Privacy Policy

Last updated: 12 July 2026

1. Introduction

This Privacy Policy explains how Motley Digital Ltd ("we", "us", "our") collects, uses, stores and protects information in connection with TravelSync, a calendar automation service that inserts travel time blocks around physical meetings and generates mileage reports.

2. Information We Collect

We collect and process the following information when you use TravelSync:

  • Account information — your name and email address, obtained through Google or Microsoft OAuth2 sign-in.
  • Calendar metadata — event titles, times, locations and descriptions from the calendars you explicitly select.
  • Location data — home and office addresses entered in Settings.
  • Travel and mileage records — journey times, distances, origins, destinations and meeting titles used by the dashboard and mileage export.
  • OAuth tokens — access and refresh tokens stored encrypted at rest.
  • Sign-in diagnostics — when you sign in, we temporarily record your IP address, browser type and sign-in timestamps so we can detect and investigate failed sign-ins. These records are deleted automatically after 30 days.
  • Optional analytics and attribution data — only if you allow analytics, Google Analytics receives page-usage, browser/device and approximate-location data, while TravelSync may retain campaign parameters and the referring page for up to 30 days. We do not send your TravelSync user ID to Google Analytics.

3. How We Use Your Data

We use this data to operate TravelSync: reading selected calendar events, identifying physical meetings, calculating journeys, creating travel blocks, generating mileage reports, sending service emails and managing your account and subscription. We do not sell your data or use it for advertising or profiling.

Staff access for support and platform operations. Authorised Motley Digital staff may access account metadata such as run status, block counts, configuration, activity logs, OOO rule names and reply counts to provide support and investigate errors. Staff do not read calendar-event, email or OOO-reply contents.

4. Data Sharing and Third Parties

We use the following processors and integrations only to provide and improve TravelSync:

  • Google Calendar API — selected calendar events and travel-block writes for Google accounts.
  • Microsoft Graph API — selected calendar events and travel-block writes for Microsoft accounts.
  • Google Maps Distance Matrix API — origin and destination addresses used to calculate journey time and distance.
  • Google Analytics — only after you allow analytics, to understand aggregate website and product usage. Google Signals, advertising personalisation and TravelSync user-ID tracking are disabled.
  • Stripe — subscription payment processing. TravelSync does not store card details.

5. Data Retention

We retain account data while your account is active. Specific retention periods:

  • Travel-block and trip records — pruned after 25 months, allowing a complete UK tax year to remain reportable through the following 31 January filing deadline.
  • Mileage report files — your most recent completed report is kept while your account is active; other report files are deleted 90 days after generation.
  • Activity logs — only the most recent entries are kept per account on a rolling basis.
  • Campaign and referral attribution — up to 30 days, and only with analytics consent.

Account deletion removes associated personal data; retained email-delivery audit records are anonymised. Travel blocks already written to your own calendar remain there unless you remove them.

6. Security

Calendar and mailbox access uses OAuth2. Tokens and configured secrets are encrypted at rest, and connections to TravelSync and third-party APIs use HTTPS/TLS. We retain only the data needed to operate the service.

7. Your Rights and Account Deletion

You may request access or correction, delete your account, withdraw optional analytics permission, or revoke Google/Microsoft access. You can download a copy of your data (profile, settings, travel and mileage records) at any time from Settings → Account → "Download my data". Account deletion is available in Settings. You can revoke provider access through Google Account permissions or Microsoft account permissions. Contact support@travelsync.co.uk for other data requests.

8. Cookies and Tracking

TravelSync uses essential cookies for sign-in, security and saved preferences. Optional analytics are off unless you choose "Allow analytics". If allowed, Google Analytics measures aggregate usage without receiving your TravelSync user ID; Google Signals and advertising-personalisation features are disabled. Campaign parameters and the referring page may also be stored in a first-party cookie for up to 30 days.

You can accept, reject or change this choice at any time using the "Cookie preferences" control shown on every page. Rejecting analytics does not affect sign-in or service functionality.

Transactional and product-update emails may contain a tracking pixel recording an open, device type and IP address for engagement and delivery measurement. This email-activity data is anonymised when an account is deleted.

9. Changes to This Policy

We may update this policy. Material changes will be notified where appropriate.

10. Google API Services User Data Policy

TravelSync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements.

  • Google user data is not used for advertising, sold, transferred to data brokers, or used to train generalised AI/ML models.
  • Humans do not read Google user data except with specific user agreement, for security/abuse investigation, to comply with law, or where aggregated and anonymised for internal operations.
  • calendar and calendar.events read selected calendars and write travel blocks.
  • gmail.readonly detects incoming messages during an active OOO period.
  • gmail.send sends the configured in-thread OOO reply.
  • gmail.settings.basic temporarily suppresses and restores the Gmail signature to prevent a duplicated signature.

Mailbox content is processed in memory and not retained. TravelSync retains only minimum reply-deduplication metadata and operational audit records. Revoking TravelSync in Google Account permissions immediately ends Google API access.

11. Contact

Motley Digital Ltd
Office 3, The Exchange
Old Market Hill
Sturminster Newton
Dorset DT10 1FH
Email: support@travelsync.co.uk