Privacy notice

This notice describes the VA Live Concert Management application and its optional Google Calendar connection.

Information used

The application holds concert records and staff account information under role-based access controls. Connecting Google Calendar associates the connection with your staff email and role. With your consent, the app requests https://www.googleapis.com/auth/calendar.app.created to create a separate VA Show Calendar and create, update or remove app-managed events there. It does not request access to read your existing personal calendars or events.

Confirmed shows with exact dates are sent to Google as calendar events. Event data includes the date, city and country, event type, production/client name when available, business reference and a link back to the protected application. Financial amounts and main-contact details are not included by this integration. Anyone you separately allow to see the calendar may be able to see its event details; the linked application still requires authorised access.

Storage and processing

Google processes the OAuth connection and calendar data. The application uses Cloudflare Workers for server processing and Cloudflare D1 for application and connection records. Refresh tokens are encrypted with AES-GCM before storage. The backend uses them to obtain temporary access tokens for background calendar updates. It also stores the linked staff email and role, calendar and event identifiers, synchronisation status and errors, and temporary OAuth state and an encrypted verifier during connection.

These connection records support calendar updates, access checks, troubleshooting and cleanup. Staff access is controlled by current enabled role assignments. Google consent does not override those controls.

Disconnecting and revoking access

You can request Disconnect in the application. This starts background removal of app-managed events; it is not immediate. After successful cleanup the stored refresh token is cleared. The empty app-created calendar, connection/event metadata, concert records and audit history are not automatically deleted by Disconnect. Disconnect does not itself revoke the Google permission.

You can also revoke the app’s access in your Google Account. Revocation can prevent the app from removing existing events. If permission is revoked or cleanup fails, manual removal of the VA Show Calendar or its events in Google Calendar may be necessary. Disabled or changed staff memberships also trigger cleanup, subject to the same Google-access limitations.

There is no automatic deletion deadline for retained connection metadata or concert/audit records stated here. For questions about retained data or a deletion request, contact teamvijayantony@gmail.com. Requests require review; this notice does not promise immediate or complete deletion from Google, backups or operational records.