Privacy Policy
Last updated: September 23, 2026
TulipSoft respects user privacy and handles personal information and service data appropriately. This policy applies to TulipSoft services, including Calendar Flow.
1. Information We Collect
We may collect information that you provide through contact forms, TulipSoft Login, account profile settings, or other communication channels. We may also collect technical information such as access logs, browser information, device information, and security-related request information.
2. Purpose of Use
Collected information may be used to respond to inquiries, provide and improve services, maintain security, analyze usage, authenticate users, operate service features, and comply with legal obligations.
3. TulipSoft Login
TulipSoft Login uses Google ID token authentication. TulipSoft validates the Google ID token on the server and uses the verified identity to create a TulipSoft session. TulipSoft Login does not grant Google Calendar API access.
4. Calendar Flow and Google Calendar Data
Calendar Flow uses the Google Calendar API only after you explicitly connect Google Calendar. It may access calendar information and event information needed to provide the app, including calendar IDs, event IDs, titles or summaries, descriptions, start and end times, attendees, organizer, creator, recurrence, location, visibility, reminders, color, and event status.
Calendar Flow uses Google Calendar data to list calendars, display events, create events, edit events, delete events, move events between calendars, display Flow Link endpoints, and operate Calendar Flow features such as activities.
5. Calendar Flow Data Storage
Google Calendar remains the source of truth for Google Calendar event bodies. Calendar Flow does not store a full copy of Google Calendar event bodies in Calendar Flow D1.
Calendar Flow stores service metadata associated with your TulipSoft User, such as Calendar IDs, Event IDs, Flow Links, link routing, lanes, task status, flow metadata, diagram data and relationships, activity data, user settings, and device-related service metadata.
6. Google OAuth Access Token
Calendar Flow uses a browser-side Google OAuth access token to call the Google Calendar API. The current implementation keeps this token in browser session storage for the active browser session. It is not stored in localStorage, Calendar Flow D1, Platform Core, or sent to the Calendar Flow server. Calendar Flow does not use refresh tokens.
7. Google Calendar Disconnect
When you disconnect Google Calendar in Calendar Flow, Calendar Flow revokes the current Google OAuth access token and disconnects from Google Calendar. Disconnecting Google Calendar does not automatically delete Calendar Flow cloud metadata such as Flow Links, lanes, diagrams, task status, activity data, or settings.
8. Security and Protection of Google User Data
Calendar Flow protects Google user data against unauthorized access, disclosure, alteration, destruction, and loss through the measures described below. Calendar Flow cloud data requests require a valid, active TulipSoft session. The Calendar Flow API derives the TulipSoft User from that session, and Calendar Flow cloud data is associated with and accessed within that user's boundary.
Google OAuth access tokens are retained only in browser session storage for the active browser session. They are not retained in localStorage, Calendar Flow D1, Platform Core, or the Calendar Flow server, and Calendar Flow does not use refresh tokens. When you disconnect Google Calendar, Calendar Flow revokes the current access token and removes the Google OAuth session from browser session storage.
Google Calendar remains the source of truth for Google Calendar event bodies. Calendar Flow does not retain a full copy of Google Calendar event bodies in Calendar Flow D1; it retains Calendar Flow-specific metadata and references to Google Calendar events. In the production service, data in transit between your browser and TulipSoft is protected using HTTPS.
These measures limit access to authenticated TulipSoft Users, limit the locations where OAuth access tokens are retained, avoid maintaining a full additional copy of Google Calendar event bodies in Calendar Flow D1, and protect data in transit using HTTPS.
9. Data Deletion and Retention
TulipSoft retains service data as needed to provide the relevant service, maintain security, comply with legal obligations, and handle support. A fixed retention period has not been separately defined for Calendar Flow cloud metadata.
If you want to request deletion of your TulipSoft Account data or Calendar Flow cloud metadata, contact TulipSoft through the contact form. TulipSoft will handle the request according to the current service operations and applicable law.
10. Disclosure to Third Parties and Limited Use
TulipSoft does not sell Google user data, use Google user data for advertising, or use Google user data to train AI or ML models. TulipSoft does not disclose personal information or Google user data to third parties except when required by law, when necessary to protect rights or safety, or when using service providers necessary to operate TulipSoft services.
11. Google Analytics
This website uses Google Analytics to understand website usage. Google Analytics may use cookies or similar technologies to collect usage data. The handling of such data is subject to Google's policies.
12. External Services
TulipSoft services may contain links to external websites and services. TulipSoft is not responsible for the privacy practices or content of those external services.
13. Changes to This Policy
This Privacy Policy may be revised when necessary. The updated policy will become effective when published on this website.