Home › Security & Google account access

Security and Google account access

Effective date: August 27, 2026

Last updated: August 27, 2026

WyzeBiz connects to accounts a business already owns so that follow-up goes out from

the address, calendar, and channels its customers already recognize. Every connection

is optional, each one is made by the business itself, and each can be undone at any

time.

This page lists every permission the application requests, and the feature that

justifies it. The [Privacy Policy](/privacy/) governs the handling of that data and

takes precedence where the two overlap.

Email

Connecting a mailbox is what lets a business send follow-up from its own address, so

replies come back to the business rather than to a platform inbox its customers have

never heard of.

Sending mail (https://www.googleapis.com/auth/gmail.send). Delivers the follow-up campaigns the business

itself wrote and approved. Nothing is sent that the business did not configure.

Reading mail (https://www.googleapis.com/auth/gmail.readonly). Notices when a lead replies, so the sequence

stops automatically, and, where the business turns it on, creates a lead when a new

inquiry arrives. Bulk and automated mail is filtered out rather than captured.

Marking a message read (https://www.googleapis.com/auth/gmail.modify). Write access, which we name explicitly

because it is broader than reading and sending. The application uses it for a single

operation: removing the unread marker from a message it has already processed, so the

mailbox reflects what has been handled. It does not label, archive, move, or delete

mail. The permission itself cannot permanently delete mail or bypass Trash.

Scheduling

Calendar (https://www.googleapis.com/auth/calendar). Creates, updates, and

cancels the appointments a business books through the application, so they appear on

the calendar it connected. Existing events are read only to check availability for

that scheduling. This is full read and write access to the connected calendar, which

is what creating and cancelling an event requires. It applies only where a calendar

is connected, and the feature can be left off.

Reviews

Google Business Profile (https://www.googleapis.com/auth/business.manage). Reads customer reviews for the locations a business connects and posts replies the

business wrote or approved. It applies only to the locations configured. Nothing else

on the profile is created, edited, or deleted, and nothing is posted that the business

has not approved. It applies only where a location is connected, and the feature can

be left off.

Social publishing

Publishing to YouTube (https://www.googleapis.com/auth/youtube.upload). Uploads a video the business created and scheduled in the application to the YouTube

channel it connected. Nothing is uploaded that the business did not schedule.

Reading the connected channel (https://www.googleapis.com/auth/youtube.readonly). Identifies the channel the business connected and confirms an upload succeeded. We

do not read analytics, comments, or any channel the business has not connected.

Social publishing is not limited to Google. Where a business enables it, the same

feature can post to a connected Facebook Page, Instagram account, or TikTok account.

Those connections use each platform's own authorization, are listed in the

[Privacy Policy](/privacy/) sub-processor table, and are equally optional.

How the data is handled

Limited Use. Our use of information received from Google APIs adheres to the

Google API Services User Data Policy,

including the Limited Use requirements.

No advertising. Google user data is not used for advertising, and the application

serves no advertising.

No sale. Google user data is never sold, and contact data is never sold.
No model training. Google user data is never used to develop, improve, or train

generalized AI or machine-learning models.

No human reading. Our personnel do not read a customer's mail, calendar entries,

review inbox, or channel content. Access by a person happens only with explicit

consent for a specific support request, where necessary to investigate abuse, or where

required by law.

Encrypted and isolated. OAuth credentials are stored encrypted and scoped to a

single business. There is no shared credential pool and no cross-tenant access.

Disconnecting

A connected mailbox, calendar, business location, or channel can be disconnected at any

time from the product's settings, which revokes the stored credentials immediately.

Access can also be revoked directly from the Google Account permissions page at

myaccount.google.com/permissions.

On disconnection, stored credentials are deleted immediately. Data already captured as

leads or conversation history stays under the business's control and is deleted on the

retention schedule in the [Privacy Policy](/privacy/), or on request.

Questions

Write to [support@wyzebiz.com](mailto:support@wyzebiz.com). A person answers, and we

will point you at the exact clause in the policy.