo, that drafts the work. You can connect your Google account so that INFIOO only offers times you are free, puts bookings in your calendar and, once sending from Gmail is switched on, sends email from your own address. This page sets out exactly what that involves.

Limited Use

INFIOO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

INFIOO does not use data obtained through Google Workspace APIs to develop, improve or train generalized or non-personalized AI or machine-learning models, and the AI providers that process requests for INFIOO are contractually prohibited from using it to train or improve their models.

What INFIOO accesses, and why

Sign in with Google

Permissions requested: openid, email, profile
What INFIOO accesses: Your name, email address and profile photo link.
Why: To create your INFIOO account and sign you in.
What INFIOO keeps: Your name and email in your INFIOO profile. Google Firebase Authentication keeps your name, email and photo link with your login. INFIOO keeps no Google access tokens for sign-in.
AI: Your name can appear when Fioo lists your team, so it knows who is who.

Google Calendar

Permissions requested: https://www.googleapis.com/auth/calendar.events.owned
What INFIOO accesses: The start and end times of events on your primary calendar — INFIOO asks Google for nothing else, so titles, attendees and descriptions never reach it. INFIOO creates, moves and deletes the events for appointments booked in INFIOO.
Why: So that only times you are actually free are offered to customers, and so INFIOO bookings appear in your calendar.
What INFIOO keeps: The id of each event INFIOO created, linked to its appointment. Your other events are read when availability is checked and not stored. Access tokens are encrypted (AES-256-GCM) in INFIOO's database in Frankfurt and deleted when you disconnect.
AI: Only the free time slots computed from your busy times — never anything about the events themselves.

Gmail (send only)

Permissions requested: openid, email, https://www.googleapis.com/auth/gmail.send
What INFIOO accesses: Permission to send email from your Gmail address, and your email address itself. INFIOO cannot read, search, label or delete anything in your mailbox.
Why: So the emails you send your customers through INFIOO can come from your own address. Until sending from Gmail is switched on, INFIOO uses the connection only to show which mailbox is linked.
What INFIOO keeps: Your Gmail address, shown on the Gmail tile. The access tokens are encrypted (AES-256-GCM) in INFIOO's database in Frankfurt and deleted when you disconnect.
AI: Nothing from your Google account reaches an AI model.

How we handle it

How we handle Google user data

We use it only to provide the features above, which you can see and control in INFIOO, and we connect each one only when you choose to.
We transfer it only to provide those features — to Google Cloud, where INFIOO runs, and, as free time slots, to our AI providers and to AI assistants you connect — or for security, to comply with the law, or as part of a merger, acquisition or sale of assets with your explicit prior consent.
No one at INFIOO reads it unless you ask us to for a specific item, it is needed for security (such as investigating abuse), the law requires it, or it is aggregated and anonymised for internal operations.
We never sell it, transfer it to advertising platforms, data brokers or information resellers, use it for advertising of any kind (including retargeting, personalised or interest-based ads), or use it to judge creditworthiness or for lending.
It is encrypted in transit; Gmail and Google Calendar tokens are encrypted (AES-256-GCM) in INFIOO's database in Frankfurt.
Revoking and deleting:Settings → Connections → Disconnect revokes INFIOO's access at Google and deletes the tokens and connection details we hold. You can also remove INFIOO in your Google Account permissions. Deleting your business removes everything else.
Our use follows the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy.

The full picture — every provider, where data is processed, your rights — is in our privacy notice. Questions: hello@infioo.com.

Changes to this document

26 October 2026: Every connection now runs on INFIOO's own registered app with each tool, so the sign-in screen names INFIOO and no connection provider sits in between. Nango is no longer used and leaves the subprocessor list; access tokens are kept encrypted in INFIOO's own database in Frankfurt and deleted when you disconnect. Nothing changes in what each connection reads or does.
25 October 2026: More connections now run through Nango, our connection provider: Outlook, Google Calendar, Outlook Calendar, HubSpot, Pipedrive, Zoho CRM, Square, Mailchimp and Constant Contact join Gmail, Calendly and Acuity. Nango holds their access tokens; Google Calendar tokens move there from INFIOO's own database. Nothing changes in what each connection reads or does.
6 October 2026: One set of documents for the INFIOO software, replacing the older website-services terms. Adds the data processing addendum, the Google API disclosure, How Fioo uses data, acceptable use, cookies, switching and export, and the illegal-content report route; the subprocessor list now names every provider and where it processes data.