Last updated: 22 September 2026

This Privacy Policy explains what information GoWondaa collects, why we collect it, how we store and protect it, who we share it with, and how you can control or delete it. It applies to the GoWondaa platform at https://gowondaa.com, the GoWondaa mobile application, and the websites, stores and booking pages our customers publish through GoWondaa.

GoWondaa is operated by GoWondaa Ltd, 61 Bridge Street, Kington, England, HR5 3DJ. For privacy questions, contact support@gowondaa.com.

Sections 5 to 13 describe, in specific terms, every category of Google user data GoWondaa accesses and exactly what we do with it. If you use Google Sign-In or connect a Google Calendar, those sections apply to you.

1. Who we are and what GoWondaa does

GoWondaa is a website and business management platform. Account holders use GoWondaa to design and publish websites with our LYDIA visual editor, run online stores, publish blogs and content, manage domains, accept payments, and take appointment bookings through the GoWondaa scheduling system.

Two different groups of people are described in this policy:

• GoWondaa account holders — the people who sign up for GoWondaa and build sites with it. We are the controller of their account information.
• Visitors and customers of a website built with GoWondaa — people who browse a published site, place an order, or book an appointment. For that information, the account holder who owns the site is the controller and GoWondaa processes it on their behalf.

2. Information you provide to us

• Account information — your name, email address, password (stored only as a one-way hash), and the country and currency we associate with your account.
• Billing information — your subscription plan, order history, wallet balance and payment status. Card details are entered directly with our payment providers and are not stored by GoWondaa.
• Content you create — the pages, sections, text, images, videos, products, blog posts, bookable services and other material you add to your sites.
• Support correspondence — messages you send us and the information they contain.

3. Information we collect automatically

• Technical and usage information — IP address, browser and device type, operating system, pages and features used, timestamps, referring pages, and error diagnostics.
• Approximate location — we resolve an approximate country from your IP address to choose an interface language and a default currency. We do not collect precise GPS location.
• Cookies — see section 18.

4. Information from services you connect

GoWondaa integrations are optional and are only activated when you choose to connect them. Where a connection uses Google, sections 5 to 13 describe exactly what is involved.

5. Google user data: the two places GoWondaa uses Google

GoWondaa uses Google APIs in exactly two features. Nothing else in GoWondaa requests or receives Google user data.

• Google Sign-In — signing in to your GoWondaa account with your Google account, on the web and in the GoWondaa Android application.
• Google Calendar for scheduling — connecting one Google Calendar to a GoWondaa site so that appointment booking works against your real availability.

These are separate authorisations. Signing in with Google gives GoWondaa no access whatsoever to your calendar. Connecting a calendar is a separate, explicit step taken from the GoWondaa dashboard, and it can be undone at any time without affecting your ability to sign in.

6. Google Sign-In

6.1 Scopes requested

Google Sign-In requests exactly three scopes, and no others:

• openid — to receive a Google account identifier for the sign-in.
• email — to receive your Google account email address.
• profile — to receive your basic profile information.

6.2 What Google sends us

After you approve the sign-in, GoWondaa calls Google's user information endpoint once and receives the basic profile associated with your Google account: your Google account identifier, your name, your email address, whether that email address is verified, your profile picture URL and your locale.

6.3 What we actually keep

From that response GoWondaa stores only two values, and only when the sign-in creates a new GoWondaa account:

• your name, used as the display name on your GoWondaa account;
• your email address, which is the identifier for your GoWondaa account and the address we use for service email.

Your Google profile picture, your Google account identifier, your locale and the verification flag are used only within the request that handles the sign-in and are then discarded. We do not store them. If a GoWondaa account already exists with the same email address, you are signed in to that account and nothing from the Google response is written.

6.4 Tokens

The Google access token issued for sign-in is used once, immediately, to read the profile described above, and is then discarded. GoWondaa does not store it, does not request a refresh token for sign-in, and retains no ability to call Google on your behalf after the sign-in completes.

6.5 The GoWondaa Android application

In the Android application, sign-in uses Google Play services with the same three scopes. The application obtains a one-time server authorisation code and hands it to GoWondaa's server, which exchanges it for a single short-lived access token, reads the same basic profile, and discards the token. The application revokes its own access immediately after the sign-in is handed over.

7. Google Calendar integration

This section applies only if you connect a Google Calendar to a GoWondaa site from Scheduling → Integrations in your dashboard.

7.1 Scopes requested

The calendar connection requests exactly these scopes, and no others:

• https://www.googleapis.com/auth/calendar.events — so GoWondaa can create an event on your calendar when a customer books an appointment, update it when the booking is rescheduled, and delete it when the booking is cancelled.
• https://www.googleapis.com/auth/calendar.readonly — used solely to call Google's free/busy endpoint, so GoWondaa knows which times are already committed on your calendar and does not offer them to customers.
• openid and email — so GoWondaa can display which Google account is connected.

The authorisation is requested with offline access, because the integration has to keep working while you are not signed in — a customer booking an appointment at midnight must still be written to your calendar.

7.2 Exactly which Google Calendar operations GoWondaa performs

GoWondaa calls four Google Calendar endpoints and no others:

• Free/busy query. For the calendar you connected, GoWondaa asks Google for the busy intervals within a short window around the dates a customer is viewing. Google returns start and end times only. This endpoint does not return event titles, descriptions, guests, locations, organisers, recurrence rules, attachments or any other event content, and GoWondaa therefore never sees them.
• Create event. When a booking is confirmed, GoWondaa creates one event for it on the connected calendar.
• Update event. When that booking is rescheduled or its details change, GoWondaa updates the event it created, identified by the event identifier Google returned when it was created.
• Delete event. When that booking is cancelled, GoWondaa deletes the event it created.

GoWondaa does not list your calendars, does not read, search or export your existing events, does not modify or delete any event it did not create, and does not import calendar entries into GoWondaa. Each booking event GoWondaa creates is tracked by the identifier Google returned for it, and that identifier is the only event GoWondaa will ever change or remove.

7.3 Which calendar is used

Unless you specify otherwise, GoWondaa uses the primary calendar of the Google account you connected. One Google account can be connected per GoWondaa site.

7.4 Information GoWondaa writes to your Google Calendar

So that you can see what an appointment is when it appears in your calendar, each booking event GoWondaa creates contains the name of the booked service, your customer's name, the booking reference, your customer's email address, their phone number if they gave one, any note they added, the location or meeting link of the service, and the start and end time. Your customer's email address is also added as an event guest so that Google can send them the calendar invitation. This is information flowing from GoWondaa to Google at your instruction; it is not Google user data that we collect from you.

8. Google user data we store, and for how long

The complete list of Google-derived values GoWondaa retains:

• Your name and email address from Google Sign-In (section 6.3), held as your GoWondaa account details for as long as your account exists. After they are written they are ordinary account information: you can change them, and they are not refreshed from Google.
• The email address of the connected Google Calendar account, stored so the dashboard can show you which account is connected. Retained until the calendar is disconnected.
• The identifier of the connected calendar (by default, primary). Retained until the calendar is disconnected.
• The OAuth access token and refresh token for the calendar connection, which are the credentials that let GoWondaa keep the integration working. The access token is short-lived and is replaced automatically as it expires; the refresh token is retained until the connection is removed, as described in section 12.
• The Google Calendar event identifier of each event GoWondaa created for one of your bookings, stored with that booking so the event can later be updated or deleted. It is an opaque identifier and contains no calendar content.

Everything else is transient. In particular, the busy intervals GoWondaa reads from your calendar are used to calculate available appointment slots for the request in progress and are then discarded. They are never written to our database, never cached, and never logged. No event content from your calendar is stored by GoWondaa, because none is ever received.

Site backups you create through GoWondaa contain your site's own content and do not contain Google credentials or Google user data. Routine system backups of our infrastructure may contain a copy of stored records for a limited period before they are overwritten in the normal backup cycle.

9. How we use Google user data

Google user data is used only to provide and maintain the two user-facing features you chose to use:

• to authenticate you and to create or identify your GoWondaa account when you sign in with Google;
• to determine which times are already busy on your calendar so that GoWondaa does not offer them as bookable appointment slots;
• to create, update and delete the calendar events that correspond to your GoWondaa bookings;
• to show you which Google account is connected, and to tell you when a connection needs to be re-authorised.

We do not use Google user data for advertising. We do not use it to build advertising or marketing profiles. We do not use it for credit, lending or insurance decisions. We do not sell it. We do not use it for any purpose other than the ones listed above.

10. Google user data and artificial intelligence

GoWondaa includes AI-assisted features that generate website sections, pages, copy, product descriptions and widgets. These features send the instructions you type, together with the design settings and site content relevant to the request, to our AI provider (OpenAI) to produce the requested result.

No Google user data is sent to OpenAI or to any other AI or machine-learning service. The AI features operate exclusively on website design and content. They have no access to Google Sign-In profile data, to Google Calendar availability, to calendar events, to the connected account's email address, or to OAuth tokens — these are handled by entirely separate parts of GoWondaa and are never included in an AI request.

We do not use Google user data to train, retrain, fine-tune or evaluate any artificial intelligence or machine-learning model, whether our own or a third party's, generalised or personalised.

11. Sharing and transfer of Google user data

GoWondaa does not share, sell, rent, trade or transfer Google user data to any third party. It is not passed to advertising networks, data brokers, analytics providers, AI providers or any other external service.

Google user data is accessible only to GoWondaa's own application servers and database, and, within GoWondaa, only to the specific components that implement Google Sign-In and the calendar integration. The only outbound transfer of Google user data is back to Google itself, over Google's own APIs, to perform the operations listed in section 7.2.

Two narrow exceptions apply, as they do to all information we hold: we may disclose information if we are legally required to do so by valid legal process, and information may transfer as part of a merger, acquisition or sale of assets, in which case the acquiring party remains bound by this policy or gives notice of any change.

The information you instruct GoWondaa to write into your own Google Calendar (section 7.4) is, by design, sent to Google. That is the purpose of the integration.

12. Disconnecting Google, and what is deleted

12.1 Disconnecting a Google Calendar

You can disconnect at any time from Scheduling → Integrations in your GoWondaa dashboard. When you do, GoWondaa deletes the stored connection record in full — the refresh token, the access token, the expiry, the connected account's email address, the calendar identifier and the connection settings. Once that record is deleted, GoWondaa holds no credential of any kind for your Google account and cannot call Google on your behalf again.

Disconnecting removes GoWondaa's copy of the authorisation. To withdraw the authorisation at Google as well, so that GoWondaa no longer appears in your list of connected applications, use myaccount.google.com/permissions. We recommend doing both.

After disconnecting, GoWondaa stops reading your availability and stops creating, updating or deleting events on your calendar. Booking events GoWondaa previously created remain in your Google Calendar, under your control, and you can delete them yourself; GoWondaa no longer has any access with which to remove them. The GoWondaa bookings themselves are unaffected.

12.2 Revoking access from your Google account

You can also revoke GoWondaa's access directly at myaccount.google.com/permissions. The stored credentials stop working at that moment: Google rejects them, so GoWondaa can no longer read your availability or write events, and the connection is marked in your dashboard as requiring re-authorisation. The connection record itself — including the credentials, which no longer grant any access — remains in our database so that you can reconnect in one click. Use Disconnect in your GoWondaa dashboard to have that record deleted, or ask us to delete it as described in section 12.6.

12.3 Deleting a site

Deleting a site removes the site and its content. Disconnect the calendar first if you want the stored connection removed at the same time — that is the action that deletes it. If you have already deleted the site, write to support@gowondaa.com and we will delete the connection record for you.

12.4 Deleting your GoWondaa account

When you delete your GoWondaa account it is closed and you can no longer sign in; the account record is retained so that our support team can restore it if you ask us to, and you can write to us to have it erased entirely. Disconnect any connected Google Calendar before deleting your account, so that the stored connection is deleted, and withdraw GoWondaa's access at myaccount.google.com/permissions. If you have already deleted your account, write to support@gowondaa.com and we will delete any remaining Google connection records we hold for you.

12.5 Google Sign-In

Because GoWondaa keeps no tokens from Google Sign-In, there is nothing to revoke for sign-in itself. Your name and email address remain on your GoWondaa account because they are your account details; you can change them in your account settings, or request deletion of your account as described above.

12.6 Requesting deletion

You can also write to support@gowondaa.com and ask us to delete Google user data we hold about you. We will confirm the request and carry it out.

13. Security of Google user data

• All communication with Google's APIs, and between you and GoWondaa, is encrypted in transit using TLS.
• OAuth tokens are stored server-side only. They are never sent to a browser — the dashboard endpoints that describe a connection return only the connected account's email address, the connection status and your read/write preferences, and the tokens are excluded from that response by construction.
• Tokens are never written to application logs, never included in error reports, and never exposed through any API.
• Only the calendar integration components can read them; no other part of GoWondaa has access.
• Connecting a calendar requires an authenticated dashboard session and site administrator rights, and the authorisation exchange is protected against cross-site request forgery with a single-use state value bound to your session.
• Access to production systems is restricted to authorised personnel.

No system can be guaranteed absolutely secure, but we keep the amount of Google user data we hold to the minimum the features need, which is the most effective protection available.

14. Google API Services User Data Policy

GoWondaa's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, and as described in detail above:

• we limit our use of Google user data to providing and improving the user-facing features you have chosen to use;
• we do not transfer Google user data to others, except as necessary to provide those features, to comply with applicable law, or in connection with a merger or acquisition;
• we do not use Google user data for serving advertising;
• we do not allow humans to read Google user data, unless we have your affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, to comply with applicable law, or the data has been aggregated and anonymised;
• we do not use Google user data to develop, improve or train generalised or non-personalised artificial intelligence or machine-learning models.

15. How we use other information

Information other than Google user data is used to operate your account and the platform: to create and maintain your account, provide and host your websites, process subscriptions and payments, provide e-commerce, booking, analytics and AI features that you use, communicate with you about your account, provide support, detect and prevent fraud and abuse, maintain security, improve our services, and comply with legal obligations.

16. Information published on your website

Anything you publish on a website you build with GoWondaa — business details, contact information, products, prices, images, posts, booking pages — is public by design, and visible to anyone who visits that site. You decide what to publish.

17. Information about your customers

If you use GoWondaa to run a store, a booking page, forms or a customer area, you will collect information about your own customers: names, email addresses, phone numbers, addresses, order details, appointment details and anything they submit through your forms. GoWondaa processes that information on your behalf and in order to provide the features you configured.

You are responsible for having a lawful basis for collecting it, for telling your customers what you do with it, and for publishing your own privacy notice where the law requires one. When a customer books an appointment with you and you have connected a Google Calendar, their booking details are written to your calendar as described in section 7.4.

18. Cookies and similar technologies

GoWondaa uses cookies and local browser storage to keep you signed in, protect against cross-site request forgery, remember your language, currency and interface preferences, cache editor assets for performance, and measure how the platform is used. Blocking essential cookies will prevent sign-in and the editor from working. You can manage cookies in your browser settings.

19. Payments

Subscription payments and store checkouts are processed by third-party payment providers, including Stripe, PayPal, Paymob and others depending on the method used. Card and payment credentials are entered with those providers and are not stored by GoWondaa. We receive and store transaction status, transaction identifiers, amounts and billing details needed for invoicing and support.

20. Analytics

We measure aggregate usage of the GoWondaa platform and of published sites in order to operate and improve them. Site owners can see visitor statistics for their own sites in the GoWondaa dashboard. Google user data is not part of any analytics processing and is never sent to an analytics provider.

21. Service providers

We use third-party providers for hosting and infrastructure, email delivery, content delivery, video hosting, domain registration, payment processing and AI-assisted generation. They process information only as needed to provide their service to us. As stated in section 11, none of them receives Google user data.

22. Retention

We keep account information for as long as your account is active, and afterwards only for as long as we need it to meet legal, accounting, tax, security and dispute-resolution obligations. Site content is kept while the site exists. Google user data is kept only as described in sections 8 and 12, which are the controlling provisions for it.

23. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected, to have it deleted, to restrict or object to how we process it, to receive a copy in a portable form, and to withdraw consent where our processing relies on it. Contact support@gowondaa.com and we will respond within the period applicable law allows. You may also complain to your local data protection authority.

24. International transfers

GoWondaa operates internationally and uses infrastructure and providers that may be located outside your country. Where required, we rely on appropriate safeguards for those transfers.

25. Children

GoWondaa is not directed at children and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

26. Links to other sites

GoWondaa and sites built with it may link to third-party services we do not control. This policy does not cover them.

27. Changes to this policy

We may update this policy as our services change. The "Last updated" date above shows when it last changed. If we make a material change to how we handle Google user data, we will update this policy before that change takes effect.

28. Contact us

GoWondaa Ltd
61 Bridge Street, Kington, England, HR5 3DJ
Email: support@gowondaa.com
Web: https://gowondaa.com