OpenSlot · Privacy Policy

Privacy Policy

Last updated 2026-08-21. This policy explains how OpenSlot ("OpenSlot", "we") handles personal data when you use the OpenSlot website, web app, Outlook add-in and mobile companion app (the "Service").OpenSlot is the controller of account and billing data described here; for the calendar availability of you and your colleagues, your organization remains the controller and we act on your instructions within the Service.

The short version

OpenSlot reads free/busy availability only, live, to answer one question: when is everyone free? We never read event titles, bodies, attendees or attachments, and we do not store calendar data. The only things we keep are your sign-in email, billing status, display preferences and — for Team plans — the emails of people assigned seats. We do not sell personal data and we do not use advertising trackers.

1. What we collect and why

Account data — your name, email address and Microsoft account identifier, from Microsoft when you sign in. Used to create your account, show your plan, and contact you about the Service (billing receipts, renewal reminders, important changes). Legal basis: performance of our contract with you.

Calendar availability (free/busy) — for you and the colleagues you select, fetched from Microsoft Graph when you click "Find free times", processed in memory to produce the list, returned to you, and discarded. Not stored, not logged, not used for anything else. Legal basis: contract, and your organization's permissions. We use Microsoft data solely to provide the features you request, consistent with the Microsoft APIs Terms of Use.

Directory search — when you type a name, we query your organization's directory for matching names and email addresses to populate the picker. Results are shown to you and not stored.

Billing data — if you subscribe, Stripe processes your payment; we receive and store your Stripe customer ID, plan, status and renewal date (never card numbers). Legal basis: contract and legal obligations (tax and accounting records).

Preferences — timezone, working hours, window, minimum slot and toggles, stored on your account so they follow you between devices and the add-in. Legal basis: contract.

Team seats — for Team plans, the email addresses the Team owner assigns seats to, so those people receive Pro. Legal basis: the Team owner's (your organization's) legitimate interest in administering its subscription.

Technical data — our hosting provider keeps short-lived server logs (IP address, user agent, request path, timestamps) for security and reliability; we keep error logs without calendar content. Legal basis: legitimate interests in running a secure service.

Support — if you email us, we keep the correspondence to resolve your request. Legal basis: legitimate interests / contract.

2. Cookies and local storage

We use only strictly necessary cookies: an encrypted session cookie for sign-in and a short-lived state cookie during the Microsoft sign-in redirect. The Outlook add-in keeps an encrypted sign-in token and your preferences in its own browser storage. We do not use analytics, advertising or cross-site tracking cookies, so no cookie banner is needed.

3. Who we share data with (sub-processors)

Microsoft (sign-in, Microsoft Graph — your organization's Microsoft 365 tenant); Stripe, Inc. (payments, invoices, billing portal); Vercel, Inc. (hosting, US); Upstash, Inc. (database for account/billing/preference records, US); Google LLC (our support mailbox). Each processes data only as needed to provide its service to us. We may disclose data if required by law or to protect rights, safety or the Service, and in connection with a merger or sale (you will be notified). We do not sell or share personal data for advertising, and we do not use it to train AI models.

4. International transfers

The Service is hosted in the United States. If you are in the UK, EEA or Switzerland, transfers to us and our sub-processors rely on Standard Contractual Clauses (or the UK addendum) and, where applicable, the EU-US Data Privacy Framework. A data processing addendum with these terms is available to organizations on request at openslotadmin@gmail.com.

5. How long we keep data

Calendar availability: not retained. Account and preference records: while your account exists, then deleted within 30 days of a deletion request. Billing records: as long as required for tax and accounting purposes (typically 7 years) — Stripe retains transaction records under its own policy. Server logs: typically 30 days or less. Support email: up to 2 years.

6. Your rights

Depending on where you live (including under GDPR, UK GDPR and the California Consumer Privacy Act), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email openslotadmin@gmail.com from the address you signed in with; we respond within 30 days. You can revoke OpenSlot's access to your Microsoft account at any time from your Microsoft account's "Apps" page, and cancel any subscription from Manage billing. We do not discriminate against you for exercising your rights, and we do not sell personal data ("Do Not Sell or Share" requires no action). EU/UK residents may also complain to their local data-protection authority.

7. Security

TLS on every connection; Microsoft sign-in with delegated, read-only permissions (no passwords handled by us); session and add-in tokens encrypted; no calendar data at rest; card data handled entirely by Stripe (PCI DSS Level 1); least-privilege access to infrastructure. No method is perfectly secure; if we learn of a breach affecting your data we will notify you and, where required, regulators without undue delay.

8. Children

The Service is for business use and not directed to anyone under 18. We do not knowingly collect data from children.

9. Changes

We may update this policy; material changes will be posted here with a new date and, where appropriate, notified by email. Continued use after the change means you accept it.

10. Contact

Questions, requests or complaints: openslotadmin@gmail.com. See also our Terms of Service and Security & IT page.