Google-connected services privacy policy

Who operates the service

Samuel Bourque operates the Google-connected features described here under the Directed Domains name. For questions or requests about your information, email sam@directeddomains.com.

Scope

This policy covers Google sign-in used by Directed Domains, DX Complete, FCNBC, Seabaeho and sambourque.com, plus the personal Calendar booking connection on sambourque.com. It describes these Google-connected features; it does not replace separate notices for unrelated services.

Information we use

When you sign in with Google, we receive basic account information such as your name, email address and profile image. We use this information to identify you and control access to authorized features. Google sign-in does not grant access to your Gmail, Drive files or Calendar. The personal booking connection described below is a separate authorization by the calendar owner. Sign-in uses session cookies.

For personal meeting booking at sambourque.com, only the configured calendar owner connects a Google Calendar. Visitors do not need a Google account or grant access to their calendars.

The calendar connection checks busy periods, reads events created by the booking service to confirm their status, and creates meeting events and Google Meet links. The permission Google grants covers events on calendars the owner owns; the booking service uses the configured owner calendar. Public visitors see available times, not private event titles or descriptions.

A booking collects the visitor’s name, email address, selected time, duration, time zone and optional note. We use these details to arrange the meeting, send invitations and organizer notifications, and prevent conflicting or abusive bookings. Please avoid sensitive information in optional notes.

Storage and sharing

The sambourque.com booking website runs on Vercel and stores booking records and an encrypted calendar refresh token in MongoDB. Google processes calendar events, invitations and Meet links. Resend processes organizer notification emails, including booking details, and service-outage alerts. Meeting information is shared with the organizer and invited participant as needed to arrange the meeting.

Access is restricted to authorized operators and service providers for these functions, security, troubleshooting, or legal requirements. Technical request information is used for operations and abuse prevention. Rate-limit identifiers are hashed with a secret key.

We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Our use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including its Limited Use requirements.

Retention and your choices

The booking database marks meeting records for automatic deletion 90 days after the meeting ends. Short-lived rate-limit records and outage-alert records expire separately. Calendar events and delivered emails remain in the relevant accounts until removed under those services’ controls; deleting a website record does not delete these copies.

The owner’s encrypted calendar authorization remains stored while the connection is configured. The owner can revoke access in their Google Account’s third-party connections settings. Revocation stops future authorized Calendar access; it does not remove existing meetings or booking records.

Contact sam@directeddomains.com to request access, correction or deletion of information held by the service, or removal of the stored calendar connection. We may need to verify your identity before acting.

Changes

We will update this policy when the described practices change. If we introduce a new use of Google data that requires consent, we will explain it and request the required authorization before using the data that way.