Last updated: October 2026
1. Who we are
BlueBearOS (“the service”) is operated by BlueBear AI, Berlin, Germany (“we”, “us”). This policy explains what data BlueBearOS processes, why, and what choices you have. Contact: hello@bluebear.berlin.
Kamen Plamenov
Scharnweberstr 109
13405, Berlin
2. Roles
BlueBearOS is used by companies (“customer companies”) to manage their customers, staff and appointments. For the business data a customer company enters (its customers, contacts, cases, staff and appointments), the customer company is the controller and BlueBear AI processes the data on its behalf. For user accounts and the operation of the platform itself, BlueBear AI is the controller.
3. Data we process
- Account data – name, email address and login information of people who use BlueBearOS.
- Business data – data a customer company enters: customers, contacts, sites, assets, service cases, notes, staff profiles, working hours and appointments.
- Google Calendar data – only if a calendar is connected; see section 4.
- Technical logs – error and security logs needed to run the service.
4. Google Calendar
A staff member, or a manager of their company, can connect a Google Calendar to the staff member's profile. BlueBearOS asks Google for permission to view calendars (calendar.readonly) and to create and delete events (calendar.events), and uses that access only as follows:
- Read: the calendar's identifier and the busy times (start and end) in the period being scheduled, so the staff member is not booked when they are already busy. Titles, descriptions, attendees and other event details are not read or stored.
- Write: one event per confirmed appointment, with the job, customer name, case number and time. BlueBearOS deletes that event again when the appointment is cancelled or moved. It does not change or delete events it did not create.
- Stored: the access and refresh tokens Google issues, encrypted on our servers, and the identifiers of the events BlueBearOS created. Busy times are fetched when needed and are not stored.
Calendar data is used only to schedule appointments in BlueBearOS for the staff member's own company. It is not sold, not used for advertising, not used to train AI models, and not shared with anyone except as needed to provide this feature or required by law. People at BlueBear AI do not read calendar data unless you ask us to for support, it is needed for security, or the law requires it.
BlueBearOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting: click “Disconnect” in the Calendar section of the staff page in BlueBearOS. BlueBearOS then deletes the events it created, the stored tokens and the connection. You can also remove access in your Google account settings at any time.
5. Why we process data (legal bases)
- Contract – to provide BlueBearOS to customer companies and their users (Art. 6(1)(b) GDPR).
- Consent – for connecting a Google Calendar, which you can withdraw by disconnecting (Art. 6(1)(a) GDPR).
- Legitimate interests – to keep the service secure and working (Art. 6(1)(f) GDPR).
6. Storage and security
Each customer company's data is separated from every other company's in the database. Connections use HTTPS/TLS, and OAuth tokens are encrypted at rest. Access by BlueBear AI staff is limited to operating and supporting the service.
7. Retention
Business data is kept while the customer company uses BlueBearOS and deleted after the contract ends, unless the law requires longer retention. Google Calendar tokens are deleted when the calendar is disconnected or the staff profile is removed. Events BlueBearOS created are removed from the calendar when it is disconnected.
8. Service providers
We may use hosting and infrastructure providers to run BlueBearOS; they process data only on our instructions. Google provides the Calendar API when a calendar is connected.
9. Your rights
You can ask for access to, correction, deletion, restriction or export of your personal data and object to processing. Where a customer company is the controller, we forward your request to it. Contact hello@bluebear.berlin. You can also complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.
10. Changes
We may update this policy. The current version is always at bluebear.berlin/bluebearos/privacy.html.