Information submitted
TwoQM receives the information you choose to provide in inquiry, intake, and domain-interest forms. TwoQM Central is the authoritative system for these submissions.
How information is used
Information is used to review requests, plan work, respond to customers, maintain business records, and protect forms from abuse.
Optional website analytics
If enabled, optional analytics requires your choice before loading Google Analytics. We measure public page visits and confirmed inquiry submissions using an opaque conversion identifier. Names, email addresses, phone numbers, messages, and uploaded files are not sent to Google Analytics. Campaign labels are limited to approved values; URL query strings and private account pages are excluded. You can clear the website’s saved analytics choice in your browser storage.
Provider boundaries
The public browser does not receive registrar or Central credentials. Domain search responses are normalized and do not expose raw provider responses.
TwoQM Central mobile app
The TwoQM app uses your existing Central account and the business workspaces you are authorized to access. Central stores account details, contacts and inquiries you manage, internal notes, support tickets, and website review activity so the same records are available on web and mobile.
Device notifications and security
If you enable app notifications, Central stores a device registration and notification token to deliver relevant updates through Apple Push Notification service or Google Firebase Cloud Messaging. Notification delivery can include a business and record identifier and a short update title. Device registrations and sessions are checked against current access. You can change notification preferences and sign out from the app.
Appointments and connected accounts
TwoQM Central lets authorized business users manage appointments, availability, and customer booking links. Appointment details, customer contact information, meeting links, and booking changes are stored with the business. Confirmation emails can include a private link for the customer to view, reschedule, or cancel their appointment.
Google user data accessed by TwoQM Central
Connecting Google Calendar is optional. With your permission, TwoQM Central accesses your primary Google calendar to check availability and manage Google Meet appointments. We request two permissions: calendar.freebusy (view calendar availability) and calendar.events.owned (view and manage events on calendars you own). Our implementation uses your primary calendar.
- Availability: We access busy start and end times to prevent overlapping bookings.
- Event information: When rescheduling an appointment, we receive Google Calendar event records and use their identifiers, start and end times, time zone, cancellation status, and free/busy status to exclude that appointment from its own conflict check. Google's response can also contain event titles, descriptions, attendees, and other event metadata. We do not copy unrelated event records into Central's CRM or display their contents to booking visitors.
- Events created by Central: We send the appointment title, start and end times, time zone, and a conference-creation request to Google. We receive and retain the event identifier, Google Meet join link, and processing status. Rescheduling updates the same event's times; cancelling deletes that application-created event from Google Calendar.
- Authorization data: We receive and store OAuth access and refresh tokens, expiry information, and granted permissions so your authorized connection continues working without repeated sign-in. We associate the connection with your Central user and business.
How Google data is used and shared
We use Google data only to provide the connected scheduling features you request: checking conflicts and creating, updating, or cancelling your appointments and Google Meet links. Appointment details and meeting links may be shown to authorized users of your business workspace and shared with the intended customer through a private appointment page and transactional confirmation email. Our hosting providers process stored service data, and our email provider processes the appointment details included in those emails. Public booking visitors see available times, not the contents of your other Google events.
We do not sell Google user data, use it for advertising, or use it to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. TwoQM Central's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
How we protect Google user data
TwoQM Central uses HTTPS to encrypt data in transit between the app, our server, and Google APIs. OAuth access and refresh tokens are encrypted at rest using server-side application encryption. Provider client secrets and tokens are kept on the server and are not included in the mobile app bundle or public website code. Server-side authorization limits access to the user's authorized business workspace and role. OAuth state validation, short-lived connection handoffs, and PKCE protect the Google connection flow. Token use also checks that the connection owner still has business access. These token protections do not mean all appointment or business records are end-to-end encrypted.
Google data retention and disconnection
Authorization tokens are retained while your connection is active. Disconnecting Google in Calendar connections removes the stored connection credentials from Central's active database and stops future access through that connection. You can also revoke TwoQM Central's access in your Google Account permissions. Disconnecting does not delete appointments, confirmation emails, or events already created in Google Calendar. Appointment history, event identifiers, and meeting links may remain with the business records for scheduling, support, and applicable recordkeeping obligations. To request deletion of retained Central information, use the privacy request options below. Retained backup copies may persist until replaced under our backup process.
Zoom meetings
If you connect Zoom and select it for an appointment, Central sends the meeting details to Zoom to create, update, or cancel the meeting and stores its identifier and join link. The join link is shared with the intended appointment participants. Zoom credentials remain encrypted on the server.
Disconnecting and deleting connected data
You can disconnect a provider in the app and revoke access in your Google or Zoom account settings. Disconnecting stops future access through that connection; it does not automatically delete existing appointments, emails, or events in your provider account. For deletion of retained Central records, use the privacy request options below.
Service providers and access
TwoQM uses hosting and service providers to operate Central. Resend handles supported email notifications; Apple and Google handle device notification delivery. Credentials stay on the server. Business records are accessible to authorized workspace users and TwoQM staff supporting the service.
Retention and privacy requests
Records are retained for business operations, support, security, and applicable obligations. You can request access, corrections, account closure, or deletion through a support ticket in TwoQM Central or the TwoQM contact form. We review requests against business ownership, other authorized users, and any records that must be retained. Signing out revokes the session; it does not delete business records.