Who we are
Matias Cristobal (Haabtime) (“Haabtime”, “we”, “us”) runs the scheduling service at this website. We are the data controller for the personal data described here. Our address is Rua Françisco Sá Carneiro 12, 1000-034 Lisboa, Portugal.
Questions or requests: [email protected].
What we collect
Haabtime has two kinds of users, and we collect different data from each.
Hosts (people who sign in with Google or Microsoft to offer bookable time):
- Your Google or Microsoft account name, email address and account ID, received when you sign in.
- OAuth tokens that let Haabtime act on your Google or Outlook calendar, stored encrypted.
- The names and IDs of the calendars on your account, and which ones you chose to check for conflicts.
- What you set up in Haabtime: your time zone, public booking link, event types (name, duration, buffers, notice, price, reminder setting) and availability rules.
- Your plan and billing status, and the Stripe customer and subscription IDs linked to you. We never see or store your card number.
- If you accept payments through Stripe: your Stripe account ID and whether it can take payments, and when you accepted the seller terms. Your identity documents and bank details go directly to Stripe, not to us.
- Your analytics choice (accepted or declined) and when you made it.
Invitees (people who book time through a host’s link):
- The name and email address you enter, your time zone, and the time you booked.
- A private link token that lets you view or cancel your booking.
- For paid bookings, the amount, currency, status and Stripe payment or refund ID, the host’s cancellation terms as shown to you, and when you accepted them and confirmed the start-of-service notice. Your card details go directly to Stripe and never reach us.
People invited to an organization (when a host invites you to join their organization):
- Your email address as entered by the host (trimmed and lower-cased), which member of the organization invited you, and when the invitation was created, accepted or revoked, and when it expires.
- A private invitation token. We store only a digest of it, never the token itself.
- The address is used only to deliver the invitation and to check that the account accepting it belongs to that address.
Technical data for everyone: IP address, browser type and request details in server logs, and error reports when something breaks (see “Who we share data with”). If you accept analytics, sampled sessions also send masked session replays to PostHog, which show the page layout, page addresses, your clicks and scrolling, and your browser and device type.
Google user data
Haabtime asks for the Google scopes email, profile and calendar. This is how each is used:
- Email and profile identify your account and fill in your name.
- Calendar lets Haabtime list your calendars, read only whether you are busy or free on the calendars you selected, create an event on your calendar when someone books you, and delete that event if the booking is cancelled.
Haabtime does not store the contents of your existing calendar events. Free/busy results are used to compute open slots and are not kept.
Haabtime’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the scheduling features you see in Haabtime. We do not sell it, use it for advertising, use it to train generalised AI models, or allow people to read it except where you ask for support, where it is needed for security or abuse investigation, or where the law requires.
You can revoke Haabtime’s access at any time in your Google Account permissions. Scheduling stops working after that; see data deletion to have your data removed as well.
Microsoft user data
If you sign in with or connect a Microsoft account, Haabtime asks for the Microsoft permissions openid, email, profile and User.Read to identify you and, if you connect your Outlook calendar, Calendars.ReadWrite and offline_access. This is how each is used:
- Identity (
openid,email,profile,User.Read) identifies your account and fills in your name and email address. - Calendar (
Calendars.ReadWrite,offline_access) lets Haabtime list your calendars, read only whether you are busy or free on the calendars you selected, create an event in a calendar named “Haabtime” when someone books you, and delete that event if the booking is cancelled.offline_accesslets this keep working without you signing in again.
Haabtime does not store the contents of your existing calendar events. Free/busy results are used to compute open slots and are not kept. We do not sell Microsoft user data or use it for advertising.
You can revoke Haabtime’s access at any time in your Microsoft account app permissions; for a work or school account, ask your organisation’s administrator. Scheduling stops working after that; see data deletion to have your data removed as well.
How we use data and why
Where the GDPR or UK GDPR applies, these are our legal bases:
- Providing the service (contract): signing you in, showing free slots, creating and cancelling bookings and calendar events, sending confirmation and reminder emails, and recording the payments hosts receive and their refunds.
- Security, fraud prevention and reliability (legitimate interests): logs, rate limiting, and error monitoring.
- Product analytics and session replay (consent): understanding how hosts use Haabtime and where bookings stall, only if you accept the cookie banner. You can withdraw at any time from Cookie settings.
- Legal obligations: keeping payment and tax records.
- Service messages: booking confirmations, reminders, cancellations and follow-ups. We do not send marketing email.
International transfers
Some providers listed above process data outside the European Economic Area and the UK, including in the United States. Where that happens we rely on an adequacy decision, the EU–US Data Privacy Framework, or the European Commission’s Standard Contractual Clauses, as applicable.
How long we keep data
- Host account data and Google and Microsoft tokens: until you delete your account or ask us to delete your data.
- Sign-ups you don’t finish: when you first sign in we email a confirmation link to the address your Google or Microsoft account gives us. Until you open it we create no account and store nothing about you. The link works for 15 minutes. Our email provider keeps its own delivery records.
- Invitations to an organization: a pending invitation expires after 7 days. Invitations that are expired, revoked or accepted, and the email address they hold, are deleted 30 days after they end. Our email provider keeps its own delivery records.
- Organization audit log: entries about membership, invitation, role and billing-seat changes are deleted 365 days after they are created.
- Booking data: while it is needed to run the booking and for the host’s records, then until deletion is requested.
- Payment and refund records: for the period tax and accounting law requires, even if you delete your account. They are kept only for that purpose.
- Server logs and error reports: only as long as needed for security and troubleshooting.
- Analytics and session replays: kept for the period configured in our PostHog project, then deleted. Withdrawing consent stops new collection; to ask us to delete data already collected, use data deletion.
- Your analytics choice: kept on your host account for as long as the account exists.
How we protect data
Traffic is encrypted with TLS. Google access and refresh tokens are encrypted in the database, and secrets are kept outside the code. Booking links use long random tokens. No system is perfectly secure; if a breach affects your data we will notify you and the regulator where the law requires.
Your rights
Depending on where you live, you can ask us to access, correct, delete, restrict or export your personal data, and object to processing based on legitimate interests. You can withdraw consent at any time where we rely on it. California residents have equivalent rights to know, delete and correct, and we do not sell or share personal data for advertising.
To use a right, follow data deletion or write to [email protected]. We reply within one month. You may also complain to your data protection authority; in the EU, this is the authority in your country of residence or work.
Children
Haabtime is not for anyone under 16. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.
Changes to this policy
We will update the date above when this policy changes. For material changes we will email hosts or show a notice in the dashboard before they take effect.
Contact
Matias Cristobal (Haabtime), Rua Françisco Sá Carneiro 12, 1000-034 Lisboa, Portugal
[email protected]