What we collect, in short
Hosts give us their Google or Outlook account name and email, access to the calendars they choose, and the event types and availability they set up. People who book give us their name, email address and time zone. Servers keep the usual technical logs.
When a host invites someone to their organization, Haabtime stores the address the invitation is sent to, which member sent the invitation, and the dates involved. The invitation link’s token is stored only as a digest. The email goes out through Resend. A pending invitation expires after 7 days, and expired, revoked or used invitations are deleted 30 days after they end. The address is used only to deliver the invitation and to match it to the account that accepts it.
Organization owners and admins can see an audit log of membership, invitation, role and billing-seat changes. Entries hold internal ids, roles and plan or seat counts, never email addresses or names. Entries are kept for 365 days and then deleted.
The full list, with the legal basis for each item, is in the privacy policy.
No selling, no advertising, no AI training
- We do not sell personal data.
- We do not use it for advertising, and we do not run ads in Haabtime.
- We do not train AI models on it. Nothing in Haabtime sends your bookings or calendar data to an AI provider.
If that ever changes, we will say so on this page and in the privacy policy before it takes effect.
What we do not collect
- Your card number. It goes straight to Stripe and never reaches our servers.
- The contents of your calendar events. Haabtime reads only whether you are busy or free on the calendars you select, and creates and deletes the events it makes for bookings.
- Your identity documents or bank details, if you take payments. They go to Stripe.
- Addresses for marketing. We send booking emails and no marketing email.
- Analytics about people who book. Guests are not identified in analytics.
Where your data lives
The Haabtime application and its database run on Amazon Web Services in region eu-west-3 (Paris). Some of the companies we use process data elsewhere; the subprocessor list gives each one’s region, purpose and the data it handles.
Where data leaves the European Economic Area, the safeguards we rely on are described under “International transfers” in the privacy policy.
Who sees it
- The host you book sees your name, email, time zone and booking details. They are responsible for how they handle them.
- Our subprocessors process data on our instructions, only for the purposes on the subprocessor list.
- Authorities and advisers, only when the law requires or to protect our rights.
How we protect it
- Traffic to Haabtime is encrypted with TLS.
- Calendar access and refresh tokens are encrypted in the application before they are stored.
- The database is encrypted at rest.
- Booking links use long random tokens, and secrets are kept outside the code.
- Error monitoring is configured not to send request bodies or user identifiers.
No system is perfectly secure. If a breach affects your data we will notify you and the regulator where the law requires.
What you can do
- Disconnect Haabtime from your calendar at any time in your Google Account permissions. Scheduling stops working after that.
- Accept or decline analytics, and change your mind, from Cookie settings. See the cookie policy.
- Cancel a booking from the link in your confirmation email.
- Ask us to delete your data: data deletion. The same address handles access, correction and export requests.