Privacy Policy

• Your name and email address
• Your answers to the booking questions
• The meeting time and your timezone
• Your IP address, used for security and abuse prevention only

We use this information to schedule the meeting, send confirmations and reminders, and share the booking with the host you are meeting.

Hosts can connect one or more Google accounts to PeakBook, from their PeakBook setup page or from PeakBook's calendar settings. PeakBook asks Google for three permissions: your basic profile, read access to your calendars, and access to create and change calendar events. This section explains exactly what PeakBook does with them.

What PeakBook accesses and why

• Your basic profile (name and profile photo). When you connect from PeakBook's calendar settings, your photo is used as the picture on your booking page. It is not used for anything else.
• Your list of calendars. PeakBook shows it on your setup page so you can choose which calendars to check for conflicts and which calendar new bookings go to. The ID of your primary calendar, which is your Google account email address, tells PeakBook which account is connected.
• The free and busy times on the calendars you tick. PeakBook checks them whenever someone looks for a time on your booking page, so nobody can book you when you are busy. PeakBook only sees when you are busy. It does not read the titles, descriptions, locations or attendees of your events.
• The events of your PeakBook bookings. When someone books, reschedules or cancels a meeting with you, PeakBook creates, updates or deletes that event in the calendar you chose, with a Google Meet link when the meeting is held on Google Meet. PeakBook never changes or deletes any other event.

What PeakBook stores

• The access and refresh tokens Google issues, so PeakBook can keep checking your availability without asking you to sign in again
• Your Google account email address
• Which calendars you ticked, and the calendar you chose for new bookings
• For each booking, the ID of the calendar event PeakBook created and its Google Meet link
• Your profile photo, if you connected from calendar settings

Your busy times are used at the moment they are needed and are not stored.

Who we share it with

• The Google Meet link and the booking details go to the person who booked, in their confirmation email, reminder emails and calendar invitation, so they can join the meeting.
• Our service providers process Google user data only to run PeakBook. Hetzner hosts the servers and database where it is stored. Resend delivers the booking emails that contain the Meet link.
• PeakFlow keeps a record of each booking in its Airtable, for the client the host works with. The record holds the event type, the host's name, the booker's name and email address, the meeting times and timezones, the booking status, the answers to the booking questions, whether the meeting took place, and the meeting link. Airtable never receives Google tokens, calendar lists or busy times.
• We do not transfer Google user data to anyone else, except when it is needed for security (for example, to investigate abuse), to comply with the law, or as part of a merger, acquisition or sale of assets, and in that last case only after asking for your consent.

What we never do with Google user data

• Sell it, or transfer it to advertising platforms, data brokers or information resellers
• Use it to serve ads, including retargeting, personalised or interest-based ads
• Use it to decide creditworthiness or for lending
• Use it to create, train or improve artificial intelligence or machine learning models
• Let a person read it, unless you ask us to for support and agree to it, it is needed for security (for example, to investigate abuse), or the law requires it

How we protect it

Google user data is stored in PeakBook's database on PeakFlow's own servers at Hetzner in Germany. It only travels over encrypted connections (HTTPS/TLS). Access to the servers and the database is limited to PeakFlow's administrator.

Limited Use

PeakBook's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Hetzner (Germany): application servers and database
• Resend: delivery of booking emails
• Airtable: booking records, including meeting links

Some providers may process data outside the EU. Where that happens, it is covered by standard contractual clauses or an equivalent safeguard.

• Bookings, including the calendar event ID and Meet link stored with them, are kept for the duration of the client engagement plus 12 months, then deleted
• When a host removes a Google account on their PeakBook setup page, PeakBook immediately deletes that account's stored tokens and calendar settings: the account email, the calendars you ticked and the calendar you chose for new bookings. PeakBook does not revoke the permission at Google; you can do that at any time at myaccount.google.com/permissions
• When a client engagement ends, PeakFlow deletes that client's host accounts

Email madalena@getpeakflow.studio to request a copy of your data, a correction, or deletion. Hosts and clients can ask us to delete their PeakBook account and all Google user data we hold for it. We delete it within 30 days of the request.

Removing a Google account on your PeakBook setup page deletes the data described above, but it does not remove PeakBook from the list of apps connected to your Google Account. To end PeakBook's access on Google's side as well, remove PeakBook at myaccount.google.com/permissions. You can do this at any time.

PeakBook uses session cookies only, which are needed for the service to work. There are no advertising or tracking cookies.

If you are in the EU or EEA, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. Our legal bases are performance of a contract (providing the scheduling service) and legitimate interest (security). You may also lodge a complaint with the Portuguese data protection authority, CNPD (cnpd.pt), or your local authority.

If this policy changes, we will post the new version here with a new effective date.