Privacy Policy

Slot is a single-owner booking and scheduling tool, similar to a personal Calendly: it lets a guest see one person’s real availability and book a meeting directly onto that person’s calendar. Slot is operated by Badillo Ventures. If you have questions about this policy or about your data, contact luisflorez@badilloventures.com.

The owner of this Slot instance connects their Google Account so Slot can manage their calendar. When the owner authorizes that connection, Slot requests the following Google API scopes and uses the data only as described:

• Account email and identity (openid, email) — used to identify which Google account is connected and to confirm the connection succeeded. It is not used for any other purpose.
• Calendar free/busy information (calendar.readonly) — read to compute which time slots are genuinely open before they are shown to a guest. This is the only reason existing events on the owner’s calendar are ever read.
• Calendar event creation and updates (calendar.events) — used to create a calendar event on the owner’s calendar when a guest completes a booking, and to update or remove that event if the booking is later moved or cancelled. Slot only writes events that correspond to a booking made through Slot; it does not create, edit, or delete any other event on the owner’s calendar.

Slot does not access any other Google product or data type (Gmail, Drive, Contacts, etc.). Guests who book a meeting through Slot never sign in with Google and never grant Slot any access to their own Google Account.

Slot’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data obtained through the Google Calendar API is used solely to provide and improve Slot’s scheduling functionality — most importantly, showing accurate availability and creating booked meetings on the owner’s calendar. That data is never used for advertising, is never sold or transferred to third parties, is never used to train generalized artificial intelligence or machine learning models, and is not read by humans except when strictly necessary for security, legal compliance, or with the owner’s explicit consent for support purposes.

When a guest books a meeting, Slot collects the information the guest provides on the booking form: name, email address, the selected time and timezone, and any notes added for the meeting. This information is used only to hold and confirm that booking, to create the corresponding calendar event, to send booking confirmation and reminder emails, and to let the guest manage (reschedule or cancel) their own booking through the link sent to them. Guest data is visible to the owner of this Slot instance, who uses it to know who they are meeting and when. It is not sold, rented, or shared with third parties for marketing purposes, and it is not used for advertising.

Google OAuth refresh tokens are encrypted at rest using AES-256-GCM before being stored in Slot’s application database, and are decrypted only in memory, at the moment a calendar request is made. Access to the database and to server infrastructure is restricted to the owner/operator. Slot uses encrypted connections (HTTPS/TLS) for all traffic between a browser and the application, and between the application and Google’s APIs.

Slot data — including guest booking details and encrypted Google tokens — is never sold, never shared with third parties for their own purposes, and never used for advertising, ad targeting, or the training of AI/ML models, whether the data originates from Google APIs or was entered directly by a guest.

The owner can disconnect Google Calendar from Slot at any time from within the app; doing so deletes the stored OAuth tokens immediately. Access can also be revoked directly from Google at any time, independent of Slot, at myaccount.google.com/permissions. Revoking access there immediately invalidates any tokens Slot holds for that account.

Booking records (including guest name, email, and notes) are kept for as long as needed to operate the service and for the owner’s own scheduling records, and are deleted or anonymized on request. To request deletion of your data — whether you are the owner or a guest who booked a meeting — email luisflorez@badilloventures.com and the request will be honored, subject to any records legally required to be kept.

Slot uses a small number of strictly necessary cookies: a session cookie for the owner’s sign-in, and short-lived, anonymous cookies used to protect the public booking form (CSRF protection) and to hold a time slot briefly while a guest completes a booking. None of these cookies are used for advertising or cross-site tracking.

If this policy changes, the “Last updated” date at the top of this page will change accordingly. Material changes affecting how Google user data is handled will be reflected here before they take effect.

Questions, data access requests, or deletion requests can be sent to luisflorez@badilloventures.com.