Compliance
QuickBot (quick.bot), operated by Urbiport, complies with the GDPR (the 2018 EU General Data Protection Regulation).Google user data
The Google Sheets and Google Calendar blocks let you connect your own Google account so that a bot can use a spreadsheet or a calendar you choose. This section describes exactly what QuickBot accesses through the Google APIs, what it does with it, who else sees it, and how it is protected. QuickBot never touches your Google account unless you explicitly connect it, from Workspace → Credentials or from a Google block inside the bot editor. Google always shows you the permissions below on its own consent screen before anything is granted.What Google data QuickBot accesses
The Sheets and Drive permissions are requested only when you connect a Google Sheets block; the
Calendar permissions only when you connect a Google Calendar block.
QuickBot does not request permission to read your Drive as a whole. It deliberately uses
drive.file, which grants access to the individual files you select and to nothing else.
How QuickBot uses it
- To run your bot, and only while it runs. A Google API call happens only when a conversation reaches a Google block that you placed in your flow.
- Values read from a spreadsheet become conversation variables. If you mark such a variable as saved, its value is stored with that conversation so the bot can use it later and so you can see it in the Inbox.
- QuickBot does not read, index, crawl or scan your Drive in the background.
- QuickBot does not use Google user data to develop, improve or train artificial intelligence or machine learning models — neither our own nor anyone else’s.
- QuickBot does not use Google user data for advertising, and does not sell it.
Who it is shared with
QuickBot does not share, transfer or disclose Google user data to anyone, with these exceptions:- People in your own workspace. Members you invited can select the connection and see the conversation data your bot produced — see Who can access my data below.
- Our infrastructure providers, which store and run the service on our behalf under contract: Railway (application hosting) and an AWS-managed PostgreSQL database in London (eu-west-2).
- Destinations you configure yourself in your own flow, and only those. If you build a flow that puts a value read from a Sheet into an AI block, that value is sent to that block’s provider as part of the prompt — today OpenAI, Anthropic, Mistral, Groq, Together AI, OpenRouter, Dify or ElevenLabs. The same applies to the HTTP Request and Send Email blocks, which send exactly where you tell them to. No Google data reaches any of these unless your own flow sends it.
- When the law requires it, for example in response to a valid legal request.
How it is protected
- In transit. Every call to a Google API, and every request to QuickBot, travels over HTTPS/TLS.
- At rest. Your Google tokens (access and refresh) are encrypted with AES-256-GCM before being written to our database, each with its own initialisation vector. The encryption key is a server-side secret held outside the database and is never stored alongside the data it protects.
- Access control. A connection belongs to the workspace that created it. Only members of that workspace can select it, and only a workspace admin can create or delete it.
- Least privilege. The file picker uses a short-lived access token, refreshed when it expires.
How long it is kept, and how to remove it
- Your Google tokens are kept for as long as the connection exists. Deleting the connection in Workspace → Credentials removes them from our database and revokes them with Google, so QuickBot disappears from your Google account’s permissions.
- Values your bot read from a spreadsheet are kept with the conversation they belong to, for as long as your account exists. Nothing deletes them automatically. You can delete a conversation and its data from the Inbox at any time, and deleting your account deletes them with it.
- You can revoke QuickBot’s access at any time from your Google Account at myaccount.google.com/permissions. Revoking there stops every future Google API call; the bot’s Google blocks then report a connection error until you reconnect.
- If you delete your workspace or your account, your stored tokens are deleted with it, but please also remove QuickBot from myaccount.google.com/permissions to withdraw the permission on Google’s side.