Privacy Policy

Scope of this policy

ToniAgent operates two distinct services, with different processing and different roles under the GDPR. Part 1 covers this website, toniagent.com, where Productivity Agents SL is the data controller. Part 2 covers the ToniAgent platform at app.toniagent.com, including the Google Calendar integration, where we act as data processor on behalf of the clinic that contracts the service. Read the part that applies to you.

Part 1 — The toniagent.com website

Data controller

The data controller for your personal data is ToniAgent. You can contact us through our contact form for any questions related to the processing of your data.

Data we collect

We collect personal data that you voluntarily provide through our contact forms, including name, email, phone, and any additional information you choose to share.

Purpose of processing

Your data will be used to: respond to your inquiries and requests, send you information about our services if you have given your consent, manage the business relationship, and comply with legal obligations.

Legal basis

The processing of your data is based on: your consent, the execution of a contract or pre-contractual measures, the legitimate interest of ToniAgent, and compliance with legal obligations.

Data retention

Your data will be kept for the time necessary to fulfill the purpose for which it was collected and to comply with applicable legal obligations.

User rights

You have the right to access, rectify, delete, limit, or object to the processing of your data, as well as data portability. You can exercise these rights by contacting us through our contact form.

Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or destruction.

International transfers

Your data may be transferred to service providers located outside the European Economic Area. In such cases, we ensure that appropriate safeguards exist in accordance with GDPR.

Part 2 — The ToniAgent platform and Google user data

This part applies if you use the ToniAgent platform or connect a Google account to it. It is reproduced from the Terms of Service, Privacy Policy and DPA accepted by our clients, and describes how the platform accesses, uses, stores, shares and deletes Google user data.

ToniAgent's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Reproduced from the ToniAgent platform legal instrument, version 2.0. The binding text is Spanish.

This Privacy Policy describes how Productivity Agents SL ("the Company", "ToniAgent", "we") collects, uses, stores and shares personal information when you use our ToniAgent platform, particularly in relation to third-party integrations such as Google Calendar.

1. Google Calendar Integration

If you choose to connect your Google Calendar account to ToniAgent, we access the following Google user data through the Google Calendar API:

OAuth Scopes Requested:

• calendar.readonly: Read-only access to your list of calendars and events.
• calendar.events: Read/write access to calendar events (used to read events and for the AI agent to book and cancel appointments on your behalf).
• userinfo.email: Your Google account email address.

Specific Data Collected:

1. Google Account Information:

Your Google email address (used to identify and associate your Google Calendar with your ToniAgent account).

2. Calendar Metadata:

Calendar IDs and names, calendar descriptions, time zone settings, calendar colours (background and foreground), primary calendar indicator.

3. Calendar Events:

Event titles (summary), event descriptions, event locations, start and end times (including all-day event indicators), event status (confirmed, tentative, cancelled), organiser email addresses, attendee information (email addresses and response status), recurrence rules (for recurring events), links to events in Google Calendar.

Data Accessed by the AI Agent:

When you interact with the ToniAgent AI assistant for calendar management, the AI agent processes:

• Your voice or text instructions about calendar operations (e.g. "Book a meeting with Juan tomorrow at 3 PM").
• Your existing calendar events, to check availability and avoid scheduling conflicts.
• Event details you provide (meeting titles, attendee names/emails, locations, descriptions).
• Confirmation responses for calendar operations.

This data is processed in order to carry out your calendar management requests and is subject to the same security and privacy protections as other Google Calendar data.

2. How We Use Your Google Calendar Data

We use your Google Calendar data for the following purposes:

1. Displaying Calendar Events:

Showing your calendar events within the ToniAgent application interface so that you can see your schedule alongside your other tasks and activities.

2. Local Synchronisation:

Synchronising and storing your calendar events locally in our database for faster access and better performance. This lets you view your calendar without repeated calls to the Google API.

3. Event Notifications (Optional):

If enabled, we configure webhook notifications from Google Calendar to receive real-time updates when your events change, keeping your synchronised events up to date.

4. Calendar Management by the AI Agent:

When you interact with the ToniAgent AI assistant, the agent may carry out the following actions in your Google Calendar on your behalf and with your explicit authorisation:

• Create new calendar events (book appointments): When you ask the AI agent to schedule a meeting or appointment, it will create a new event in your connected Google Calendar with the details specified (title, date, time, attendees, location, description).
• Cancel existing events: When you ask the AI agent to cancel an appointment, it will update the event status to "cancelled" or delete the event from your Google Calendar.
• Modify event details: When you request changes to an existing event (time, location, attendees), the AI agent will update the event in your Google Calendar.

How AI Agent Modifications Work:

• The AI agent only makes changes when you explicitly instruct it to (e.g. "Book a meeting with Juan tomorrow at 3 PM" or "Cancel my 2 PM appointment").
• All AI agent actions are performed using your authenticated OAuth tokens, which means changes are made as if you had made them yourself.
• You will receive confirmation of calendar modifications through the ToniAgent interface.
• All events created, modified or cancelled are reflected immediately in your Google Calendar and in any other application connected to it.

Important Safeguards:

• Your Google Calendar data is never shared with third-party services beyond our infrastructure provider (AWS).
• Your calendar data is isolated to your account and cannot be accessed by other ToniAgent users.
• The AI agent can only access calendars that you have explicitly connected to ToniAgent.
• We do not use your Google Calendar data for advertising, marketing or any purpose beyond the core calendar integration and AI assistant functionality.
• You retain full control and may revoke ToniAgent's access to your Google Calendar at any time.

3. How We Store Your Google Calendar Data

Database Storage:

Your Google Calendar data is stored in a PostgreSQL database hosted on Amazon Web Services (AWS) in the Ireland region (eu-west-1). We store three types of data:

• Google Account Information: Your Google email address and OAuth tokens (encrypted).
• Calendar Metadata: Calendar names, settings and synchronisation status.
• Calendar Events: Event details, times, attendees and descriptions.

Encryption and Security:

• OAuth tokens (access tokens and refresh tokens) are encrypted at rest using Fernet encryption with AES-256 before being stored in our database.
• Encryption keys are stored securely in AWS Secrets Manager and are never exposed in application code or logs.
• Calendar event data (titles, descriptions, attendees) is stored unencrypted for performance reasons, but access is restricted to authenticated users only.
• All data transmission between your browser, our servers and Google's servers uses HTTPS/TLS 1.2 or higher.

Data Isolation:

• Your Google Calendar data is associated exclusively with your user account.
• Our application enforces strict authorisation controls to ensure that users can only access their own Google Calendar data.
• Administrative users cannot override these controls to access other users' Google Calendar data.

Data Retention:

• Your Google Calendar data is retained for as long as your calendar integration is active.
• When you disconnect your Google Calendar account, we immediately and permanently delete all associated data, including: OAuth tokens, calendar metadata, and all synchronised events (both events created by you and events created by the AI agent on your behalf).
• This deletion is automatic and cascades throughout our database schema.

Important Note About AI-Created Events:

• Events created by the AI agent in your Google Calendar remain in your Google Calendar even after you disconnect ToniAgent. These are your calendar events.
• To remove AI-created events from Google Calendar, you must delete them directly in Google Calendar (either before or after disconnecting ToniAgent).
• Disconnecting ToniAgent only deletes our local copy of the synchronised event data, not the events themselves in Google Calendar.

4. Sharing Your Google Calendar Data

Infrastructure Provider:

We use Amazon Web Services (AWS) as our hosting and database provider. Your Google Calendar data is stored on AWS servers located in the Ireland region (eu-west-1) within the European Economic Area (EEA). AWS acts as a data processor under our Data Processing Agreement (DPA) and is subject to AWS's GDPR-compliant terms.

No Sharing With Other Third Parties:

We do not share your Google Calendar data with any other third-party service, including: analytics providers, advertising networks, marketing platforms, or other integrations (e.g. voice synthesis, telephony services).

Your Google Calendar data is used exclusively within ToniAgent for the purposes described in this policy.

Google as a Data Source:

• When you connect your Google Calendar, you grant ToniAgent permission to access your Google Calendar data through Google's OAuth 2.0 authorisation.
• We access your Google Calendar data using Google's official Calendar API.
• Your relationship with Google and their use of your data is governed by Google's Privacy Policy, available at policies.google.com/privacy .

5. How the AI Agent Accesses Your Google Calendar

AI Agent Capabilities:

When you authorise ToniAgent to access your Google Calendar, our AI assistant can perform calendar management tasks on your behalf, including:

• Reading Your Schedule: The AI agent can view your calendar events to check your availability when scheduling appointments or answering questions about your schedule.
• Creating Events: When you instruct the AI agent (e.g. "Schedule a meeting with Juan on Friday at 2 PM"), it will create a new event in your connected Google Calendar, set the event title, date, time, location and description according to your instructions, add attendees if specified, and send calendar invitations through Google Calendar.
• Cancelling Events: When you instruct the AI agent (e.g. "Cancel my 3 PM meeting tomorrow"), it will find the corresponding event in your calendar, update the event status to "cancelled" or delete the event, and Google Calendar will notify attendees of the cancellation.
• Modifying Events: When you instruct the AI agent (e.g. "Move my meeting to 4 PM"), it will update the event details in your Google Calendar and Google Calendar will notify attendees of the changes.

Important Safeguards:

• The AI agent only acts on your explicit instructions — it will not create, modify or cancel events autonomously without your direction.
• All calendar operations are performed using your authenticated OAuth credentials, which means changes appear as if you had made them yourself in Google Calendar.
• The AI agent can only access calendars that you have explicitly connected to ToniAgent.
• You will receive confirmation of any calendar change through the ToniAgent interface.
• All modifications are synchronised immediately with your Google Calendar and are visible across all your devices and applications.

User Control:

• You may disconnect Google Calendar at any time to revoke the AI agent's access.
• You may select which specific calendars to share with ToniAgent (e.g. share your work calendar but not your personal calendar).
• You may review and manually modify any event created by the AI agent directly in Google Calendar.

6. Your Rights Regarding Google Calendar Data

You have full control over your Google Calendar integration:

Revoke Access at Any Time:

You may disconnect your Google Calendar account from ToniAgent at any time through the Integrations page in your account settings. Disconnecting will immediately delete all OAuth tokens, calendar metadata and synchronised events from our database.

Granular Control:

You may choose which specific calendars to synchronise with ToniAgent. You may disconnect individual calendars while keeping other calendars connected.

Google Account Settings:

You may also revoke ToniAgent's access to your Google Calendar directly through your Google Account settings at myaccount.google.com/permissions . Revoking access through Google will prevent ToniAgent from accessing your calendar data, but you should also disconnect the integration within ToniAgent to delete the locally stored data.

Data Portability:

Your calendar events remain in your Google Calendar at all times. You may export your calendar data directly from Google Calendar using Google Takeout ( takeout.google.com ).

GDPR Rights (EEA Users):

• Right of Access: View all connected Google accounts and synchronised calendar data through your ToniAgent account.
• Right to Erasure: Delete all Google Calendar data by disconnecting your Google account.
• Right to Data Portability: Export your calendar data from Google Calendar directly.
• Right to Restriction: Disconnect individual calendars to stop synchronising specific calendar data.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We will notify you of any material change by publishing the new policy on this page and updating the "Last updated" date at the top.

8. Contact

If you have questions about this Privacy Policy or about how we handle your Google Calendar data, please contact us at:

Productivity Agents SL Carrer Santa Eulalia 5 08195 Sant Cugat del Vallès, Spain Email: support@toniagent.com