Optima Learn's use and transfer of information received from Google APIs to any other app will adhere to the
Google API Services User Data Policy, including the Limited Use requirements.
When a mentor connects their Google Calendar, we request the following OAuth scopes:
- openid and email — to associate the connection with the mentor's Google account identifier and primary email address.
- https://www.googleapis.com/auth/calendar.events — to create, modify, and delete calendar events that the Platform itself schedules for mentor sessions on the mentor's primary calendar.
We use Google user data exclusively for the user-facing feature of scheduling and managing mentor sessions (including the associated Google Meet conference links that allow our transcription integration to attend on the mentor's behalf). We do not:
- Read, store, or analyse calendar events that the Platform did not itself create.
- Use Google user data for serving advertisements.
- Sell or transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with the user's explicit consent.
- Allow humans to read Google user data, except where (a) the user has given affirmative consent, (b) it is necessary for security purposes (e.g., investigating abuse), (c) to comply with applicable law, or (d) the data has been aggregated and is used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements.
Refresh tokens received from Google are encrypted at rest using AES-256-GCM with keys stored separately in a managed secret vault. A mentor may revoke our access at any time from the mentor home page on Optima Learn or from https://myaccount.google.com/permissions; revocation causes the encrypted token to be marked invalid and removed from active use.