{
  "version": "2026-10-15-google-data",
  "effectiveDate": "October 15, 2026",
  "authoredBy": "DotWin",
  "title": ".win Google data notice",
  "sections": [
    {
      "id": "google-service",
      "heading": ".win, Google sign-in and build-review booking",
      "body": [
        ".win is the website and application building service operated by DotWin LLC at Entrepreneurs.win. You can verify your email, submit a business brief, follow your build, review a private website preview and arrange a call with our team. This notice supplements the portfolio privacy policy below for .win's Google sign-in and staff calendar connection. It does not authorize unrelated portfolio services to access your Google information."
      ]
    },
    {
      "id": "google-access-use",
      "heading": "Google information we access and why",
      "body": [
        "If you choose Continue with Google, our authentication service receives your Google account identifier, email address, email-verification status and basic profile information that Google provides, such as your name and profile picture. We use this information to verify your identity, sign you in and associate your .win profile with your build request. We do not receive your Google password. You can also sign in with an email link.",
        "Calendar access is a separate connection authorized by DotWin staff. It is not required from customers to request a build or book a call. The connection reads free/busy time intervals for the team's host calendars to offer available appointments. Free/busy access does not provide the titles, descriptions, guests or contents of unrelated personal calendar events.",
        "The calendar connection can create a dedicated booking calendar and read, create, update or delete events on calendars the application creates. We use it for build-review appointments and Google Meet links. Appointment information includes the customer's email address, the assigned host, the appointment time, a meeting link and internal identifiers used to match the appointment to its build request. We do not request access to Gmail messages, Google Drive files or Google Contacts for these features."
      ]
    },
    {
      "id": "google-sharing",
      "heading": "Who receives Google and appointment information",
      "body": [
        "Google processes the identity and calendar requests. Supabase provides authentication and database storage; Vercel hosts the application and its server processing. These providers process information needed to operate these features. Authorized DotWin staff can access relevant lead and appointment records for build review, scheduling and support. Customers receive available appointment times, not another host's personal event details.",
        "When an appointment is booked or cancelled, Google receives the appointment details and sends calendar invitations or updates to the customer and assigned host. Appointment participants can see information included in their invitation, including attendee email addresses and the meeting link. Do not put sensitive personal information into a build brief or calendar invitation.",
        "Google user data from these features is not sold, used for targeted advertising or used to develop, improve or train generalized or non-personalized AI or machine-learning models. Any sharing is limited to providing these features, security, legal requirements and permitted transfers under Google's API Services User Data Policy."
      ]
    },
    {
      "id": "google-storage",
      "heading": "Storage, protection and retention",
      "body": [
        "Google identity details and appointment records are stored in our access-controlled Supabase database. Connections to Google and our services use HTTPS. The staff calendar refresh credential is encrypted in Supabase Vault and retrieved only by authorized server processing; it is not exposed to customers or included in their browser pages. Access tokens are used by the server to make authorized Google requests.",
        "The latest free/busy snapshot is refreshed regularly and is used to offer appointments only while it is fresh. Calendar identifiers and the encrypted refresh credential are retained to maintain the staff connection until it is removed. Identity and appointment records are retained while needed to provide the service and handle support, security or legal obligations, subject to the retention and deletion rules in the portfolio policy below. Revoking Google access does not automatically delete existing .win records or calendar invitations."
      ]
    },
    {
      "id": "google-choices",
      "heading": "Revoke access or request deletion",
      "body": [
        "You can review or revoke .win's Google permissions through the third-party connections page in your Google Account. Revocation prevents further authorized access through that grant; it does not cancel a previously booked appointment. Use DotWin's appointment controls or contact us for booking changes.",
        "To request access, correction, removal of a calendar connection, or deletion of Google-derived information held by .win, email privacy@dotwin.win from the relevant account address. Include enough information to locate the account or appointment, but never send a password or authorization token. We may verify your identity and retain limited records where required for security, legal obligations or disputes, as explained below."
      ]
    }
  ]
}