Privacy Policy

• Account details you give us: name, email, and profile information.
• Content you create: events, contacts, messages, and files you upload.
• Data from services you choose to connect, such as your Google Calendar (see below).
• Basic technical logs needed to keep the service secure and working.

Connecting a Google account is optional, and each feature asks separately for the narrowest access that makes it work. Nothing is requested until you start that feature.

On aibuilders.club the consent screen asks for Calendar only. The other integrations below are optional add-ons that are switched off here, and the ones that would read your mail or your contacts run on a separate OAuth client with its own consent screen, so connecting your calendar can never grant them.

• Calendar (calendar.readonly, calendar.events): read your calendar so scheduling shows your real availability, and create or update the meetings and hub events you choose to add.
• Contacts (contacts.readonly): if you choose to import contacts, we read your Google contacts once to create the community contacts you select.
• Drive (drive.file): access is limited to the individual files you pick or that the Hub itself creates. We cannot see the rest of your Drive.
• Gmail (gmail.readonly): used only by a community admin who connects their own mailbox so replies to community mail appear in one inbox. We read message content to display those threads and never send mail from your account.

A fuller, plain-language breakdown of exactly what a connected calendar touches is on Your Google account.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we do not transfer or use Google user data:

• for serving advertising, including retargeted, personalised or interest-based advertising,
• to sell it, or to provide it to data brokers or information resellers,
• to determine credit-worthiness or for lending purposes,
• to train or improve generalised or non-personalised AI or machine-learning models.

We transfer Google user data to others only as needed to provide the feature you asked for, to comply with law, or as part of a merger where this policy still applies. No human reads your Google data except with your explicit consent, for security, or where required by law.

These are the measures actually in place, not a wish list.

• In transit: every connection to the site and the API is served over HTTPS, with plain HTTP permanently redirected and certificates renewed automatically.
• Access control: a role-based permission system decides what each person can read and change, scoped to the community and team they belong to.
• Connected-account tokens stay on the server: the token from a Google or other connection is never sent to your browser. The app can see only whether a connection exists and which account it belongs to.
• Sign-in flows: OAuth connections use PKCE and a single-use, short-lived state value, so a link cannot be replayed or pointed at someone else's account.
• Encrypted at rest: the secrets that would be most damaging to leak, mailbox passwords and stored API keys, are encrypted in the database with AES-256-GCM and are never returned by any query a browser can call. Other data, including community content and connected-account tokens, is stored unencrypted at the application layer and protected by the access controls above.

No system is perfectly secure, and we would rather be specific than reassuring. If you find a security problem, mail admin@aibuilders.club and we will treat it as urgent. AI Builders is run by volunteers, and that is exactly why we would rather hear from you than not.

• To run the community: events, scheduling, messaging, and your profile.
• To send you messages you have asked for or that relate to your activity.
• To keep the platform secure and to fix problems.

Some features send the text you are working on to an AI provider (OpenAI) to produce a result you asked for, such as a draft message or a suggestion. That is processing on your instruction, the content is not used to train that provider's models, and, as stated above, Google user data is never sent for model training of any kind.

We share data only with service providers who help us run the platform (for example hosting, email delivery, and the AI provider named above), and only so they can perform that work for us. We do not sell personal data. We may disclose data if the law requires it.

We keep your data for as long as your account is active, because the community history it belongs to stays useful. We have not set a fixed expiry beyond that, and we would rather say so than publish a period we do not enforce.

You can ask us to delete your account and its associated data at any time by emailing admin@aibuilders.club. Deletion is handled by a person rather than a self-serve button, and we confirm when it is done.

Disconnecting a Google account deletes our stored access and refresh tokens immediately, which ends our access. It does not withdraw the grant on Google's side: to do that as well, remove AI Builders from your Google account permissions.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. Under the GDPR you may also object to processing and complain to your local data protection authority. Contact us and we will help.

If we change what we collect or what we do with it, we update this page and move the date at the top. Where a change materially affects how your data is used, we tell account holders by email rather than relying on you to re-read this page.

Questions about this policy or your data? Email admin@aibuilders.club.