Privacy Policy
Your data, your control. Always.
Last updated: November 2026
1. Hello: what this is
We built Tymeslot to make scheduling painless, and we'd rather you trust us than not. This page tells you exactly what we collect when you use tymeslot.app, why we collect it, who we share it with, how long we keep it, and what you can ask us to do about it.
If anything here isn't clear, please contact us.
2. Who's responsible
The person legally responsible for your data when you use tymeslot.app is:
Diletta Luna OÜ
Sepapaja 6, 15551 Tallinn, Estonia
Estonian commercial registry code 14646450
VAT number EE102132685
The supervisory authority for data protection in Estonia is Andmekaitse Inspektsioon (the Estonian Data Protection Inspectorate, aki.ee). You can lodge a complaint with them about anything we do with your data.
To reach us about anything in this policy, email (email address shown with JavaScript enabled) or use the contact form.
3. What we collect
From you
When you create an account or use the service, we collect:
- Your email address, and your name if you give it
- If you sign in with Google or GitHub, the account ID, email address and name they give us for you
- Your profile: display name, username, photo, headline, bio, language and timezone
- Your availability (weekly hours, breaks and time off)
- The booking pages you create and their settings
- Meeting details you set up (titles, descriptions, custom questions)
- The account names or email addresses of the calendars and video accounts you connect, and the Slack workspace and channel or Telegram chat you send notifications to
- Credentials and secret links for everything you connect (calendars, video providers, Slack, Telegram, webhooks), encrypted at rest with AES-256-GCM
- Your account password, stored as a one-way hash, never in plain text
- Your choice about marketing email: whether you said yes or no, when, which version of the question you saw, and when you changed your mind
- If you withdraw from your subscription, the name you give in your withdrawal statement
To have an account you need to give us your email address and a password, or sign in with Google or GitHub. Everything else is up to you, though some features can't work without it.
Automatically
When you use the site, we collect:
- IP address: used for rate limiting and abuse prevention. The address you signed up from is kept with your account until you verify your email.
- Each time you accept our terms or this policy, your IP address and browser details, as proof of that acceptance
- Browser and device info from request headers
- When something goes wrong, an error report with the page, what was sent to it and your browser details, so we can fix it
- If you've agreed to marketing emails, whether you open them
To see which pages people use and roughly where visitors come from, we use Umami, a privacy-first analytics tool, on our pages, including the dashboard and the booking pages our customers share. We run Umami ourselves, on the same Netcup servers as the rest of Tymeslot, so no analytics company is involved. Umami doesn't use cookies, doesn't fingerprint your browser and doesn't identify you. It records the address and title of each page viewed. On a booking page these include the host's public username and name, and we also note which plan the host is on. We remove anything in the address that works as a key, such as a link to cancel a meeting, before it reaches Umami. The visit statistics we show hosts for their own booking pages are a separate feature, described below. If we ever add or change an analytics provider, we'll update this section first.
When you write to us through the contact or support form, we receive your name, email address, subject and message. For an Enterprise enquiry we also receive your answers about your organisation (its type, team size, data region and main requirement). A support request sent from your dashboard is linked to your account. Your message reaches us by email, and we keep it in our support inbox for as long as we need to answer you. Our system also keeps a copy, so the email can be sent again if it fails. We delete that copy 7 days after the email reaches us. If it never does, we keep the copy for one year so we can still find and answer your message, and then delete it.
From people who book a meeting with you
When someone uses one of your booking pages, we store what they enter into the form (typically their name, email address, any phone number, company, message or custom answers you ask for, the guests they add, and their timezone and language) and the time they pick. People who answer one of your polls give us their name, email address and the times that suit them. We do this on your behalf so you can run the meeting: for this data you're the controller and we're your processor, under the data processing agreement in section 11 of our Terms. They have the same rights over their data as anyone else (see §10). If one of them asks for their data to be deleted, contact us and we'll erase it from your bookings, guest lists and polls; an upcoming booking has to be cancelled first. Otherwise we remove it two years after the meeting (see §9).
If you charge for a meeting, your invitees pay on a checkout page run by Stripe, and the money goes to your own Stripe account. Stripe receives the invitee's email address, the name and price of the meeting, and the card or other payment details they enter there, and issues the invoice in your name. Card numbers never reach our servers. We keep a record of each payment: the invitee's name and email address, the meeting type, the amount and currency, our platform fee, when it was paid, and whether it was refunded or disputed. The invitee's name and email address are removed from that record along with the rest of their details; the amounts and dates stay (see §9).
So you can see how your booking pages perform, we keep simple statistics about visits to them: which pages were viewed, where the visit came from (for example a campaign link or another website), the type of browser and device, and whether the visit led to a booking. A booking also keeps where its visit came from. To count unique visitors without cookies, we turn each visitor's IP address and browser into a short code, a fingerprint, using a random key that we create each day and delete early the next morning. We never store the IP address itself. Once a day's key is deleted, nobody can work out which IP address that day's fingerprints came from, and because each day has a new key, they can't be used to follow someone from one day or site to the next. Fingerprints recorded before October 2026 used a key that could be recreated, so this guarantee doesn't cover them. Visit records are deleted after 90 days; a booking keeps its fingerprint until the invitee's details are removed (see §9).
4. Where it comes from
Almost everything comes directly from you. The exceptions are the bits you authorise:
- • When you sign up or sign in with Google or GitHub, they tell us your account ID, name and email address. GitHub tells us every verified email address on your account, and we use one of them.
- • When you connect Google, Microsoft, Apple, or another calendar provider, we receive whatever that provider lets us read (typically your free/busy times and the events on the calendars you select), and we keep a copy of those events, including their titles, descriptions, locations and the people invited, so your availability and calendar view stay up to date.
- • When you subscribe to Pro, Stripe tells us the state of your subscription, your payments and your invoices (see §6).
- • When you take payments for bookings, Stripe tells us whether each payment went through and whether it was later refunded or disputed (see §3).
5. How we use your data, and why we're allowed to
GDPR requires us to tell you the legal basis for each thing we do. Here it is.
Run your account, host your booking pages, sync your calendars, send meeting confirmations
Basis: Contract
We can't deliver the service without doing this.
Charge for Pro subscriptions
Basis: Contract
Same reason.
Process payments for the paid bookings you set up
Basis: Contract
Paid bookings can't work without it.
Keep the service secure (rate limiting, abuse detection, fraud prevention)
Basis: Legitimate interest
We genuinely need this to keep the service usable for everyone, and you'd reasonably expect it.
Send setup tips in your first weeks: a welcome letter, reminders to connect a calendar, create a meeting type, publish your booking page and try a test booking, and a check-in after two weeks
Basis: Legitimate interest
They help you set up the account you signed up for and contain no offers. We don't track whether you open them; we check your account so we don't send a tip for a step you've already done. The unsubscribe link in any of them stops them, and marketing emails too.
Improve the product based on what works
Basis: Legitimate interest
We look at patterns across all users, such as which pages are visited and which setup steps people complete; we don't use this to make decisions about you.
Handle your withdrawal from a subscription within 14 days: use the name in your withdrawal statement, refund your payments through Stripe and email you an acknowledgement
Basis: Contract and legal obligation
Consumer law gives you this right and requires us to confirm it in writing; we offer it to every subscriber.
Answer your messages through the contact or support form, and keep a copy of each until it has reached us
Basis: Legitimate interest; pre-contractual steps for Enterprise enquiries
You wrote to us and expect an answer; the copy makes sure your message isn't lost if the email carrying it fails. An Enterprise enquiry is a step towards a contract you asked about.
Comply with tax law (keep invoices) and respond to legal requests
Basis: Legal obligation
We have to.
Send marketing emails (upgrade offers, feature tours, a nudge to share your booking link, and product announcements) and see whether they're opened
Basis: Consent
Only if you say yes in your dashboard, apart from the existing customers in the next row. Change your mind any time under Email preferences, or with the unsubscribe link in every one.
Send the same marketing emails, without seeing whether they're opened, to people whose account predates our question about marketing email and who haven't answered it
Basis: Legitimate interest (existing customers)
You were already a customer when we started asking, and the law lets a business email its customers about its own similar service as long as they can say no. Say no any time under Email preferences, or with the unsubscribe link in every one, and they stop.
Keep a record of your answer about marketing email (yes or no, when, which version of the question, and when you changed your mind)
Basis: Legal obligation
We have to be able to show what you agreed to. After your account is deleted we keep a minimal record of it for 3 years, in case that is ever disputed.
We do not make automated decisions about you with significant effects: no AI scoring, no profiling that affects what you can do.
6. Who we share your data with
We use four mandatory third-party services to run Tymeslot. Every account is exposed to all four; you can't opt out of them and stay on tymeslot.app.
Stripe Payments Europe Ltd
Subscription billing and payments for paid bookings
Card numbers never touch our servers. Stripe's parent company is in the US, and any transfer of personal data outside the EU happens under the EU's Standard Contractual Clauses (SCCs).
Postmark (ActiveCampaign)
Email delivery (booking confirmations, password resets, account and billing notifications, setup tips, marketing emails, and the messages you send us through the contact and support forms)
Postmark records when an email is delivered or bounces. For marketing emails sent to people who agreed to receive them, it also records when an email is opened, using a small image inside it; we use this to see which emails are useful. No other email we send is tracked for opens: not booking confirmations, password resets, account or billing emails, reminders, or the setup tips we send in your first weeks. Links in our emails are never tracked. US-based; transfers happen under SCCs.
Google reCAPTCHA
Bot protection on sign-up, the contact form, and booking and poll pages
On booking and poll pages it loads only once a visitor starts filling in the form, so someone who only browses sends Google nothing. Google may set its own cookie when it loads. US-based; transfers happen under SCCs.
What Stripe receives, and what we keep
Pro subscriptions. When you subscribe, Stripe receives your email address, the plan you choose, your card or other payment details, and any billing name, address or VAT number you enter at checkout. It uses them to charge you, work out tax where it applies, and issue your invoices. We keep your Stripe customer and subscription references; your plan, billing interval, trial and billing-period dates, and whether the subscription is active or cancelled; a record of each payment (amount, status, Stripe's reference, your name and email address, and the billing address, country, VAT number and type of payment method you used); each invoice's number, amount, dates and status, with Stripe's link to it; and, if a payment is ever disputed, the dispute's amount, reason and status.
Paid bookings. Payments for your booking pages go through your own Stripe account, which you connect to Tymeslot. We keep its Stripe reference, its country and currency, and whether it can take payments, together with the payment records described in §3.
Sub-processors change occasionally as we add features or move services. When they do, we update this list and publish a new version of this Privacy Policy, which you're asked to accept. For a copy of the Standard Contractual Clauses we rely on, ask us through the contact form.
We never sell your personal information.
We also don't share it with anyone except the four providers above and the integrations you choose to connect (see §7), unless we're legally required to (e.g. a court order).
7. Integrations you choose to connect
Tymeslot lets you plug into a calendar (Google, Outlook, Microsoft Exchange, Apple iCloud, any CalDAV-compatible server such as Nextcloud, Mailbox.org, Radicale, Baikal, Zimbra or your own, or a calendar feed you add by its link), a video provider (Google Meet, Microsoft Teams, Zoom, Jitsi Meet, kMeet, Nextcloud Talk, MiroTalk, or any custom URL you supply), notification channels (Slack, Telegram, or webhooks sent to an address you choose), and your own Stripe account for paid bookings.
You can also sign in with Google or GitHub instead of a password. When you connect one of these, your data flows to that provider because you authorised it. You decide which integrations are active, and you can disconnect any of them from your dashboard. Your relationship with that provider is governed by their own terms and privacy policy; we're not a party to it.
8. Data security
We're a small team and we take security seriously without overclaiming.
All traffic to and from tymeslot.app uses HTTPS.
Calendar and video credentials are encrypted at rest with AES-256-GCM.
Passwords are stored as one-way hashes, so we can't read them, even if we wanted to.
Sensitive endpoints (login, sign-up, password reset, contact form) are rate-limited.
Bot protection (reCAPTCHA) on sign-up, the contact form, and booking and poll pages.
Logs are scrubbed of secrets before they're written.
We don't currently offer two-factor authentication on your Tymeslot account itself; it's something we want to add. If your connected accounts (Google, Microsoft, etc.) support 2FA, we strongly recommend enabling it there.
9. How long we keep your data
As long as your account is open.
Deleted 14 days after you ask, unless you restore the account before then.
Kept for 30 days, then deleted.
Kept while your account is open, because tax and commercial law require them. Once the account is deleted, we delete each one 10 years after the end of the year it belongs to, or straight away if that date has passed.
Your answer about marketing email, and any unsubscribe, are kept while your account is open. When the account is deleted, we keep a minimal record of your marketing consent (your email address, account ID, when you gave, declined or withdrew consent, and which version of the wording you saw) for 3 years, so we can show that consent was given or withdrawn if that is ever disputed, and then delete it. If you withdraw from your subscription, we use the name in your statement only to send your acknowledgement and delete our copy within 7 days. We keep a record of the withdrawal itself (which subscription, when you sent it and what we refunded, without your name) with your subscription records.
Visit statistics for booking pages: 90 days. Records of notifications sent to your webhooks, Slack or Telegram: 60 days. Payment notifications from Stripe: 90 days. Error reports: until 60 days after the error was last seen. Background tasks, including emails waiting to be sent: 7 days after they finish. Sign-ups never verified: deleted after 30 days, or once the last meeting booked with them is over, if that is later.
The copy we store of each message sent through the contact or support form: 7 days after its email reaches us, or one year after you send it if the email never does, whether or not you still have an account, and then deleted. The email in our support inbox is kept for as long as we need to answer you.
Two years after a meeting ends, or after the last time proposed in a poll, we remove what your invitees gave us: their names, email addresses, phone numbers, messages and answers. The meeting itself stays without them (its time, type and status), so your statistics still add up. The payment record of a paid booking loses the invitee's name and email address at the same time, and keeps its amounts and dates as part of your payment records.
You can delete your account yourself in your dashboard, under Account settings, by confirming with your password or, if your account has no password, by typing its email address. For the next 14 days it is frozen: your booking page goes offline, nobody can book you, and signing in lets you restore everything. After that we permanently delete the account and its data, including your bookings and the details your guests gave you. Upcoming bookings are deleted with your account and your guests are not told, so let them know if a meeting won't take place.
Your Pro subscription stops renewing as soon as you ask. If you restore the account, it renews again, unless you had cancelled it yourself before. When the account is deleted, we cancel any subscription that is still running and delete your customer records at Stripe (Stripe keeps the invoices it issued). If you took payments for bookings, we stop using your Stripe account; it's your own, so it stays open at Stripe.
We also withdraw the access you gave us to Google, Zoom and Slack, where the provider lets us. If another Tymeslot account uses the same Google or Zoom account or Slack workspace, we delete your stored credentials instead and leave that shared access in place. Microsoft doesn't let us withdraw access, so we delete the stored credentials, which leaves the access unusable; you can also remove it in your Microsoft account.
If you tell us why you're leaving, we keep your answer with your account and throw it away if you restore the account. Once the account is deleted, we keep only the reason you chose, any comment you wrote and the month of the deletion, with nothing that links them to you.
Some records stay after the account is deleted, because the law requires them or protects us with them:
- Your payment records, including those of your paid bookings, keep your name and email address, because a tax record has to say who it was for. Those of your paid bookings lose your invitees' names and email addresses. These records and your invoices are deleted at the end of the period above.
- The records of your subscription, of any withdrawal from it and of any payment dispute, none of which holds your contact details.
- The record that you accepted our terms and this policy, without your IP address or browser details.
- The minimal record of your marketing consent, deleted 3 years after the account.
- The copy of any message you sent us through the contact or support form, deleted 7 days after it reached us, or a year after you sent it if it never did.
- Backups, deleted after 30 days.
If you can't sign in, ask us through the contact form and we'll delete the account for you. We try to act on these within a few working days.
10. Your rights
Under GDPR you have the right to:
Get a copy of the personal data we hold about you.
Correct anything that's wrong.
Ask us to delete your data ("right to be forgotten").
Ask us to pause certain uses.
Get your data in a structured, machine-readable form.
Object to processing based on legitimate interest. Marketing email sent to you as an existing customer stops as soon as you turn it off under Email preferences or use the unsubscribe link in one.
For anything we do based on your consent. Withdrawing doesn't affect what we did before. For marketing email, turn it off under Email preferences in your dashboard, or use the unsubscribe link in any marketing email.
With the Estonian supervisory authority (AKI, aki.ee) or the equivalent in your country.
To exercise any of these, use the contact form. We respond within one month (in complex cases the law lets us take up to two months more, and we'd tell you why).
These rights apply equally to people who book meetings via Tymeslot booking pages; you don't need a Tymeslot account to use them.
11. Cookies
We set one cookie ourselves: a session cookie that keeps you logged in, remembers your language, where you are in signing up and the page to return to after signing in, and protects our forms against cross-site request forgery. On a booking page it also remembers which site sent you there, for the host's visit statistics. When you start filling in a form protected by reCAPTCHA (sign-up, the contact form, or a booking or poll page), Google's script loads and may set its own cookie to tell people and bots apart. On booking pages with a moving background, your browser also remembers whether you paused it. That's it.
Our site analytics (Umami) use no cookies, and neither they nor the visit statistics for booking pages track you across sites.
12. Children
Tymeslot is not for under-16s. We don't have an age check at sign-up, so we rely on you not creating an account for a child. If you find out a child has created an account, please tell us and we'll delete it.
13. Open-source transparency
The Tymeslot Core scheduling engine (the part that handles your bookings, your calendar sync, and your data) is open source on GitHub. You can read exactly what it does and how. The SaaS-specific layer (billing, marketing pages, this very document) is closed source and lives in a private repo.
14. Changes to this policy
We may update this policy. Every change, however small, is published as a new version, and you'll be asked to accept it before you carry on using your dashboard. We keep a record of every version and of when you accepted it.