1. Executive summary
Nexus Legal (operated by Daniel Jiménez) requests a very specific permission from Google: create events in your Google Calendar (scope https://www.googleapis.com/auth/calendar.events) and know your email address (scope https://www.googleapis.com/auth/userinfo.email).
This data is used solely to sync the deadlines computed in our procedural calendar (/plazos) with your personal Google Calendar, and to show you which Google account is linked to Nexus Legal.
We comply with Google's "Limited Use" policy: we do not read your existing events, we do not access Gmail, Drive, Contacts or any other Google service; we do not use the data for advertising; we do not sell it; we do not share it with third parties for non-operational purposes; we do not use it to train AI models.
2. Requested OAuth scopes
1) https://www.googleapis.com/auth/calendar.events — View, create, modify and delete events in your calendar. Required so that, when you compute a procedural deadline in /plazos (e.g. "20 working days from notification"), you can press a button that automatically creates an all-day event in your calendar with reminders 24h and 1h before the due date. In practice we only create new events; we never read, modify or delete events that our app didn't create.
2) https://www.googleapis.com/auth/userinfo.email — Get your email address. Required to display in the settings page (/integrations/google-calendar) which Google account you've connected, so you can distinguish between accounts if you have several or disconnect the wrong one.
We do NOT request ANY other scope. This is the complete list: two scopes, both non-sensitive per Google's classification.
3. What data we store in Nexus Legal
Access tokens and refresh tokens: encrypted with AES-256-GCM before being stored in our database (Supabase, servers in the European Union). The encryption key is managed as an application secret and never included in source code or logs.
Your Google email address: in plaintext (not sensitive info) to display in the UI. Stored in the gcal_connections table, linked to your Nexus Legal account.
We do NOT store: content of your existing calendar events, data from other calendars, your contacts, Gmail messages, Drive files, or any other data from your Google account beyond your email.
Events we create: the google_event_id of each event we create is saved in our database only to avoid duplicates if the user clicks "Add to Calendar" twice on the same deadline. We do not store event content (it's already in your calendar).
4. Google "Limited Use" Policy — explicit commitments
In compliance with the Google API Services User Data Policy, we formally declare:
1) Use of information received from Google APIs adheres to the user-facing features described on this page and at /integrations/google-calendar within Nexus Legal.
2) Use of information received from Google APIs complies with the Limited Use Policy.
3) We do not transfer information received from Google APIs to others except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition or sale of assets with adequate notice to users.
4) We do not use information received from Google APIs to serve advertising, including retargeted, personalized or interest-based advertising.
5) We do not allow humans to read such information except (a) with your explicit and specific consent, (b) when necessary for security purposes (e.g. abuse investigation), (c) when necessary to comply with applicable law, or (d) when the information is aggregated and used for internal operations.
6) We do not use information received from Google APIs to train generalised or third-party AI/ML models.
5. Data retention and deletion
While the connection is active: we keep the encrypted tokens and your Google email linked to your Nexus account.
On clicking "Disconnect" at /integrations/google-calendar: we immediately and irreversibly delete the row in gcal_connections containing your tokens and email. Events we previously created in your calendar remain there (they are yours); you can manually delete them from Google Calendar if you wish.
On deleting your full Nexus Legal account: after the GDPR Art. 17.2 deletion flow confirmation (token emailed to you), we delete all your data from our infrastructure including any Google Calendar connection.
Revocation from Google: independently, you may revoke access to Nexus Legal at any time from myaccount.google.com/permissions. Doing so instantly invalidates our tokens; our app will detect the failure on the next attempt and prompt reconnection.
6. Security of Google data
Encryption at rest: tokens stored with AES-256-GCM. Encryption key outside source code, managed as a platform secret with documented rotation.
Encryption in transit: all communication with Google APIs and with your browser is over HTTPS (TLS 1.2+).
Access control: at application level, only the user themselves can access their tokens via authenticated session; at database level, RLS (Row Level Security) and service-role-only for sensitive tables.
Audit: we log connect, disconnect and event-creation events with timestamp and user_id, retained per our general retention policy (see /privacy).
Vulnerability disclosure: if you discover a vulnerability related to this integration, please contact us at support@nexusquantum.legal. See also our /security program.
7. How to delete all your Google data from our app
Method 1 — from Nexus Legal (recommended): go to /integrations/google-calendar, click Disconnect, confirm. Immediate, irreversible deletion of your tokens and email.
Method 2 — from Google: go to myaccount.google.com/permissions, find "Nexus Legal", click "Remove access". This invalidates our tokens. Additionally, contact us at support@nexusquantum.legal if you also want us to delete your email from our table.
Method 3 — full GDPR erasure: from the Account section of Nexus Legal, request full deletion. You will receive an email with a confirmation token (GDPR Art. 17.2). After confirming, all your data — including the Google Calendar connection — is removed from our infrastructure within 30 days.
8. Contact and controller
Data controller: Daniel Jiménez (Individual / sole proprietor). Address: Dubai, United Arab Emirates.
Application: Nexus Legal — website: https://legal.nexusquantum.legal.
Email for questions related to this integration or Google data: support@nexusquantum.legal.
General privacy policy: /privacy (this page is a Google-APIs-specific supplement; the general policy prevails for everything else).
General terms: /terms.