Privacy Policy

1. Data controller

Kairoslot (kairoslot.com) is a scheduling service. For any question about this policy or your data, you can reach us at info@kairoslot.com.

2. What data we collect

a) Your Kairoslot account data

Email, username, password (stored as a hash, never in plain text), timezone, and the availability schedule you configure.

b) Data from people who book with you

When someone books a meeting through your public page, we store their name, email, and the meeting details (title, description, date/time, location if in-person) in order to manage that booking. The booking form is protected by Google reCAPTCHA, which receives a verification token (not the booking data) to confirm the submitter is not a bot.

c) Google data (if you connect your Google Calendar)

If you connect your Google account, we access only:

• The list of your calendars (name and identifier), so you can choose which ones to use.
• Free/busy ranges for the calendars you select — we never read the title, description, attendees, or any other detail of your existing events, only whether a slot is free or busy.
• Permission to create a new event on the calendar you designate, when you approve a booking.

d) Microsoft data (if you connect Microsoft Teams, optional)

If you enable the Microsoft Teams integration, we use your access token solely to create the online meeting link for an approved booking.

e) If you are booking a meeting and choose to connect your calendar (mutual availability)

If a host offers it, you can optionally connect your own Google Calendar for a single booking so we can show only the times when both of you are free — no Kairoslot account is required for this. We request the narrowest possible permission (free/busy only, on your primary calendar) and a short-lived, one-time authorization — we never request offline/long-term access, so no lasting credential is issued or stored beyond that single booking attempt. This connection is optional, revocable by you at any time from the booking page, and automatically deleted shortly after use.

f) If you are invited to a group meeting finder poll

A Kairoslot user can invite you by email to help find a meeting time that works for several people at once. If you don't already have a Kairoslot account, connecting your calendar for this is similar to (e) above — free/busy only, on your primary calendar — except that because the poll may stay open for several days waiting on other invitees, we request a longer-lived authorization so your availability can be re-checked once everyone has responded, rather than only once at the moment you connect. This access is automatically revoked and deleted as soon as the meeting is confirmed or the poll is cancelled, and in any case no later than 14 days after the poll was created. If you already have a Kairoslot account and are invited to a poll, we do not request any new access from Google — we ask you to explicitly confirm, in a single click while signed in, that we may check your existing connected calendar for that specific meeting.

g) If you sign in or register with Google

If you choose "Continue with Google" instead of a password, we only request your Google account ID and email address (never Calendar access) to identify you and create or access your Kairoslot account. If that email already has an existing Kairoslot account, we link it to your Google account automatically rather than creating a duplicate — Google's own confirmation that the email is verified is the basis for this.

h) If you use the contact form or report an issue

If you send us a message through the public contact form or, as a logged-in user, the "Report a problem" form, we forward your name (contact form only), email, and message directly to the operator's email inbox — this data is not stored in our database at all. The public contact form is also protected by Google reCAPTCHA, which receives a verification token to confirm you're not a bot.

i) Account activity

To operate the service and understand whether it is being used, we record a small amount of activity data about your own account: the time you last signed in, and a coarse log of your own key actions (signing in, approving or rejecting a booking, creating a group meeting poll, connecting your calendar, saving settings). This never includes anything a visitor supplied — no names, emails, or meeting details from your bookings — only the type of action and when it happened. This log is automatically deleted after 12 months, and entirely on account deletion.

j) If you connect Google Contacts to search for invitees (optional)

When creating a group meeting, you can optionally connect your Google Contacts so you can pick invitees from your own address book instead of typing every email. This is a separate connection you start yourself, independent of connecting your calendar, and requests read-only access to your contacts. As you type in the search box, we ask Google's People API for the names and email addresses of your contacts that match — used only to show you the autocomplete list, never stored. Only the addresses you actually select are saved, and only as the invitee list for that meeting. You can disconnect it at any time from the same form, which revokes the access at Google.

3. How we use Google data

We use data obtained from Google APIs exclusively to provide Kairoslot's visible functionality: showing your genuinely free slots to whoever wants to book with you, and creating the corresponding event when you approve a booking. We do not use this data for any other purpose. For the mutual availability feature described above, a visitor's free/busy data is used in-memory only, to compute overlapping slots at that moment — it is never written to our database.

Kairoslot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Who we share data with

We do not sell or share your data with third parties for advertising purposes. Data is only shared with:

• Google / Microsoft, to the extent necessary to sync your calendar or create a meeting, when you have explicitly authorized it. When a visitor connects their calendar for mutual availability, that authorization is made directly by them to Google, on our behalf, and is revocable by them at any time.
• Our email delivery provider, to notify you of new bookings and to notify requesters.
• Geoapify (EU-based), which powers the address search box shown to a requester booking an in-person meeting. Only the address text being typed is sent to Geoapify to return suggestions — no other booking or account data.

Authorized Kairoslot administrators may also access account-level data (not the content of your bookings) for support, security, and abuse-prevention purposes.

5. Retention and deletion

We keep your data while your account is active. You can disconnect Google or Microsoft at any time from Settings, which removes the stored access token. From your Settings page you can also download a copy of your data or permanently delete your account and all associated data (bookings, calendar connections) immediately and yourself, with no need to contact us. Bookings themselves are kept as long as your account is active so you have a record of past meetings; you can delete individual bookings at any time from your dashboard. A visitor's temporary calendar connection (mutual availability) is deleted and revoked at Google automatically as soon as the booking is made, or within 30 minutes if the booking is never completed — whichever comes first. A group meeting poll invitee's calendar connection is deleted and revoked automatically once the meeting is confirmed or the poll is cancelled, and in any case no later than 14 days after the poll was created. The account activity log described in section 2(i) is automatically pruned after 12 months.

6. Security

Passwords are stored as a hash (never in plain text) — including a random, unusable one generated automatically for accounts created via Google Sign-In, which never see or use it. Session cookies are HttpOnly and, in production, only transmitted over HTTPS. Access to your Google/Microsoft account is stored as an OAuth token, not as your password for those services. A visitor's temporary calendar connection is likewise stored server-side only, never in a cookie, and requested with a single read-only free/busy permission with no long-term access.

7. Your rights

You can access and export your data, correct your account details, delete your account, and revoke Kairoslot's access to Google Calendar or Microsoft Teams at any time from your Settings panel — or directly from your Google/Microsoft account settings. If you connected your calendar temporarily as a visitor booking a meeting, you can disconnect it at any time from a "Desconectar" button on the booking page, or from your own Google Account's third-party app permissions. If you are located in the European Economic Area or United Kingdom, these rights are provided to you under the GDPR (access, rectification, erasure, restriction, portability, and objection). For anything not self-service, or if you are a person who booked a meeting through a Kairoslot user's page rather than a Kairoslot account holder, contact us at the email above and we will act on your request within a reasonable timeframe.

8. Legal basis for processing

We process account and booking data on the basis of contract performance (Art. 6(1)(b) GDPR) — it is necessary to provide the scheduling service you or the person booking with you requested. This includes signing in with Google as an alternative to a password — it's simply a different way of authenticating to the same account. Where you connect Google Calendar or Microsoft Teams, processing is based on your explicit consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by disconnecting the integration. A visitor's temporary calendar connection for mutual availability is a separate, independent consent (also Art. 6(1)(a)) from the contract basis for the booking itself — declining it, or withdrawing it, does not affect your ability to book a meeting through the normal availability shown on the page. The same applies to a group meeting poll invitee's calendar connection, including for existing Kairoslot users, whose confirmation for a specific poll is a separate consent from whatever basis their original Google connection was granted under. Where an authorized administrator accesses account-level data for support or security purposes, that processing is based on our legitimate interest (Art. 6(1)(f)) in operating and securing the service.

9. Changes to this policy

If we make substantial updates to this policy, we will reflect that on this same page with a new "last updated" date.