Privacy Policy

1. Who we are

OpenBookings (openbookings.ai) is operated by 10356689 Canada Inc., operating as MicroAngel, 138 rue Tobago, Dollard-des-Ormeaux QC H9G 2X5, Canada ("OpenBookings", "we", "us"). We are responsible for the personal information described in this policy.

Our person in charge of the protection of personal information, as required by Quebec's Act respecting the protection of personal information in the private sector (Law 25), is Eyal Toledano. You can reach us at hello@openbookings.ai or by mail at the address above. Write to him for any question, request or complaint about privacy.

2. The short version

• When you book, the business you book receives your name, your contact details and any notes you add. That is the main reason we collect them.
• We keep the searches people make (service, area and time) to learn where demand is, but we do not attach your name to them.
• We do not sell personal information, and we do not use it for advertising.
• Businesses that connect Google Calendar give us access to their free and busy times and let us add and cancel the booking events we create. We never read the contents of their other events, and we never use Google data for ads or to train AI models.
• You can ask us to see, correct, export or delete your information at any time.

3. Information we collect

People who search or book. Most people reach us through an AI assistant such as ChatGPT, Claude or Grok, which calls our booking service on their behalf. Others use our website. We collect:

• Booking details: your name, your email address or phone number (or both), party size, any notes you add, the service, the business, the date and time, your language and a confirmation code.
• Search requests: the service you asked for, the area or place you named, the time window, the approximate coordinates of that area, which businesses we returned and in what order, and which app sent the request (for example "ChatGPT"). We do not ask for your name to search, and we do not link searches to bookings by name.

We do not receive your conversation with your AI assistant. We only receive the request your assistant sends to us.

Businesses. When you claim or create a listing we collect your business name, address and neighbourhood, the email address you claim with, and optionally a phone number and website. We also keep the services, prices, hours and booking rules you set, your language, whether you agreed to receive news from us, and the calendar connection described in section 7.

Public business information. To build listings before a business claims them, we collect business information that is published publicly, such as a business name, address, phone number, website and a business email address published on the business's own website or directory listings. We record where each published email came from so we can respect anti-spam law (see section 13).

Our administrators. Staff who sign in to our admin area do so with Google sign-in. We receive their name, email address and profile picture from Google for that purpose only.

Technical information. We use your IP address to limit how many requests one source can make, to stop abuse. We keep it in server memory for a few minutes and do not save it in our database. Our hosting providers may keep standard access logs that include IP addresses for a short period for security.

4. How we use information

• To find openings and make, show, change and cancel bookings, and to send the booking details to the business you chose.
• To let businesses claim and manage their listing, including sending sign-in links by email.
• To understand demand: we count searches by service, area and time to decide where to recruit businesses and which services to support. These reports use search data without names.
• To keep the service secure, prevent fraud and abuse, and fix problems.
• To contact businesses about OpenBookings when anti-spam law allows it (section 13).
• To meet legal obligations and to establish or defend legal claims.

Where the GDPR or a similar law applies, we rely on these legal bases: performing the booking you ask for (contract), our legitimate interests in running a safe and useful service and understanding demand, your consent where we ask for it (for example, news emails), and legal obligations.

Openings are ranked automatically by how soon they start and how close they are. This ranking is not a decision about you and has no legal or similarly significant effect on you. Businesses cannot pay to rank higher.

5. AI assistants

When you use OpenBookings through an AI assistant, the assistant's provider (for example OpenAI, Anthropic or xAI) processes your conversation under its own privacy policy. We are not responsible for how those providers handle your conversation. We send back to the assistant the openings we found and, after you book, the booking details and confirmation code so the assistant can show them to you.

We do not use the personal information we receive through AI assistants to train AI models.

6. Who we share information with

• The business you book. It receives your name, contact details, party size, notes and the booking time, usually as an event in its own calendar or booking system.
• Your AI assistant, as described in section 5.
• Service providers that process information for us under contract and only on our instructions: hosting and database providers, Nango (which runs calendar connections and stores the access tokens for them), Cloudflare (email delivery) and Google (sign-in for our administrators, and the calendar API when a business connects Google Calendar).
• Authorities or others when the law requires it, or when it is necessary to protect the rights, safety or property of people or of OpenBookings.
• A buyer or successor if OpenBookings is involved in a merger, acquisition or sale of assets. For Google user data, we would ask for your explicit consent first.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

7. Google user data (Google Calendar)

This section applies to businesses that connect a Google Calendar so customers can book them. It describes every way OpenBookings accesses, uses, stores and shares Google user data.

Limited Use. OpenBookings' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will also adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

What we access. When you connect, you sign in with Google and grant two permissions:

• "See the availability on Google Calendars you have access to" (calendar.freebusy). We read only the start and end times of busy periods on the calendar you connect. This permission does not show us event titles, descriptions, locations or attendees.
• "View and edit events on all your calendars" (calendar.events). We use it only to add an event for each booking made through OpenBookings, to delete that same event if the booking is cancelled, and, once when you connect, to read the name of your primary calendar (normally your Google account's email address) so we can show you which account is connected. We request only the calendar's name in that call, not any events. We do not read, change or delete any event that OpenBookings did not create.

Why we access it. Only to provide the booking feature you set up: to show people searching through AI assistants or our website the times when you are free, and to put each booking into your calendar so you see it right away. We do not use Google user data for any other purpose.

What we store. Free and busy times are read when someone searches and are used in memory to calculate openings; we do not store them. We store the connected calendar's identifier and name, the identifier of each event we create (so we can remove it if the booking is cancelled), and the identifier of your connection at Nango. The Google access and refresh tokens are stored, encrypted, by Nango, our connection provider, and not in our own database.

What appears in the events we create. Each event contains the service, the customer's name, contact details, party size and notes, and the booking time. That information comes from the customer, not from Google.

Who we share it with. The only Google-derived information others see is the resulting open time slots, which we show to people searching, because that is the purpose of the feature. Nango processes the connection and tokens on our behalf as a service provider. We do not transfer Google user data to anyone else, except to comply with the law, for security purposes such as investigating abuse, or as part of a merger, acquisition or sale of assets with your explicit prior consent.

No human access. Our staff do not read Google user data, unless you ask us to and agree to it for a specific support request, it is necessary for security purposes such as investigating a bug or abuse, it is required by law, or the data is aggregated and anonymized for internal operations.

No ads, no sale, no AI training. We never sell Google user data. We never use it, or transfer it, for advertising, including retargeting or personalized or interest-based ads. We never use it to determine creditworthiness or for lending. We never use it to create, train or improve any artificial intelligence or machine learning model.

Retention and deletion. You can disconnect your calendar at any time from your listing's management page. Disconnecting deletes the connection, including the tokens held by Nango, and removes the calendar identifier and name from our records immediately. You can also remove OpenBookings' access at any time from your Google Account at myaccount.google.com/permissions. Event identifiers stay attached to their booking records until those records are deleted under section 9, so we can still cancel a booked event if needed. If you want all Google-derived data deleted sooner, email hello@openbookings.ai and we will delete it within 30 days. Events already added to your calendar belong to you and stay there unless you delete them.

8. Where information is stored

OpenBookings is run from Quebec, Canada. Our service providers, including our hosting, database, connection and email providers, may store or process information in other provinces, in the United States or in other countries. Before we communicate personal information outside Quebec, we assess whether it will receive adequate protection, as Law 25 requires, and we use contracts that require providers to protect it. Information stored in another country may be accessible to the authorities of that country under its laws.

9. How long we keep information

• Booking records: 24 months after the appointment date, then deleted or anonymized. Businesses keep their own copy in their calendar.
• Search records: 13 months, then kept only as aggregate counts that identify no one.
• Sign-in links: only a fingerprint (hash) of each link is stored, and it expires within minutes.
• Business listings and settings: while the listing is active. If you ask us to remove your listing, we delete it within 30 days, except what we must keep for the law.
• Consent and unsubscribe records: as long as needed to prove consent and to honour unsubscribe requests, which is at least three years after our last message.
• IP addresses used for rate limiting: a few minutes, in memory only.
• Google user data: as described in section 7.

10. Security

We protect information with encryption in transit (HTTPS), encryption at rest at our providers, access limited to the people who need it, and hashed sign-in links. Calendar access tokens are held by Nango and never stored in our database. Each business's management page is reached through a private link that should not be shared.

No system is perfectly secure. If a confidentiality incident creates a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and the people affected, as Law 25 requires, and we keep a register of incidents. For incidents involving Google user data, we also notify Google as its policies require.

11. Your rights and choices

Depending on where you live, you have the right to:

• know what personal information we hold about you and get a copy;
• correct information that is wrong or incomplete;
• have your information deleted, or stop its dissemination where the law allows;
• receive the information you gave us in a structured, commonly used technological format (portability);
• withdraw your consent, for example to news emails, at any time;
• object to or restrict certain uses;
• complain to a privacy authority.

To use any of these rights, email hello@openbookings.ai. We may need to confirm your identity first, for example by asking for your confirmation code and the contact details you booked with. We answer within 30 days. Using your rights is free and will not affect the service you receive.

You can complain to the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, or, in Europe, your local data protection authority. Please contact us first so we can try to help.

California residents. You have the rights to know, delete and correct personal information, and not to be discriminated against for using them. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics about you.

12. Children

OpenBookings is not directed at children. We do not knowingly collect personal information from anyone under 14 without the consent of a parent or guardian. If you believe a child has given us information, contact us and we will delete it.

13. Emails we send

We send transactional emails, such as sign-in links and booking messages, when you ask for them. We send messages about OpenBookings to businesses only when Canada's Anti-Spam Legislation (CASL) allows it: with express consent, or with implied consent, for example when a business has conspicuously published its email address without saying it does not want messages and our message relates to its business. Every such message identifies us, gives our mailing address and includes a working unsubscribe link. We honour unsubscribe requests within 10 business days, and usually right away.

14. Cookies

We use only cookies that are needed for the site to work or that remember a choice you made:

• a sign-in session cookie for our administrators (Auth.js);
• a "NEXT_LOCALE" cookie that remembers the language you chose until you close your browser;
• an "ob_city" cookie that remembers the city you picked, for one year.

We do not use analytics, advertising or tracking cookies, and we do not let third parties set them on our site. If that ever changes, we will ask for your consent first.

15. Changes to this policy

We will update this policy when our practices change and change the date at the top. If a change is significant, we will tell affected users before it applies. If we ever want to use Google user data in a new way, we will update this policy and ask for your consent first.

16. Contact

10356689 Canada Inc., operating as MicroAngel, 138 rue Tobago, Dollard-des-Ormeaux QC H9G 2X5, Canada. Person in charge of the protection of personal information: Eyal Toledano, hello@openbookings.ai.