Privacy Policy — OpenSlot

What this app does. OpenSlot gives a local business a booking page. Customers pick a service, staff member, date and time, and leave a name and phone number. The business owner connects their Google Calendar so bookings appear on their calendar and times that are already busy cannot be booked.

How we use it. Calendar data is used only to run the booking features above, for the business whose owner connected that calendar. It is not sold, not used for advertising, and not used to train AI models. We do not share a business's calendar data with any other business — each owner's calendar is theirs alone.

Storage and retention. Bookings and shop settings are stored in the app's database (Supabase, via Lovable Cloud). A booking keeps the customer's name, phone number, and — only if the customer chooses to leave one — email address, plus the service, staff member, date, time, price, and any notes, and the ID of the Google Calendar event created for that booking. Shop settings (business name, address, phone, services, staff, hours, and message wording) are stored in the same database. We do not set a fixed automatic deletion date for bookings: a booking stays in the database until the owner cancels or deletes it, and cancelling a booking deletes it from the database and deletes its Google Calendar event. Email-reminder records for a booking (the planned 24-hour and 2-hour reminders, whether each was sent, and any send error) are stored in the same database and are deleted together with the booking. The Google Calendar connection is not stored as a Google password or as a Google token in our database. The app stores one encrypted connection key for the owner's Google Calendar (AES-256-GCM encryption, key held in the server environment), which Lovable's connector service uses to call Google Calendar on the owner's behalf. Disconnecting Google Calendar in the Owner dashboard deletes that stored key and asks Lovable's connector service to disconnect the calendar; the owner can also revoke access at myaccount.google.com/permissions. Disconnecting does not delete bookings already made or their Google Calendar events — those stay until the owner cancels them. Calendar events themselves live on Google Calendar, not in our database; when the app checks availability it reads the owner's events for the day being booked and keeps only the busy start and end times for that check, and it does not store the titles or details of the owner's other calendar events.

Disconnecting. The owner can disconnect Google Calendar from the Owner dashboard at any time, and can also revoke access at myaccount.google.com/permissions. Disconnecting stops new bookings from being written to the calendar; existing bookings already made stay in the app unless cancelled there.

Customer data. A customer who books leaves a name and phone number, and an email address only if they choose to leave one, visible only to that business's owner, for running that appointment. We do not sell customer data or share it with other businesses.

Children. The service is for businesses and their adult customers, not for children under 13.

Changes. If this policy changes, the date above will be updated and the current version will stay at this URL.

Google API Services User Data Policy. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.