Privacy policy

Updated November 11, 2026.

Moran & Fisher CRM is an internal desk for Moran & Fisher Law. BMG AI Consulting operates it for the firm. This page is public so the Google connection can be reviewed. The rest of the desk is only for staff who have been given an account. There is no public signup.

Google account access

When a partner or an admin connects Google Calendar, the app asks for two permissions and no others:

https://www.googleapis.com/auth/calendar.events — view and edit events on the calendars that Google account can access.
https://www.googleapis.com/auth/calendar.freebusy — see whether a time is busy or free. That check does not include event titles, guests, or notes.

The app does not ask for Gmail, Drive, Contacts, or a Google profile scope. The connected address is the id of the primary calendar, which Google returns with the calendar permission above.

What is read, and why

The primary calendar’s address, so Settings can show which Google account is connected.
Busy and free times on that calendar, so a consult is not booked on top of something already there.
Events in the date range on screen: title, start, location, a link back to Google Calendar, and whether the event was cancelled. Today’s docket and the calendar page show these. Cancelled events are skipped.

What is written, and why

The app writes only events it created, on the primary calendar:

A timed event when a consult is booked. The title is “Consult:” plus the caller’s name. The description has the caller’s name, phone, reason, a short call summary, and a link back to that call in the CRM. The time is Eastern time.
An all-day event for an open task that has a due date and is assigned to the person whose calendar is connected. It carries the task title, the task notes, the matter name and case number when there is one, a link to the task list, and a reminder at 9:00 AM the day before. The event is updated when that task changes, and removed when the task is finished, archived, reassigned, or the date is cleared.

Events the CRM did not create are shown. They are not edited or deleted.

What we do not do with Google data

We do not sell it.
We do not share it with advertisers, data brokers, or other apps.
We do not use it for advertising.
We do not use it to train AI models, and we do not send it to an AI provider.
A signed-in person at the firm sees it on their own desk. We do not give it to anyone else to read, except if the law requires it or if a record has to be looked at to fix a security problem.

Google API Services User Data Policy

Moran & Fisher CRM’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain language: Google user data is used only to provide the calendar features that are visible in this CRM. It is not transferred except as needed to provide those features, to secure the service, to comply with the law, or as part of a merger with notice. It is not used for serving advertisements. Humans do not read it except a signed-in firm user looking at the desk, for security, to comply with the law, or with the user’s permission.

Storage

The refresh token and the short-lived access token are encrypted (AES-256-GCM) before they are saved in the CRM’s data store.
The connected email address, the permissions granted, who connected the calendar, and when, are stored with that connection.
A Google event id is stored on a task or meeting so the CRM can update or remove the event it created.
Lists of events are kept in server memory for about a minute so a page can reload. They are not copied into the matter file.

Retention

The connection is kept until a partner or an admin disconnects it in Settings, or until Google rejects the refresh token. Disconnecting deletes the stored tokens from the CRM. Events already on the Google Calendar stay there until someone deletes them in Google Calendar. A rejected refresh token is marked disconnected. The CRM stops calling Google with it and asks for a reconnect. Connecting again replaces the old tokens.

Revoking access

In the CRM: Settings, then Integrations, then Disconnect. A partner or an admin can do this.
In Google: Google Account, then Security, then Third-party access, at myaccount.google.com/permissions. Remove Moran & Fisher CRM.

After Google revokes access, or after a refresh token expires, the desk shows that Google Calendar is disconnected and links to Settings to reconnect.

Other records

The CRM also holds the firm’s own records, such as people, intakes, matters, calls, and tasks. Those are for staff who can sign in. This policy does not describe a security certification. It describes what this app actually does with Google user data.

Contact

BMG AI Consulting
45 Glenridge Ct
Chagrin Falls, OH 44022
garrin@bmgaiconsulting.com