Privacy Policy

FlashAPT is dispatch software for field-service businesses. A business signs in with Google, connects its Google Calendar, and its office staff use FlashAPT to capture appointments and place them on that calendar. This page describes what the service collects, where it goes, and how to get rid of it.

Two different groups of people appear below. Customers are the businesses that hold FlashAPT accounts. End customers are the members of the public who ring those businesses to book work. FlashAPT holds end-customer details on behalf of the business, and the business decides what is collected and why.

What is collected

Your account

• The email address, name and account identifier supplied by Google when you sign in. No password is ever created, seen or stored — Google performs the authentication.
• Your business name, phone number and timezone, as entered in Settings.
• Your technicians' names, phone numbers, email addresses, vehicles, working hours and home or base addresses, as entered by you.
• Your service prices and service area.

Google Calendar

Connecting a calendar stores an access token and a refresh token issued by Google. Both are encrypted at rest with AES-256-GCM using a key held only in the server environment, never in the database. A copy of the database alone is not enough to reach your calendar.

Calendar events are read live from Google each time a screen needs them and are not copied into the FlashAPT database. What is stored is the identifier of an event FlashAPT created, so it can later be moved, unbooked or deleted. Google Calendar remains the record; FlashAPT is a view onto it.

Appointments and end customers

• The end customer's name, phone number, email address and service address, where entered or dictated.
• Notes about the work, as written or dictated by your staff.
• Geographic coordinates for addresses, so drive times can be calculated.

Dictation

Speech recognition runs in your browser using the browser's own speech interface. FlashAPT never receives or stores audio. Be aware that most browsers implement this by sending audio to their vendor's servers — in Chrome, to Google — under that vendor's privacy policy, not this one. Only the resulting text reaches FlashAPT.

What is not collected

• No advertising or analytics trackers, and no third-party cookies. The only cookie is the one that keeps you signed in.
• No payment card details. When billing is active, card details go directly to Stripe and FlashAPT never sees them.
• No audio recordings.
• No access to your Google account beyond calendar access and the email, name and profile granted at sign-in.

Who it is shared with

FlashAPT does not sell personal information and does not share it for advertising. Information is passed to these providers only to make the service work:

• Google — sign-in and Google Calendar. Calendar events created, read, moved and deleted on your behalf.
• OpenStreetMap's Nominatim service — addresses are sent to be converted into coordinates.
• The public OSRM routing service — coordinates, not addresses, are sent to calculate drive times.
• Railway — hosting and the database, currently in Amsterdam, Netherlands.
• Stripe — subscription billing, once billing is active. Stripe receives your email address and billing details.

Appointment text is processed on FlashAPT's own servers by a pattern-based extractor. Dictated content is not sent to any external language-model provider. If that ever changes, this page will say so before it does.

Information may also be disclosed where the law requires it, or to protect the service and its users from abuse.

Google user data

FlashAPT's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Calendar data is used only to show your schedule, calculate drive times and create or change the appointments you ask it to. It is not used for advertising, not sold, and not used to train any model.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. FlashAPT does not use any AI or machine-learning model on Google user data. Appointment text is structured by a deterministic pattern matcher running on FlashAPT's own servers, and no Google user data is sent to any third-party AI service or used to develop, improve or train any model.

You can withdraw calendar access at any time, either by disconnecting inside Settings or from your Google account permissions. Withdrawing it stops FlashAPT reading or writing your calendar; appointments already on the calendar stay where they are.

How long it is kept

• Account and appointment data is kept while the account is open.
• Deleting your business removes it, together with its technicians, customers, appointments, settings and stored Google tokens. Deletion is immediate and cannot be undone.
• Disconnecting a calendar deletes the stored tokens for it straight away.
• Coordinates for addresses, and drive times between coordinates, are cached to avoid asking the same question repeatedly. These hold no names or contact details and expire on their own.
• Backups, once in place, may hold deleted data for a short period before ageing out.

Your choices

• See and change what is held about your business, technicians and services in Settings at any time.
• Export a copy of your business data as a file from Settings.
• Delete your business, and everything belonging to it, from Settings.
• Disconnect Google Calendar without deleting your account.

End customers who want their details corrected or removed should contact the business that booked their appointment, which controls that information. FlashAPT will assist that business in acting on the request.

Security

• All traffic is served over HTTPS.
• Google tokens are encrypted at rest with AES-256-GCM.
• Each business's data is isolated: every query is scoped to the signed-in business.
• Sign-in uses Google, so two-factor authentication and account recovery are handled by Google.

No service can promise perfect security. If a breach affects your information, you will be told without unnecessary delay.

Children

FlashAPT is business software and is not directed at children. It should not be used by anyone under 16.

Changes

If this policy changes, the date at the top changes with it. Changes affecting what is collected or who it is shared with will be notified by email to account holders before they take effect.

Contact

Questions, requests and complaints: flashaptsupport@gmail.com.