Specific and purpose-limited
The connection is optional and host-specific.
A merchant chooses whether to connect a provider for an eligible host. Bookimatic requests only the permissions needed for availability, appointment events and booking-specific online meeting rooms. The provider consent screen shows the requested permissions before authorization.
1. Scope and choice
This notice supplements the ClientAhead Privacy Policy for Bookimatic connections to Google Calendar, Google Meet and Zoom. Each host authorizes their own provider account. A Shopify merchant can use Bookimatic without giving it mailbox, Google Drive, contacts, recordings or transcript access.
Google Calendar and Google Meet share one host connection because Meet conferencing is created through a Calendar event. Zoom is authorized separately. Connection availability is subject to the provider’s authorization controls and the Bookimatic plan and configuration that apply to the merchant.
2. Google data and permissions
Bookimatic requests these Google OAuth permissions for the connected host:
| Permission | Information and purpose |
|---|---|
openid and email | Identify the consenting host, require a verified email address and bind the correct Google account to that Bookimatic staff member. This does not grant mailbox access. |
calendar.events | Create the appointment event, read the same Bookimatic event to recover or verify a write, update it when the booking is rescheduled and delete it when the booking is cancelled or removed through an applicable privacy workflow. Google Meet conferencing is created through the event’s conference data. |
calendar.freebusy | Read busy intervals so Bookimatic does not offer an appointment over the host’s existing commitment. The availability check does not require unrelated event descriptions or attendee lists. |
calendar.calendarlist.readonly | Read the primary calendar identifier, access role, timezone and conferencing capability so Bookimatic can use a writable calendar and determine whether it supports Google Meet. |
3. How Google Calendar and Meet are used
When Google Calendar is connected, Bookimatic can check free/busy intervals and mirror a confirmed appointment to the connected host’s primary calendar. If the merchant selects automatic Google Meet for an eligible online appointment, Bookimatic asks Google Calendar to create a unique conference for that event.
Rescheduling updates the same Bookimatic-managed event and conference. Cancelling removes the event and clears the locally stored customer join link. Google controls the eventual expiry of an old Meet code; Bookimatic does not claim that a previously issued Meet URL becomes unusable immediately.
Bookimatic does not request Google Meet recordings, transcripts or mailbox contents.
4. Zoom data and permissions
Bookimatic requests these Zoom OAuth scopes for the connected host:
| Scope | Purpose |
|---|---|
user:read:user | Identify the consenting Zoom host and prevent a mismatched account from being assigned to the wrong Bookimatic staff member. |
meeting:write:meeting | Create a separate scheduled Zoom room for a confirmed online appointment. |
meeting:read:meeting | Verify the Bookimatic-created room and its customer join URL. |
meeting:update:meeting | Update the existing room when the appointment is rescheduled. |
meeting:delete:meeting | Remove the room when the appointment is cancelled or an applicable privacy-cleanup workflow requires removal. |
5. How Zoom is used
For an eligible confirmed online appointment, Bookimatic creates one scheduled Zoom meeting for the assigned connected host. The customer receives the booking-specific join link through the applicable Bookimatic confirmation flow. Rescheduling updates the existing meeting; cancellation removes it and clears the local customer join link.
The Zoom meeting uses a generic topic and an opaque booking reference rather than the customer’s contact details or intake answers. Bookimatic discards the privileged host start URL. It does not use the Zoom Meeting SDK and does not request or access recordings or transcripts.
6. Storage, isolation and security
Provider account identifiers, event or meeting identifiers and synchronization metadata are stored in tenant-scoped PostgreSQL records so one merchant cannot use another merchant’s connection. OAuth access and refresh tokens and customer meeting join URLs are encrypted server-side with AES-256-GCM and contextual authenticated data. Operational identifiers and synchronization metadata are not represented as individually application-encrypted fields.
OAuth state is short-lived, single-use and bound to the initiating browser, Shopify installation, tenant and staff resource. Google authorization also uses PKCE. Provider tokens are not exposed to browser bundles. Public Bookimatic and provider API traffic uses HTTPS; this notice does not claim an independent security certification or third-party penetration-test report.
7. Sharing, advertising and Google Limited Use
Bookimatic shares information with Google or Zoom only to perform the connected feature, with infrastructure and service providers that help operate and secure Bookimatic, with the authorizing merchant and appropriate booking participant, or where disclosure is required by law or needed to protect people and services.
ClientAhead’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google API data is not sold, used for advertising or used to train Bookimatic’s merchant AI. Calendar data is not passed wholesale into merchant AI. Bookimatic may show the minimum operational connection state or provider result needed for an authorized merchant workflow.
8. Retention, cleanup and deletion
Bookimatic keeps provider credentials and synchronization records while they are needed to operate the connected feature, protect booking integrity, complete authorized retries or cleanup, meet legal obligations and resolve security or support issues. Booking records follow the retention terms described in the company-wide policy and any applicable merchant agreement.
After provider revocation, account closure or a verified deletion request, Bookimatic removes, redacts or de-identifies applicable connection data from active systems through its deletion and cleanup processes, subject to legal, fraud-prevention, security, dispute and backup requirements. Revoking a provider grant and deleting local Bookimatic records are separate actions, so provider removal does not guarantee that every related local record disappears instantly.
To request access, correction or deletion, email [email protected] and identify Bookimatic, the connected provider, the Shopify store and the host account. We verify identity and authority before acting.
9. Remove access and troubleshoot
Remove Google access
- Open your Google Account’s third-party connections page.
- Choose Bookimatic, open the connection details and select Remove access.
- Google stops future authorized access. Bookimatic detects a revoked or expired grant when the connection is next used or refreshed.
Remove Zoom access
- Open Zoom App Marketplace and go to Manage → Added Apps.
- Choose Bookimatic and select Remove.
- Zoom stops future authorized access. Email ClientAhead if you also need a verified local-data deletion request.
Troubleshooting
- Use Reconnect in Bookimatic Settings → Integrations if consent changed, a token expired or the provider account was replaced.
- For Google Meet, confirm the connected primary calendar is writable and reports Google Meet support.
- For Zoom, confirm the assigned host authorized the same account Bookimatic shows as connected.
- If a connection remains unavailable, include the provider, Shopify store, host and the visible error message in a support email. Do not email passwords, tokens or one-time management links.
10. Support, response time and changes
Bookimatic integration and privacy support is available by email at [email protected], Monday to Friday, 9:00 AM to 5:00 PM Pakistan time (UTC+05:00), excluding applicable public holidays. Our target is a first response within two business days.
We may update this notice when provider permissions, Bookimatic behavior or legal requirements change. If a change materially affects connected data use, we will provide any additional notice or choice required by applicable law before using information in the new way.