Privacy Policy – IQ Kos AI Solutions

1. Information We Collect

Personal-IQ collects only the data necessary to provide and secure the service. This includes:

Google Account Information: Your email address (for authentication) and, if available, your name as provided by Google.
OAuth Credentials: Encrypted Google OAuth tokens (stored using AES encryption via Fernet) that allow Personal-IQ to access your Google Calendar on your behalf.
Calendar Data (Metadata only): Calendar event details such as event titles, dates, and times, which are processed temporarily to schedule or modify events. We do not store the content or descriptions of your calendar events beyond what is needed for immediate use.
AI Prompt Content: The text of any requests or prompts you submit to the Personal-IQ AI assistant (e.g., “Schedule a meeting for tomorrow at 10 AM”). This is used transiently to generate a response to you.
Booking Information: If you use Personal-IQ’s booking features, we collect information related to appointments. For end-users booking with a business user, this may include your name and contact information (phone number and/or email) as provided in the booking form. For business users, we also store business profile details you provide (such as business name, address, contact email/phone, services offered, and working hours).
Policy and Consent Records: Records of your agreement to our Terms of Service and Privacy Policy (including your email, the IP address used at the time of acceptance, date/time, and the version of the policy agreed to).
Technical Logs: Basic technical information automatically collected when you use Personal-IQ, such as IP address and browser type. This data is kept in server logs and metrics for security, fraud prevention (e.g., rate limiting), and performance monitoring.

2. How We Use Your Information

We strictly use collected information to operate and improve the Personal-IQ service and for no other purposes. Specifically, we use your data to:

Authenticate and Secure Your Account: Your Google account email (and associated credentials) are used to log you in via Google OAuth and ensure that only you can access your Personal-IQ account and associated data.
Provide Calendar Functionality: Personal-IQ uses your Google OAuth token to access your Google Calendar and perform actions you request, such as creating, updating, or deleting calendar events, setting reminders, and managing appointments. Event metadata (title, date, time) is processed to fulfill your requests.
AI-Powered Assistance: Your prompt messages are sent to our AI (OpenAI’s GPT-based service) to interpret your natural language instructions (for example, understanding “Book a dentist appointment tomorrow at 3 PM” and turning it into a calendar event). We use the AI’s response solely to carry out your request (e.g., scheduling an event or replying with available times).
Booking Services: For business users, we use the information you provide (business hours, services, etc.) to create your public booking page and manage appointments. For end-users booking an appointment with a business, the personal information you provide in the booking form is used to schedule that appointment and is shared with the relevant business user. Personal-IQ facilitates the exchange by storing the booking details and making them available to the business owner and (where applicable) sending confirmation notifications.
Communications: We may use your email address to send you service-related communications, such as confirmations of bookings, cancellation or rescheduling notices, important updates about the platform, or responses to support inquiries. We do not send marketing emails or newsletters without your explicit consent.
Compliance and Legal Obligations: We maintain records of your acceptance of our policies to demonstrate compliance with legal requirements. If necessary, we may use or disclose information to enforce our Terms of Service, comply with law enforcement or regulatory requests, or to exercise or defend legal claims.
Analytics and Improvements: We may use de-identified and aggregated information (never calendar event content or personal conversation content) to understand overall usage patterns and to improve Personal-IQ’s features and performance. For example, we might track the number of scheduling requests per week or monitor system load, but we do not profile individual users or analyze your specific calendar data or prompts for product development. Any metrics collected are used strictly to ensure reliability and efficiency of the service (see also Section 3, “Data Storage and Protection”, regarding logging).

We do not sell your personal information to any third parties, and we do not use your calendar data or prompt content for advertising or marketing purposes. Your data is never shared with unrelated parties, and we do not analyze your individual calendar events or conversations beyond what is needed to provide the service to you in that moment.

3. Data Storage and Protection

We take the security of your data seriously and employ industry-standard practices and technical measures to protect it. Key data storage and protection measures include:

Encrypted Credential Storage: Your OAuth access tokens (which allow Personal-IQ to perform actions on your Google Calendar) are stored in our database in an encrypted form using the Fernet symmetric encryption (AES-256). This means that even if our database were accessed without authorization, the tokens are not readable without the encryption key. The encryption key is kept secure on our server and is never exposed publicly.
Secure Sessions: When you log in, we create a session to keep you authenticated. Session data (like your session ID and minimal user info such as your email identifier) is stored server-side in a protected session store (Redis). Session cookies are marked HTTPOnly, Secure, and with a strict SameSite policy, meaning they are only sent over HTTPS, not accessible via JavaScript, and are resistant to cross-site request forgery. Sessions automatically expire after periods of inactivity for safety. This approach ensures that your session information is not stored in the browser beyond a secure session cookie, and on our server it resides only in memory for a limited time.
Content Security Policy (CSP): Our web application is built with a strict Content Security Policy and without any inline or third-party scripts that could compromise your data. This means the Personal-IQ frontend only loads approved resources, significantly reducing the risk of cross-site scripting attacks and preventing your data from being sent to unauthorized external services. We do not use external analytics or tracking scripts that collect your data.
Data in Transit: All communications between your browser and Personal-IQ servers are encrypted using HTTPS/TLS. This end-to-end encryption ensures that your commands, calendar data, and any other information are protected from eavesdropping while in transit.
User Access Controls: Personal-IQ is a single-tenant experience for each user. You can only access your own calendar data and account information when logged in. We do not allow any user to access another user’s data. Business users can access the booking information for their own business only. Administrators of the system have very limited access to user data (see Admin role in Terms of Service); in general, our staff do not access the content of your calendar or prompts except in rare circumstances where you have requested support or when required for security diagnostics, and even then, access is restricted and logged.
Logging and Monitoring: For the health and security of the service, Personal-IQ maintains server logs and uses monitoring tools (such as Prometheus and Grafana) to track performance metrics and detect issues like errors or abuse (e.g., excessive login attempts or booking requests). These logs and metrics may include truncated or hashed identifiers (for example, we log a hashed version of your email address rather than the full address) and IP addresses. We intentionally redact or hash personal identifiers in our logs to protect your privacy while still allowing us to troubleshoot problems. Detailed or debug logs of AI prompt content are disabled by default and are only activated temporarily if needed to resolve a specific user issue, and typically only with user consent or request. Monitoring data is kept secure and is used only by our team to maintain the service’s performance and security.
Data Isolation: All user data is stored in a local database (SQLite) within our secure server environment (deployed via Docker containers). We do not use cloud-based storage for your personal data at this time; all data resides in our controlled infrastructure. This containerized deployment is regularly updated and maintained to apply security patches and minimize vulnerabilities. Access to the production server and databases is limited to authorized personnel and protected by strong authentication and network security measures.

In summary, we limit what we store, secure what we must store, and employ multiple layers of protection (encryption, secure sessions, strict frontend security, and access controls) to safeguard your personal information. If you have questions about our security practices, please contact us as described below.

4. Use of OpenAI API (AI Processing)

Personal-IQ integrates with OpenAI’s GPT-based API to convert your natural language requests into structured calendar actions or responses. When you use the AI assistant feature, only the necessary information is sent to OpenAI:

Typically, this is the text of your request or prompt (for example, "Schedule a team meeting next Wednesday at 2 PM with Project X team."). This text may include the event title and time you mention, and any details you voluntarily provide in your prompt.
We do not send personal identifiers such as your real name, your email address, or the identities of other people from your calendar to the OpenAI API. We also avoid sending specific details that are not necessary for interpretation (for instance, if an event involves other people’s email addresses or a meeting link, that information is not part of the prompt we send to OpenAI).

The OpenAI API processes the prompt and returns an AI-generated response, which Personal-IQ then uses to perform the requested action or to present you with a conversational answer. All communication with OpenAI’s API is conducted securely (over HTTPS). We have configured our usage of OpenAI such that it does not retain or use the data we send for training their models. OpenAI acts as a data processor for the content of your requests; it is contractually obligated not to use your data for any purpose other than providing the response. Personal-IQ does not give OpenAI any more data than necessary to interpret your command. The AI’s involvement is solely to enhance functionality (e.g., understanding natural language and providing scheduling suggestions), and the output is immediately used to assist you. No AI-processed data is stored on our servers beyond the immediate response cycle (we do not keep transcripts of your chats on the server).

Note: While the AI helps us interpret your requests, it may occasionally make mistakes or require clarification. However, it does not change any calendar data without your request, and all final actions (like creating an event) are executed by Personal-IQ. We do not allow the AI to independently take actions beyond generating text suggestions that our system then applies with appropriate checks.

5. Third-Party Services and Disclosure

Personal-IQ relies on a few trusted third-party services in order to function. We disclose user data to third parties only in the ways described below, and only when necessary to provide or secure the service:

Google (Google LLC): Personal-IQ uses Google OAuth for user authentication and the Google Calendar API to fetch and manage your calendar events as you direct. This means that some of your data (for example, calendar event details and any updates you request) passes between our application and Google’s servers. Your use of Personal-IQ is therefore also subject to Google’s Terms of Service and Privacy Policy, and we encourage you to review those. We do not share any more of your information with Google than is needed for these operations. Specifically, we do not provide Google with any of your AI interaction data or any Personal-IQ internal logs; we only make requests to Google’s APIs when you ask us to read or write calendar events on your behalf. Google may process your data on servers located in various countries (including the United States), but we use Google’s APIs in compliance with their data protection requirements and have agreed to Google’s API policies to keep your data safe (including strict rules on limited use of the data).
OpenAI (OpenAI, L.L.C.): As described in Section 4, we send the content of your scheduling prompts to OpenAI’s GPT API for processing. OpenAI is considered a sub-processor for us — it processes that prompt text and returns an AI-generated response. OpenAI does not receive your identity or any calendar data beyond what might be implicitly in your prompt (which, as noted, we try to keep free of personally identifying details). OpenAI may process this data on servers in the United States or other locations. We have a binding agreement that OpenAI will not use our API data for training or improving their models, and OpenAI maintains its own stringent privacy and security practices. For more details on how OpenAI might handle data, you can refer to OpenAI’s privacy policy, but note that via their API, data is not used for secondary purposes.
Email Service (if applicable): In the event that Personal-IQ sends email notifications (for example, a booking confirmation or cancellation notice to you or your customers), we would use a secure email service or SMTP to dispatch that message. Such messages would contain only the necessary information (e.g., appointment details) and your contact info. We do not use any third-party email marketing services at this time; emails are purely transactional or support-related.

Aside from Google and OpenAI (and possibly an email relay as described), no other third parties are given access to your personal data. We do not share or sell any data to advertisers or analytics companies. In certain cases, we may use cloud hosting or infrastructure providers to run the Personal-IQ application (for example, a cloud platform to host our servers or databases); any such provider would potentially process data only to the extent of storing or transmitting it on our behalf. We ensure any infrastructure providers implement strong security measures and, if they are outside of our country, that appropriate legal safeguards for international data transfer (such as standard contractual clauses or equivalents) are in place.

Finally, we may disclose your information if required to do so by law or in response to valid requests by public authorities (such as a court order or a government regulation). If we ever need to disclose data in such circumstances, we will only disclose the minimum necessary and, unless legally prohibited, we will inform you of such disclosure.

6. Data Protection and AI Model Use

We want to be completely transparent about how your data is (and is not) used when it comes to machine learning and improvement of services:

No Personal Data for AI Training: Personal-IQ does not use any data obtained from your Google Calendar or any personal data you provide to develop, train, or improve generalized artificial intelligence (AI) or machine learning models. This means that the contents of your calendar events, your prompts, and any responses are not fed into any model-training pipelines by us. The OpenAI service that interprets your prompts also does not use those prompts to train OpenAI’s models, per our usage agreement.
No Profiling or Data Mining: We do not analyze your calendar data or conversation history to profile you, to derive analytics about your behavior, or for any purpose outside of fulfilling the specific requests you make. We do not combine your data with any outside datasets to infer additional information about you.
Session-Based Processing: All AI interpretations and calendar operations occur within your active session. Once an operation is completed (for example, an event is scheduled or a question is answered), Personal-IQ does not retain the underlying personal data (such as the full text of your prompt or the detailed event information) in a way that’s linked to you. (Of course, the events you create remain in your Google Calendar until you choose to remove them, but Personal-IQ doesn’t keep its own copy of that content.)
Limited Data Retention for Support: The only circumstance in which we might temporarily retain some content of your interactions is if you request technical support that requires us to reproduce an issue. In such a case, with your permission, we might enable debug logging to capture the issue and then share relevant excerpts with you or our development team to fix the problem. Any such data is handled with the same care and is erased once no longer needed for troubleshooting.
No Third-Party Sale or Sharing: We reiterate that no user data (calendar data, prompt content, booking information, etc.) is ever sold, rented, or given away to advertisers or other third parties. We also don’t use your data for marketing or advertising targeting, and we don’t show you ads in the Personal-IQ service.
Compliance with Google Policies: Personal-IQ adheres to Google’s API User Data Policy and Google Workspace Marketplace guidelines for handling data from Google services. This includes the Google Limited Use requirements: the data we obtain through Google OAuth and Google Calendar API is used only to provide the functionality in our app to you, and not for any other purpose. We have implemented measures to ensure this compliance, and our code and processes are designed to respect these rules. Our commitment to privacy isn’t just a promise to users but is also aligned with the strict standards that Google (and other partners) require from apps like ours.

7. Your Rights and Choices

As a user of Personal-IQ, and particularly if you are located in the European Union or a jurisdiction with similar data protection laws, you have certain rights regarding your personal data. We are committed to upholding these rights. These rights include:

Right of Access: You have the right to request a copy of the personal data we hold about you. This typically would include the information in Section 1 (like your account email, any business profile info, and records of consent). We will provide this information to you in a common format, normally within a reasonable timeframe.
Right to Rectification: If any personal information we have about you is incorrect or incomplete, you have the right to request that we correct or update it. In practice, much of your data (like name or email) comes from your Google account, so you would update it via Google. For any profile data stored in Personal-IQ (e.g., business details), you can edit those through the app interface or by contacting us if you need assistance.
Right to Deletion (Right to be Forgotten): You have the right to request that we delete your personal data. Because of our limited data retention practices, most of your data (like calendar content and prompt history) is not stored by us long-term. For the data we do hold (such as your encrypted credentials, user account record, business profile, and consent logs), you can request full deletion. Please note that deleting your Personal-IQ data does not remove calendar events from Google that were created through the service; you would manage those via Google Calendar. However, revoking our access (as described below in Section 8) will prevent any further access to your Google data.
Right to Withdraw Consent: In cases where we rely on your consent to process data (for example, if in the future we ask for your consent for optional features or detailed error logging), you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of processing based on consent before its withdrawal. If you withdraw consent for us to use your Google Calendar data (by revoking access), certain features of Personal-IQ will no longer function, but we will respect your decision and remove our stored credentials as described.
Right to Object or Restrict Processing: You have the right to object to certain processing of your data or ask us to limit processing. For instance, you might object to us keeping consent records with your IP address. We will evaluate such objections, and if we have no overriding legitimate interest in continuing the processing, we will comply with your request. In practice, because we process very limited personal data and do not do marketing, profiling, or broad analytics, the situations where this applies are rare. But if you have concerns, we’re happy to discuss and accommodate where possible.
Right to Data Portability: To the extent applicable, you have the right to receive your personal data that you provided to us in a structured, commonly used, machine-readable format, and to have that data transmitted to another service provider (if it’s data we control, like your business profile information). Given the nature of our service, most of your data remains in Google (your calendar events) or is simple (your email, settings), which we can export for you upon request.
Automated Decision-Making: Personal-IQ does not make any decisions about you that have legal or significant effects solely by automated means. The AI may assist with scheduling suggestions, but all final decisions (like creating an event or not) involve your input. You have the right not to be subject to a purely automated decision-making process without human involvement for any such significant decisions.

If you wish to exercise any of these rights, you can do so by contacting us at the email address provided in the Contact section below. For security, we may need to verify your identity (for example, by confirming control of your Google account email) before fulfilling certain requests, especially those related to accessing or deleting data.

Data Subject Requests: We will respond to inquiries and requests regarding your rights promptly and in accordance with applicable law. For EU residents, if you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority. However, we encourage you to reach out to us first, and we will do our best to resolve any issue to your satisfaction.

8. Data Retention and Deletion

We design our systems to minimize data retention. Here is how long we keep different types of data and how you can delete your data:

Google OAuth Tokens: We retain your encrypted Google OAuth access and refresh tokens for as long as your Personal-IQ account is active and you have not revoked our access. These tokens are what allow Personal-IQ to interact with your Google Calendar. If you decide to stop using Personal-IQ, you can revoke Personal-IQ’s access to your Google Account at any time via your Google Account security settings (look for the section that lists third-party apps with account access). Revoking access will immediately prevent Personal-IQ from accessing your Google Calendar on your behalf. Our system regularly checks token validity; if we detect a revocation, or if a token expires and cannot be refreshed, we will treat it as a termination of your use and delete the stored tokens from our database. Additionally, you may log out of Personal-IQ and use the “Delete Account” option (if provided in the app interface) or contact us to ensure removal of your credentials from our system. Upon deletion, you would need to re-authorize if you ever want to use the service again.
Personal Data and Account Information: Information like your email address and any profile info (including business profile data) is stored as long as you maintain an account with us. If you request account deletion, or if you revoke Google access (which we interpret as account termination), we will delete your user record and any associated data we hold (business entries, bookings, etc.) from our databases. In normal circumstances, we aim to do this promptly after confirmation. Some data, like bookings that were made, may be retained in an anonymized form for service integrity (for instance, to keep an accurate history for the business owner without identifying the customer after deletion) – but in such cases we remove or anonymize personal identifiers.
Calendar and Prompt Content: As noted, Personal-IQ does not store the content of your calendar events or your AI conversation history on our servers outside your active session. Calendar events reside on Google’s servers (under your Google account) and are subject to Google’s retention and your control. If you delete an event from your Google Calendar, it is gone from Personal-IQ’s perspective as well since we pull data live from Google. We do not maintain separate archives. The prompt you send to the AI is transient – it’s held in memory long enough to get a response and is not saved to persistent storage. Therefore, there is no long-term retention of these items by us to delete. (Any ephemeral cache or log that might incidentally contain a portion of this – such as a short-term in-memory log for debugging – is routinely cleared and never used for any other purpose.)
Logs and Analytics Data: Our operational logs (with hashed email identifiers and IP addresses) and metrics are generally retained for a short period for troubleshooting and monitoring – typically on the order of weeks to a few months – after which they are automatically purged or overwritten. In cases of security logs (e.g., records of consent or unusual activity), we may retain those specific records longer to comply with legal obligations or investigate incidents. However, those logs are limited in scope (often containing no personal content, just technical details or hashed IDs). If you have a specific concern about log data related to you, let us know. We can review and, if appropriate, anonymize or delete identifiable entries sooner.
Policy Acceptance Records: We retain records of your acceptance of our Terms of Service and Privacy Policy (including timestamp and IP) for as long as we operate Personal-IQ or until they are no longer needed for legal compliance. This is to demonstrate that we had consent to access your Google data and that you agreed to our terms at a given time. If you request deletion of your data under GDPR or similar laws, we will remove personal data to the extent required, but may keep a note that an anonymized user (or a particular email hashed) had once consented, for compliance evidence. These records are kept secure and used only for that compliance purpose.

How to Delete Your Data: You can initiate deletion of your data at any time by: (a) revoking the Personal-IQ app’s access to your Google Account (which you can do through Google’s security settings), (b) contacting us directly to request deletion, or (c) if available, using an in-app feature to delete your account or data. For any deletion request, we will verify and then delete the requested data. Keep in mind, as noted, that any events or data already in your Google Calendar will remain there for you to manage (or delete) via Google; our deletion covers data on our side.

Once your Personal-IQ account is deleted, or you revoke access, we will not have any further access to your Google Calendar data, and any future attempts by the service to use your old tokens will fail. We will ensure all associated personal data that we store is erased (apart from the limited exceptions noted above for legal compliance or safety, which will be handled as per law).

If you have any questions about deleting your data or need assistance with it, please contact us at our support email. We are here to help ensure you feel in control of your information.

10. Contact and Support

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your data in Personal-IQ, please contact us. We are committed to addressing your inquiries and resolving any issues to the best of our ability.

Contact Email: [email protected]

When contacting us about a privacy concern, please provide as much detail as possible about your question or request, so that we can effectively assist you. If you are exercising one of your data protection rights (see Section 7 above), please clearly indicate what action you would like us to take and for which data (for example, the Google account email you used with Personal-IQ, and what specific request you have).

We will respond to legitimate inquiries without undue delay and in accordance with any applicable regulations. Your trust is extremely important to us, and we welcome feedback on how we can improve our privacy practices. Thank you for using Personal-IQ with confidence in how we protect your information.

11. Your Data Rights and Contact Information

If you are located in the EU or other regions with data protection laws (such as the GDPR), you have certain rights regarding your personal data. These include the right to:

Access the personal data we hold about you and obtain information about how we process it.
Rectification of inaccurate personal data, allowing you to correct or update your information.
Erasure (Deletion) of your personal data. For example, you can revoke Personal-IQ’s access to your Google account and request that we delete any stored credentials or records associated with your use of the service.
Object to or restrict certain processing of your data, including the right to withdraw consent where applicable.
Data Portability, to receive a copy of your personal data in a commonly used, machine-readable format for transfer to another service.

To exercise any of these rights, or if you have questions about your data, please contact us at [email protected]. IQ Kos AI Solutions (the operator of Personal-IQ) is the data controller responsible for your personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. If we make material changes to how we handle your personal data, we will provide a prominent notice (for example, by posting a notice within the app or via email notification) and, if required, obtain your consent. The “Effective Date” at the top of this Policy will always indicate when the latest changes took effect.

We encourage you to review this Privacy Policy periodically to stay informed about how Personal-IQ is protecting your information. Your continued use of Personal-IQ after any modifications to this Policy will signify your acceptance of the changes, to the extent permitted by law. If you do not agree with any updates to the Policy, you should discontinue using the service and may revoke your permission for us to access your data (as described above in Section 8).

Rest assured, we will not dilute your rights under this Privacy Policy or the level of protection for your data without your explicit consent. Any changes we make will aim to enhance clarity or improve your experience, and we will always keep our core commitment to your privacy at the forefront.

Privacy Policy – Personal-IQ (IQ Kos AI Solutions)