Privacy notice: connecting external calendars

This notice supplements our privacy policy for connecting external calendars to Neurobots (application “Neurobots Calendar”). How the feature works is described on the page Calendar sync for resources. Controller: Neurobots, Inh. Roman Bohatyrov, Nürnberger Str. 81, 90762 Fürth, Germany, email: info@neurobots.tech.

Connecting external calendars (Google Calendar, Microsoft Outlook, Apple iCloud and CalDAV, .ics links)

Neurobots customers can connect an external calendar to individual resources (for example staff members, rooms or equipment). The connection is made by an administrator of the customer or by the staff member the resource belongs to. Its only purpose is to keep bookings in sync with that calendar: busy time in the external calendar blocks booking slots in Neurobots, and bookings made through Neurobots are written as events to a calendar the user selects.

What we access

• Google and Microsoft: the email address of the connected account, the list of its calendars (ID, name, whether it is the primary calendar, write access, time zone) and the events of the calendars the user selects.
• Apple iCloud and other CalDAV servers: the server address, the user name and the app-specific password created by the user; the calendar list and the events of the selected calendars.
• .ics links: the link itself and the events published in it.

From events that Neurobots did not create, we use and store only timing information: start, end, whether the event is all-day, whether it is marked busy or free, whether it was cancelled or declined by the account owner, and the event's technical ID. From Google Calendar we do not request titles, descriptions, locations, attendees, attachments or any other content of such events at all: we ask Google only for the timing information listed above. For Microsoft Outlook, Apple iCloud, other CalDAV servers and .ics links the retrieval cannot technically be limited to timing information; there such content is included in the responses, but we discard it immediately. In no case do we store it, log it, display it or share it.

What we write to your calendar

For each booking Neurobots creates and maintains one event in the selected calendar. It contains the service name, the customer's first name and last-name initial, a short description and the duration of the service, the booking note (phone numbers and email addresses are removed), a link to the admin area (works only after signing in) and a notice that changes must be agreed with the administrator. The event is marked private and has no attendees; no invitations are sent. If such an event is moved or deleted in the external calendar, Neurobots does not change the booking itself; it creates a change request that an authorised person at the customer approves or rejects.

How we use the data

• To calculate free booking slots, prevent double bookings and show busy time in the admin calendar as “busy” (no content, only the name of the calendar provider).
• To create, update and delete the events for bookings.
• For Google and Microsoft, we also query current availability at the moment a booking is made; this result is used only for that check and is not stored.
• The AI employee receives only free time slots and, if a requested time is taken, the start and end of the busy period marked “external”. It never receives the content of calendar events.

We do not use calendar data for advertising, do not sell it, do not build profiles from it and do not use it to train AI or machine-learning models, our own or anyone else's. Neurobots staff can see calendar data only with the customer's explicit consent for a support case, when needed for security purposes (such as investigating abuse), or when required by law.

Storage and security

Data is processed on servers of Hetzner Online GmbH in Germany, in the customer's own instance, separated from other customers. Credentials (OAuth access and refresh tokens, CalDAV passwords, .ics links) are stored encrypted with AES-256-GCM and are never written to logs. All transfers use HTTPS.

Retention and deletion

• We keep busy time only for the window from one day in the past to 180 days in the future. Older entries are deleted on every sync (at least every five minutes while the connection is active).
• When a calendar is disconnected, we immediately delete the credentials, the calendar list, all stored busy time and the mapping of our events. For Google we also revoke the granted access. Microsoft has no revocation of a single token; access can be removed at myaccount.microsoft.com (“Apps”). When disconnecting, the user can choose to also delete the events Neurobots created in the external calendar; otherwise they stay there.
• Access can also be revoked at the provider at any time: Google at myaccount.google.com/permissions, Microsoft as above, Apple by revoking the app-specific password at account.apple.com. Neurobots then stops syncing and notifies the customer.
• Encrypted backups are overwritten after no more than 7 days.
• When the customer's contract ends, the data is deleted together with the instance.

Legal basis

Art. 6(1)(b) GDPR (performance of the contract with the customer who sets up the connection). For resources that are the customer's staff members, we process the data as the customer's processor under Art. 28 GDPR.

Google API Services User Data Policy

Neurobots Calendar's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.