Digitális Recepciós: Privacy Policy: Google user data

Digitális Recepciós is an AI phone receptionist for small businesses. It is developed and operated by Runios IT Kft. (trading as Rollout IT), 9600 Sárvár, Hunyadi utca 36., Magyarország. This privacy policy explains how Digitális Recepciós accesses, uses, stores, shares, protects, retains and deletes Google user data. Questions and requests: adatvedelem@rolloutit.net. Last updated: 15 October 2026.

We access Google user data in two features only, and only after the user chooses to use them. (1) Sign in with Google (scopes: openid, email, profile): your name, your email address and your Google account identifier. We do not store your profile photo. (2) Google Calendar connection, used by a business on the Calendar tab of the app: the email address of the connected Google account; the list of calendars you can write to (https://www.googleapis.com/auth/calendar.calendarlist.readonly); the busy time intervals of the calendars you select (https://www.googleapis.com/auth/calendar.freebusy), which contain no event titles, descriptions or attendees; and the appointment events that our app itself creates in the calendars you select (https://www.googleapis.com/auth/calendar.events). We do not read the content of any other event in your calendars, and we do not access Gmail, Google Drive, Google Contacts or any other Google service.

We use Google user data only to provide and improve user-facing features that are prominent in the app's user interface: (1) to let you sign in and to show your name and email address in your account; (2) to show which Google account is connected and let you choose the calendars for bookings; (3) to avoid offering appointment times that are already busy in your selected calendars; and (4) to create, move or delete the events for the appointments our assistant books, reschedules or cancels, so that they appear in your Google Calendar. We do not use Google user data for any other purpose.

We do not use Google Workspace APIs, or any Google user data obtained through them, to develop, improve, or train non-personalized AI and/or ML models, including generalized AI and/or ML models. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google user data, raw or derived, is not used to train any AI or ML model, including our own. We do not use self-hosted or offline models, and we do not use AI aggregators or model gateways. How the voice assistant uses your calendar: our own scheduling code uses the busy intervals to work out which appointment times are available. Only these available times, which are derived from your calendar, are given to the assistant so that it can offer them to the caller. They are processed by two AI service providers through their business APIs: OpenAI (API Platform), the language model that conducts the conversation and writes a short summary of the call for the business, and Microsoft Azure AI Speech (EU region), which reads the assistant's replies aloud. Neither provider uses this data to train its models: OpenAI does not train on data sent through its API unless the customer opts in, and we have not opted in; our requests are sent with response storage disabled, and OpenAI may keep API data for up to 30 days for abuse monitoring only. Microsoft does not use customer data sent to Azure AI Speech to train its models. Raw busy intervals, calendar names, calendar events and Google account details are never sent to any AI provider. The speech recognition provider (Deepgram) receives only the caller's voice, never Google user data. The available times offered during a call appear in the call transcript, which is kept as described in our general privacy notice.

We do not sell Google user data, and we do not share, transfer or disclose it to third parties, except: (1) to the providers that host our servers and database, which store it on our behalf and under our instructions only so that we can provide the features above; (2) the available appointment times derived from your calendar, to the AI service providers named in the AI and machine learning section, only so that the assistant can offer them to callers; and (3) when required by applicable law or a valid legal request. We never transfer Google user data to advertising platforms, data brokers or information resellers, or to anyone for training AI or ML models.

Our public website pages use Google Analytics only if the visitor accepts cookies; this page and the logged-in app do not use it. Google user data received through Google APIs (Sign in with Google and Google Calendar) is never sent to Google Analytics or to any analytics or advertising service, and is never used for measurement, marketing or advertising.

Our staff do not read Google user data, except (1) with the explicit permission of the user, to provide support the user has requested; (2) when necessary for security purposes, such as investigating abuse; or (3) to comply with applicable law.

All data in transit, between your browser and our servers and between our servers and Google, is encrypted with HTTPS/TLS. The OAuth refresh token of a connected calendar is encrypted at rest with AES-256-GCM in a separate table, and the encryption key is kept outside the database. Short-lived access tokens and busy intervals are kept in memory only and are never written to the database. Tokens are removed from error messages before logging. The app requires an authenticated login and role-based permissions, so a business can only reach its own data, and connecting or disconnecting a Google account is recorded in an audit log. Security procedures are in place to protect the confidentiality of your data.

Sign in with Google: your name, email address and Google account identifier are kept while your user account exists, and are deleted when the account is deleted. Google Calendar: the refresh token, the connected account's email address and the names of the selected calendars are kept only while the calendar is connected. You can disconnect at any time in the app (Calendar tab, Disconnect account) or in your Google Account at myaccount.google.com/permissions. On disconnect we revoke the token at Google, delete the token and the account email address, and delete the calendar names; we keep only the identifiers of the calendars and of the events our app created, linked to the business's own booking records. Busy intervals are never stored. When a business account is deleted, all of its Google user data is deleted. You can request deletion of your data at any time by writing to adatvedelem@rolloutit.net; we respond within 30 days.

Digitális Recepciós's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use or transfer Google user data for serving advertisements, including personalized, retargeted or interest-based advertisements; we do not sell it to data brokers or provide it to information resellers; we do not use it to determine creditworthiness or for lending purposes; and we do not use it to create databases.

If we change how Digitális Recepciós uses Google user data, we will update this page and its date, and notify the businesses that have connected a Google Calendar by email before the change takes effect.

This policy covers Google user data only. Data from phone calls handled by the assistant (for example transcripts and caller phone numbers) does not come from Google and is described in our general privacy notice, in Hungarian, at voice.rolloutit.net/jogi.