Privacy Policy — BBCgo

Last updated: 10 September 2026 · versión con el diseño de la app

Data controller: LUIS JULIAN RUEDA HERNANDEZ · NIF 52365585J · Calle Venezuela, 8, 28220 Majadahonda (Madrid), Spain · julian.herbalife@gmail.com · https://nutriclub.es/

BBCgo is a management application for healthy-breakfast clubs. Club owners and coaches use it to manage members, appointments, attendance, sales and shifts. Connecting Google Calendar is optional and only happens when a coach presses "Conectar Google Calendar" and explicitly grants the permissions on Google's consent screen.

English

1. What Google user data the application accesses

Email address of the connected Google account (scope https://www.googleapis.com/auth/userinfo.email), to show which account is linked.
Basic profile information — name and public picture (scope https://www.googleapis.com/auth/userinfo.profile) — to identify the account in the settings screen.
Calendar read access (scope https://www.googleapis.com/auth/calendar.readonly): date, time and duration of existing events, in order to know which time slots are busy.
Calendar events (scope https://www.googleapis.com/auth/calendar.events): create, update and cancel only the events that correspond to appointments managed in BBCgo.

2. How the application uses Google user data

Display the connected Google account in the settings screen.
Block, in the club agenda and in the public booking link, the time slots already busy in the coach's calendar, to prevent double bookings.
Create, update or cancel a Google Calendar event for each appointment created, modified or cancelled in BBCgo.

Google user data is never used for advertising, commercial profiling, resale, or to train artificial-intelligence models. No human reads the content of the user's events, except where strictly necessary with the user's explicit consent to resolve a support issue, for security purposes, or to comply with applicable law.

We do not sell, rent or disclose Google user data to third parties for commercial, advertising or analytics purposes. Data is transmitted only:

To Google's own APIs, in order to provide the service requested by the user.
To the infrastructure providers that host and run the application on behalf of the controller, bound by data-processing agreements and with no right to use the data for their own purposes.
To competent authorities, where legally required.

A coach's Google data is never shared with other clubs or other users of the application: only the coach sees their own connected account, and the rest of the club only sees the slot as busy, never the event content.

4. How we protect sensitive data

All traffic is encrypted in transit via HTTPS/TLS.
Google access and refresh tokens are stored encrypted (AES-GCM) and are only reachable from the server; they are never sent to the browser nor displayed in the interface.
Data is stored in databases encrypted at rest, with strict per-club isolation enforced by row-level security policies.
Access is restricted by authentication and by role: each user only sees the data of their club and of their level of responsibility.
We request the minimum set of scopes required for the features described, and administrative access is logged.

5. Retention and deletion of Google user data

Google credentials are retained only while the connection remains active.
Availability information read from the calendar is used at query time and is not stored permanently.
When the user presses "Desconectar" in settings, we revoke access with Google and immediately delete the stored credentials.
The user may also revoke access at any time at myaccount.google.com/permissions.
When an account or a club is deleted, all associated data — including Google credentials — is erased within a maximum of 30 days, unless a legal retention obligation applies.
Deletion can also be requested by writing to julian.herbalife@gmail.com; we respond within 30 days at most.

6. Artificial intelligence and machine learning

BBCgo does not use artificial-intelligence or machine-learning models, neither its own nor third-party hosted ones.
We do not integrate any AI provider, either directly or through gateways, aggregators or model hubs.
Google user data (the connected account email and calendar availability) is never transferred or made available to any AI service, whether raw, aggregated or anonymised.
No Google user data is used to create, train, fine-tune or improve AI models, our own or those of third parties.
The optional connector that allowed external assistants to query club data has been removed from the application; it never transmitted Google Calendar data.

Limited Use disclosure

BBCgo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, BBCgo does not use, transfer or sell Google user data — raw, aggregated, anonymised or derived — to develop, train or improve artificial-intelligence or machine-learning models.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to julian.herbalife@gmail.com. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Español

1. A qué datos de Google accede la aplicación

Dirección de correo electrónico de la cuenta de Google conectada (userinfo.email), para mostrar qué cuenta está vinculada.
Datos básicos del perfil —nombre y foto pública— (userinfo.profile), para identificar la cuenta en los ajustes.
Lectura del calendario (calendar.readonly): fecha, hora y duración de los eventos existentes, para saber qué franjas están ocupadas.
Eventos de calendario (calendar.events): crear, modificar y cancelar únicamente los eventos de las citas gestionadas desde BBCgo.

2. Cómo usamos los datos de Google

Mostrar en los ajustes la cuenta de Google conectada.
Bloquear en la agenda y en el enlace público de reservas las franjas ya ocupadas, para evitar dobles reservas.
Crear, actualizar o cancelar en Google Calendar el evento de cada cita creada, modificada o cancelada en BBCgo.

No usamos los datos de Google para publicidad, perfiles comerciales, venta ni entrenamiento de modelos de inteligencia artificial.

3. Con quién compartimos, transferimos o divulgamos los datos de Google

No vendemos, cedemos ni divulgamos los datos de Google a terceros con fines comerciales, publicitarios ni de análisis. Solo se transmiten a las propias API de Google, a los proveedores de infraestructura que alojan la aplicación (con contrato de encargado de tratamiento) y a las autoridades competentes cuando exista obligación legal. Los datos de Google de un coach no se comparten con otros clubes ni con otros usuarios.

4. Cómo protegemos los datos sensibles

Todo el tráfico viaja cifrado mediante HTTPS/TLS.
Los tokens de Google se almacenan cifrados (AES-GCM) y solo son accesibles desde el servidor.
Bases de datos cifradas en reposo, con aislamiento estricto por club mediante seguridad a nivel de fila.
Acceso limitado por autenticación y por rol; se registran los accesos administrativos.
Se solicitan los permisos mínimos necesarios.

5. Conservación y eliminación de los datos de Google

Las credenciales se conservan únicamente mientras la conexión está activa.
La disponibilidad leída del calendario se usa en el momento y no se almacena.
Al pulsar «Desconectar» se revoca el acceso ante Google y se eliminan de inmediato las credenciales.
También puede revocarse en myaccount.google.com/permissions.
Al eliminar la cuenta o el club, todos los datos asociados se borran en un máximo de 30 días, salvo obligación legal.
Puede solicitar la eliminación en julian.herbalife@gmail.com; respondemos en 30 días como máximo.

6. Inteligencia artificial

BBCgo no utiliza modelos de inteligencia artificial ni integra ningún proveedor de IA, directamente o mediante pasarelas o agregadores. Los datos de Google nunca se transfieren a servicios de IA ni se usan para entrenar modelos.

Consulta también el Aviso Legal, las Condiciones del Servicio y la Política de Cookies.