Privacy policy

Operator and data controller

1. Scope and controller

This policy explains personal data processing on famboos.com and in the Famboos app services. The controller is the individual identified below, operating under the trading name Famboos. Contact the email or postal address shown for privacy questions and rights requests.

2. Data we process and its sources

Website: technical data needed to serve pages and protect the service, such as IP address, browser and request logs; cookie preferences and, only with consent, browsing data for statistics. If you contact us, we process your email address, message and any information you include. Unsubscribe links contain an identifier used to update the email preference of the relevant account.

App: account registration and identification, profile and household membership; content you enter or share, such as tasks, groceries, budgets, planning, pet information and documents; and technical data needed to operate the service. The specific categories depend on the features you use. We may also receive information another household member shares about you or an invitation they send you. Sign-in providers supply the information you authorize during sign-in.

3. Data Protection and Security Measures for Google Workspace Data

Famboos processes Google Workspace and Google Calendar data only when a user connects the Calendar integration. Calendar events may contain personal or sensitive information depending on the content entered by the user or other event participants.

Famboos requests the calendar.calendarlist.readonly permission so users can view and select the calendars they want to connect. The calendar.events permission is used to read, synchronize, create, update and delete events only as necessary to provide the Calendar functionality requested by the user and only in the calendars the user selects.

Google Workspace data is protected using technical and organizational security measures. Data is encrypted in transit using HTTPS/TLS and encrypted at rest. Sensitive OAuth credentials receive additional application-level encryption. Access to Calendar data is restricted through authentication, authorization controls and permissions based on the user's role and household membership. Integration secrets are protected from client access, and production access is limited to authorized personnel.

Calendar information is shared with other members of the same Famboos household only according to the privacy option selected by the connected user. Users can keep events private, share only availability or choose to share event details.

Active connection data is retained while the Calendar integration remains active. Disconnecting Google Calendar stops future synchronization and initiates the removal of the active integration data. Some residual technical records may remain: their automatic expiry is not currently active, and deleting a Famboos account alone is not yet verified to remove every Calendar-related technical record. Encrypted recovery copies may remain temporarily until their applicable retention period expires. Users may request erasure, including review of residual records, by contacting contact@famboos.com.

Famboos does not sell Google Calendar data, use it for advertising, send it to artificial intelligence services or use it to create, train or improve generalized artificial intelligence or machine-learning models.

The use of information received from Google Workspace APIs adheres to the Google User Data Policy, including the Limited Use requirements.

Manage connections to third-party apps and services in your Google Account

4. Purposes and legal bases

Providing requested features, managing accounts, syncing content and answering contract-related enquiries: performance of a contract or pre-contractual steps you request (GDPR Article 6(1)(b)). Data necessary for a feature is required to provide it; browsing the website does not require an account.

Answering general enquiries and protecting the service against abuse, unauthorized access and incidents: our legitimate interests in responding to people who contact us and maintaining security (Article 6(1)(f)), balanced against your rights. You may object on grounds relating to your particular situation.

Optional analytics, advertising measurement and marketing messages: specific consent for each purpose (Article 6(1)(a)), where applicable. Accepting terms or creating an account does not itself authorize these activities. Handling an unsubscribe or rights request: compliance with applicable legal obligations (Article 6(1)(c)), including the GDPR and Spanish LSSI.

5. Email and withdrawing consent

Messages necessary to deliver the service are distinct from promotional messages. You can reject optional messages or withdraw consent without losing access to contracted features. Use the unsubscribe link in the message or email contact@famboos.com. An unsubscribe link applies to the category specified in that link; you can request removal from all marketing messages by email. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Shared content, children and sensitive data

Content you share with a household may be accessible to its members according to the permissions of the feature used. Before adding someone else’s information, ensure you have a lawful basis and inform them. Avoid unnecessary personal data in documents or text fields.

Family features do not authorize unrestricted collection of children’s data. Where processing relies on a child’s consent, the applicable age and representation requirements apply; in Spain, consent for children under 14 must be given by their legal representatives. Contact us if you identify a child’s data being processed without the necessary lawful basis.

Human health information, allergies and other special categories require an additional condition under GDPR Article 9. Do not enter them in general fields or send them to AI features unless the feature first explains the processing and obtains the necessary legal basis. Veterinary records may include personal information about owners or professionals.

7. Providers and recipients

Google/Firebase and Google Cloud supply hosting and service infrastructure. Cookiebot, by Usercentrics, manages website cookie preferences. Google Analytics processes website statistics when you authorize them. Email and support providers may access information needed to deliver messages and handle requests, subject to the applicable data protection conditions.

In the app, optional measurement features may use Google Analytics for Firebase, Meta App Events and TikTok App Events when enabled and with the corresponding consent. They may process device or instance identifiers, events, technical information and attribution data. Website consent does not activate app consent. Apple and Google manage downloads and purchases in their stores under their own terms.

Household members receive the content you share. Authorities may receive data where legally required, as may advisers needed to handle claims. Accepting this policy does not authorize unrestricted disclosure of data.

8. International transfers

International providers’ services may involve access to or processing of data outside the European Economic Area. A European hosting region does not in itself rule out such access.

These transfers require an applicable adequacy decision or safeguards under GDPR Chapter V, such as standard contractual clauses and additional measures where necessary. The EU–US Data Privacy Framework can only be used for certified entities and covered processing. You can request information about destinations, the applicable safeguard and a copy of safeguards by email. A provider’s privacy policy does not replace these obligations.

9. Retention

Account and service content: for as long as needed to provide the features you keep active, until you delete the content or request erasure, subject to legal obligations and shared data that must lawfully be retained for other members. Erasure requests are also assessed in relation to copies and connected systems.

Enquiries: while being handled and afterwards only as necessary to address liabilities arising from the enquiry. Security data: for the period needed to detect and investigate incidents. If a claim or legal obligation applies, use is restricted to that purpose for the applicable period.

Optional communications: until consent is withdrawn or you unsubscribe. The minimum information necessary is retained to respect your exclusion and demonstrate consent management. Unsubscribe links are valid for one year from creation; expiry does not mean deletion of associated records. Cookie lifetimes appear in the cookies section. Cookie lifetimes differ from retention of events on analytics servers.

10. Rights and complaints

You may request access, rectification, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests on grounds relating to your particular situation, and object at any time to direct marketing, including related profiling.

Email contact@famboos.com with your request and the information needed to locate it, or use the controller’s postal address. We only request additional identity information where there are reasonable doubts; a copy of your ID is not routinely required. We respond within one month of receipt. For complex or numerous requests, this may be extended by two further months, explaining the extension and reasons within the first month.

You may complain to the Spanish Data Protection Agency (AEPD) or the supervisory authority of your habitual residence, workplace or the place of the alleged infringement. You do not have to complain to Famboos first.

11. Website cookies and similar technologies

Necessary cookies manage your privacy choice and essential website functionality. Statistics are optional: Google Analytics code only loads after explicit acceptance of that category. Rejecting or not responding keeps analytics blocked. Advertising tags through Google Tag Manager are disabled in this website version.

Open “Cookie preferences” from any page to accept, reject or change your choice. Withdrawal stops analytics and removes Google Analytics cookies accessible from this domain. You can also delete cookies in your browser. If the consent manager is unavailable, analytics remains blocked without valid consent.

CookieConsent (Cookiebot/Usercentrics): stores your consent selection; necessary; normally lasts one year, subject to the consent manager’s configuration. _ga and _ga_42ZED1CHEL (Google Analytics): distinguish browsers and sessions for statistics; optional; this integration limits their lifetime to one year without automatic renewal. The linked cookie declaration provides the manager’s inventory, with providers, purposes and durations.

12. AI, profiling and automated decisions

AI features you request may process the instructions and content you supply through Google AI services. Read the feature information before sending documents or other people’s data. Results may contain errors and require human review.

The website does not use solely automated decisions with legal or similarly significant effects on you. Optional campaign measurement may associate events with identifiers to attribute conversions; this requires the stated consent and does not permit unrestricted use of private household content for advertising.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. Famboos does not use, transfer or sell raw, aggregated or derived Google user data to create, train or improve foundational or generalized machine learning or artificial intelligence models.

13. Security and policy changes

We apply technical and organizational measures proportionate to risk, including access controls. Report privacy incidents to our contact email. If a security breach requires notification to affected people under the GDPR, the corresponding notice will be provided.

This page shows its update date. Relevant changes will be communicated by an appropriate channel before new purposes apply where necessary; consent for any new processing that requires it will be requested separately. Continued website use does not constitute consent to new optional processing.