Privacy Policy

1. Introduction

Welcome to NextAvailableSlot. We are committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and scheduling platform. By using the service, you consent to the data practices described in this policy.

2. Information We Collect

The information we collect depends on your relationship with NextAvailableSlot. We classify our users into three main groups:

3. Calendar Integration & API Scope Disclosure

Connecting an external calendar is optional. For users who choose to, NextAvailableSlot integrates with Google Calendar and Microsoft Outlook to provide automated, conflict-free scheduling. Connecting one provider never grants access to the other, and you may connect neither.

Google Calendar. We request the following specific permissions:

• Conflict Prevention (calendar.calendarlist.readonly and calendar.freebusy):We read your calendar list and busy time blocks to ensure clients can only book times when you are actually free. We do not read or store private event details, descriptions, or attendee lists.
• Instant Event Creation (calendar.events):When a client books a slot, NextAvailableSlot automatically creates a new calendar event on your Google Calendar so it appears immediately in your schedule.
• Automatic Syncing and Updates:If you reschedule or cancel an appointment through the NextAvailableSlot dashboard, the changes are written directly to your Google Calendar to keep both calendars synchronized.
• Control:You can disconnect your calendar and revoke NextAvailableSlot's access at any time via your Account settings.

Microsoft Outlook. If you connect an Outlook or Microsoft 365 calendar instead, we request Calendars.ReadWrite to list your calendars, read your busy time blocks, and create, update and remove the events NextAvailableSlot itself creates; User.Read to identify the connected account; and offline_access so syncing continues without asking you to sign in again. We do not request permission to create Teams meetings. As with Google, we read busy time blocks rather than the contents of your other meetings.

Retention and deletion of calendar data: we store the access and refresh tokens for the calendar you connected, the identity of that calendar, and a cache of busy time blocks used to check availability. When you disconnect a calendar, we stop the sync subscription and delete those tokens and the cached busy data. Deleting your account removes them as well.

Artificial intelligence and machine learning:data obtained through the Google Calendar API or the Microsoft Graph API — whether raw, aggregated, anonymised or derived from it — is never used to develop, train, improve or evaluate any artificial-intelligence or machine-learning model, generalised or personalised, whether ours or anyone else's. It is never sent to any AI or machine-learning service, first-party or third-party. That is a property of how the product is built rather than a promise about how it is operated: the AI features described below are reached from code paths that are never given a calendar token and never receive calendar records, so there is no configuration of this product in which calendar data could reach a model.

Which AI services we use, and on what data. NextAvailableSlot uses exactly one AI provider: the Google Gemini API (model gemini-2.5-flash), called directly on a paid, billed Google Cloud project — not through any aggregator, gateway, model hub or reseller, and with no other model provider behind it. Under the paid-tier Gemini API terms, Google does not use the prompts or responses to train its models. It is used for two things only: (1) turning the public web page at a business address you give us into a draft business profile during setup, and (2) reading the brand colours off that same public page to suggest a theme. The only inputs are the text you type and the content of the public website you asked us to look at. No calendar data, no client records, no booking history and no email content are ever included in a prompt.

Google API Services User Data Policy Compliance: NextAvailableSlot's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell or transfer your calendar data to data brokers, use it for advertising of any kind, or use it for any purpose other than providing and improving the scheduling features you connected it for. No human reads your calendar data except where you have given specific consent, where it is necessary for security purposes such as investigating abuse, or where we are compelled to by law.

4. How We Use Your Information

We process personal data to fulfill our contract to you and for our legitimate business purposes, including:

• Facilitating appointment scheduling, reminder notifications, and booking status confirmations.
• Enforcing active personnel limits and subscription billing parameters based on your business tier.
• Processing payments, pack enrollments, and payout allocations via third-party secure systems.
• Securing the service against fraud, abuse, and system exploitation.
• Optimizing and analyzing platform performance, design layout flow, and usability.

5. Data Sharing and Subprocessors

We do not sell your personal data. We share information only with trusted service providers who help us run our platform:

• Hosting & Storage: Google Cloud Platform and Firebase database environments for secure data persistence.
• Authentication: Firebase Authentication services for user account verification.
• Payment Processing: Secure transaction processors (such as Stripe) for billing and staff payout disbursements.
• Notifications: Email delivery services for transaction receipts and booking updates.
• Analytics: Google Analytics, only with your consent (see Cookies & Analytics below).
• Calendar providers you connect: where you connect Google Calendar or Microsoft Outlook, booking details you create in NextAvailableSlot are written to that calendar so it stays in step. This happens only for the account you connected, and only while it stays connected.

6. Cookies & Analytics

We use Google Analytics to understand how the platform is used. It runs only after you accept the cookie banner; if you decline, no analytics cookies are set and nothing is sent to Google. You can change your choice at any time using the “Do Not Sell or Share My Personal Info” control in our footer or below.

• What is recorded: the pages you visit, which part of the product you are in (for example booking, or the owner dashboard), and whether you are signed in as a business owner, professional or client.
• What is never sent: your name, email address, phone number, user ID, or the business you belong to.
• Essential cookies: sign-in sessions and security (reCAPTCHA) cookies are required for the service to work and do not depend on the banner.
• Global Privacy Control (GPC): If your browser transmits a recognized GPC signal, we automatically treat analytics cookies and third-party data sharing as opted-out.

7. Your Rights & Choices (GDPR, CCPA/CPRA & US State Laws)

Depending on your location, you may have rights regarding your personal information, including the right to access, correct, limit the use of, or request the deletion of your personal data.

• EEA / GDPR: Residents have the right to data portability, rectification, deletion (''Right to be Forgotten''), and restriction of processing.
• California / CCPA & CPRA (“Do Not Sell or Share My Personal Information”):California and other US state residents have the right to opt out of the “sale” or “sharing” of personal information. NextAvailableSlot does not sell personal information for monetary compensation. To the extent third-party analytics cookies may constitute “sharing” under applicable law, you may opt out at any time.
• Action: You can manage and update most account information directly inside your dashboard settings, or request account closure and deletion by contacting us.

8. Data Retention & Security

We retain your personal data only for as long as your account remains active or as required to comply with legal obligations and settle disputes. We apply standard industry security protocols, including transport encryption (HTTPS) and secure database policies, to protect all personal information.

9. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the ''Last Updated'' timestamp at the top.