Privacy Policy

What Bookpilot is

Bookpilot lets a client book an appointment inside a Telegram bot that is not ours. We do not run that bot, we do not take payments, and we do not store the bot’s token. We show available times, create the booking, and write an event to the specialist’s Google Calendar.

Data we process

From Telegram (the client in the Mini App). Telegram user id and name from signed initData; optional name, email, phone and note the client types; the service, specialist, time and place of the booking.

From Telegram (operators). Identity from Telegram Login when an operator opens the dashboard.

From Google (the specialist who connects a calendar). Email of the Google account; an OAuth refresh token; calendar ids and titles; free/busy intervals; events Bookpilot creates, updates or deletes, including a Google Meet link when the booking is online.

How we use Google user data

We use Google Calendar data only to compute availability and to create, update or delete events for bookings made in the Mini App, including Meet conference data for online appointments. We use the account email to show which Google account is connected.

Bookpilot’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, and we do not sell it.

Storage and sharing

Google refresh tokens are stored encrypted (AES-256-GCM). We do not store tokens of the client’s Telegram bot.

Booking facts (who, when, service, contact the client entered) are sent to webhook endpoints the bot owner configured. We do not send a dump of the specialist’s calendar.

We keep records until deletion is requested, unless a shorter period is required to run the booking.

Access, disconnect, deletion

A specialist can revoke Bookpilot in Google Account → Security → Third-party access, or reconnect from the link we send when access expires. To delete booking or account data, write through the Telegram bot that opened the Mini App or through the operator dashboard.

Public website

Visits to this website (the homepage and this policy) are measured with Google Analytics: which pages are opened, plus the browser and device data the Google tag sends. This is separate from Google Calendar data above.

Contact

Questions about this policy: through the Telegram bot that opened the Mini App, or through the operator dashboard. The support email shown on Google’s consent screen is the same operator.