Privacy policy

OpenSlot is a scheduling service operated by MAKEITFLOW Agency G.P. (“we”). This policy explains what we collect when you use OpenSlot as a host (someone who publishes booking links) or as an invitee (someone who books a time), how we use it, and your choices. Questions: support@makeitflow.ca.

What we collect

• Hosts: your name, email address, username, portrait, time zone and preferences; your availability schedules, event types, questions and settings; team memberships; API tokens and webhook settings (secrets are stored encrypted).
• Connected calendars: when you connect Google Calendar or Apple iCloud Calendar we store an encrypted access credential, the list of your calendars, and which ones you chose to check for conflicts or to add events to. We read busy times (start and end only) to offer open slots, and we create, update and delete the calendar events for your OpenSlot bookings. We do not store the titles, descriptions or attendees of your other calendar events.
• Invitees: the name, email address, time zone, guests, answers to the host's questions, phone number or location you provide when booking, the page you came from and campaign (UTM) parameters, and, for embedded booking pages, the website it was embedded on.
• Technical data: server logs (such as request time, IP address and errors) used to run and secure the service. IP addresses used for rate limiting are stored only as a keyed hash.

How we use it

• To show your booking pages, calculate open times, create bookings and calendar events, and send confirmations, reminders, cancellations and reschedule notices.
• To deliver the webhooks and API access you set up.
• To keep the service secure, prevent abuse and fix problems.

We do not sell personal data, show advertising, or use your data to train AI models.

Google user data

OpenSlot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request access to your Google Calendar only to read free/busy times so invitees see open slots, and to create, update and delete the events (with Google Meet links) for your bookings. We do not use Google user data for advertising, do not sell it, do not let humans read it except with your permission, for security, or to comply with the law, and do not transfer it except as needed to provide these features. You can disconnect Google at any time from Integrations, which revokes our access, or from your Google Account settings.

Who we share it with

• The people in a booking: invitees see the host's name, the event details and location; hosts see what invitees entered. Invitees never see the details of a host's other calendar events.
• Services that run OpenSlot for us: Supabase (database and sign-in, hosted in Canada), Vercel (application hosting), Resend (email delivery), and Google or Apple when you connect their calendars. They process data only to provide their service to us.
• Your integrations: data you send to webhook URLs or read through the API goes to the systems you choose.
• The law: when required to comply with a legal obligation or protect rights and safety.

Retention and deletion

We keep your data while your account is active. You can delete your account at any time in Settings → Account: this cancels your upcoming bookings (invitees are told), removes the calendar events we created, revokes calendar access and deletes your profile, event types, schedules, connections, tokens and webhooks. Past bookings may remain visible to other people who took part in them. Invitees can ask the host, or us at support@makeitflow.ca, to delete their booking information.

Security

Data travels over HTTPS. Calendar credentials, webhook secrets and similar values are encrypted at rest (AES-256-GCM). Links in emails use unguessable tokens stored only as hashes. Access to the database is limited by row-level security.

Cookies

We use only the cookies needed to keep you signed in and to show your booking links right after you book. We do not use advertising or tracking cookies.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to its use. Most of this you can do yourself in Settings; for anything else, email support@makeitflow.ca and we'll respond within 30 days.

Children

OpenSlot is not meant for children under 16, and we don't knowingly collect their data.

Changes

We'll update this page when our practices change and change the date above. For significant changes we'll notify hosts by email.