Application Privacy Policy

This Privacy Policy explains how ToggleBook, operated by ToggleMind ("ToggleBook", "we", "us", or "our"), collects, uses, stores, and shares information when businesses use the ToggleBook platform and when their customers submit bookings or uploads through a ToggleBook-powered booking page.

1. Scope of this Policy

• Business owners, administrators, and staff who subscribe to or manage a ToggleBook tenant account.
• Customers who submit bookings, contact information, payment references, or uploaded receipt images through a ToggleBook-powered booking page.
• Google Account users who authorize ToggleBook to connect to their Google Drive for tenant-owned file storage.

A tenant business may have its own privacy obligations to its customers. Where a tenant determines the purposes for which customer information is collected, the tenant remains responsible for its own notices, lawful basis, retention rules, and customer requests.

2. Information We Collect

2.1 Tenant and business information

• Business name, contact details, business address, operating hours, facility or service configuration, and account settings.
• Administrator or staff account information needed to access and operate the platform.

2.2 Booking and customer information

• Customer name, contact details, booking date and time, selected service or facility, booking notes, amount, payment method, payment reference, and booking status.
• Uploaded files such as payment receipt screenshots or supporting documents, when a tenant enables these features.

2.3 Technical and security information

• Basic logs and diagnostic information that may include timestamps, request details, device/browser information, security events, and error information necessary to operate, troubleshoot, and protect the service.

2.4 Google Drive integration information

• Google account identifiers made available through the authorization flow, such as the account email when provided by Google and required for connection display or management.
• OAuth authorization tokens or related credentials necessary to maintain the tenant-authorized connection. We do not collect or store the tenant's Google password.
• Google Drive file and folder identifiers, file names, file types, file sizes, and other metadata necessary to upload, locate, retrieve, or manage files created or selected through ToggleBook.

3. How We Use Information

• Provide booking, scheduling, payment review, reporting, and tenant administration features.
• Route customer-uploaded receipts and files to the correct tenant-owned storage location when that tenant has connected Google Drive.
• Generate booking reports and exports, including links or references to tenant-owned receipt files where enabled.
• Authenticate users, maintain sessions, prevent abuse, investigate errors, and protect the platform.
• Provide support, respond to requests, and communicate service-related notices.
• Maintain and improve platform reliability, performance, and functionality.

4. Google Drive and Google API Data

Google Drive connection is optional unless a tenant chooses a workflow that requires Drive-based file storage. A tenant connects its own Google Account through Google's OAuth consent process. ToggleBook uses the authorization only to provide the storage and file-management features the tenant has enabled.

When Google Drive is connected, ToggleBook may:

• Create folders used by ToggleBook in the tenant's Google Drive.
• Upload payment receipts and other tenant-authorized files to those folders.
• Read file metadata and retrieve files when needed for tenant-facing functionality, such as viewing a payment receipt.
• Update or delete files created or managed through ToggleBook when the tenant requests or enables that action and the granted Google scope permits it.

Limited use of Google data. We use information received through Google APIs only to provide or improve user-facing ToggleBook features that the tenant has requested. We do not sell Google user data, use it for targeted advertising, use it to build advertising profiles, or transfer it for unrelated purposes. Our handling of Google API data is intended to comply with the Google API Services User Data Policy and its Limited Use requirements.

Human access. ToggleBook personnel do not intentionally inspect tenant Google Drive content except when necessary to provide support requested by the tenant, investigate a security or operational issue, comply with applicable law, or where the tenant has otherwise authorized such access.

5. How Files Are Stored

When a tenant connects Google Drive, the actual uploaded receipt image or document is intended to be stored in that tenant's own Google Drive. ToggleBook may store the file identifier, folder identifier, file name, type, size, upload status, and related booking/payment metadata in its database so the file can be associated with the correct booking.

The tenant retains control of its Google Drive account and its Drive storage. Google's own terms and privacy practices also apply to data stored in Google Drive.

6. OAuth Tokens and Connection Security

• ToggleBook does not request the tenant's Google password.
• OAuth credentials used to maintain a Google Drive connection are treated as sensitive application credentials and are not displayed to end customers.
• Authorization may be revoked by the tenant through Google Account controls or through ToggleBook connection controls when available.
• If Google authorization becomes invalid, ToggleBook may mark the integration as disconnected or requiring reauthorization and request that the tenant reconnect the account.

No security measure can guarantee absolute security. ToggleBook uses reasonable technical and organizational measures appropriate to the nature of the service and continues to improve safeguards as the platform evolves.

7. When We Share Information

We do not sell personal information. We may disclose or process information through service providers only as reasonably necessary to operate ToggleBook, such as:

• Cloud hosting and application infrastructure providers.
• Database providers used to store structured booking and account information.
• Google Drive, when a tenant explicitly connects its Google Account for file storage.
• Email, messaging, analytics, security, or support services enabled by ToggleBook or configured by a tenant.
• Professional advisers or authorities when reasonably necessary to comply with law, enforce agreements, protect rights and security, or respond to lawful requests.

Service providers are expected to process information only for the services they provide to us or the tenant, subject to their applicable terms and data-processing obligations.

8. Data Retention and Deletion

• Booking and account information is retained for as long as reasonably necessary to provide the service, meet tenant-selected retention needs, maintain records, resolve disputes, or satisfy applicable legal obligations.
• OAuth connection credentials are retained only while needed to maintain the authorized integration, subject to applicable operational and security requirements.
• Disconnecting Google Drive stops ToggleBook from using the connection for future access once the authorization is revoked or removed. Files already stored in the tenant's Google Drive generally remain in that Drive until the tenant deletes or moves them.
• A tenant may request deletion of its ToggleBook account data, subject to legal, security, backup, fraud-prevention, or recordkeeping obligations that may require limited retention.

9. Tenant and Customer Choices

• Tenants can choose whether to connect Google Drive and can revoke Google authorization at any time from their Google Account.
• Tenants may contact us to request access to, correction of, or deletion of information associated with their ToggleBook account, subject to applicable limitations.
• Customers of a tenant should normally direct booking-related privacy requests to the business with which they made the booking. ToggleBook will reasonably assist tenants with such requests where appropriate.

10. Data Accuracy and Responsibilities

Tenants are responsible for keeping business and administrator information accurate and for configuring the platform in a manner appropriate for their business. Tenants should avoid collecting unnecessary sensitive information through booking notes, receipt uploads, or custom fields.

11. Children and Minors

ToggleBook is designed for businesses and their booking customers. It is not intended for children to independently create or administer tenant accounts. Where a tenant provides services to minors, the tenant is responsible for obtaining any consent or authorization required for the collection and handling of a minor's information.

12. International Processing

ToggleBook and its service providers may process information in countries other than the user's location. Where applicable, we take reasonable steps to use service providers and safeguards appropriate to the information being processed.

13. Changes to this Privacy Policy

We may update this Privacy Policy when ToggleBook features, integrations, legal requirements, or data practices change. The effective date at the top of this policy will be updated when material changes are published. Where appropriate, we may provide additional notice within the platform or by email.

14. Contact Us

For privacy questions, Google Drive integration concerns, or requests relating to ToggleBook data, contact: