Privacy Policy

A host is someone who connects their Calendly to Slotghost. A client is someone who joins a host’s waitlist.

For a host, we decide what is kept and why. For a client, the host chose to run a waitlist and we hold your details for them, to do the one job they asked for: offer you a cancelled slot. If you have a question about why you are on a host’s waitlist, ask the host.

Slotghost is not built for health information. We do not sign a business associate agreement. If you are a provider covered by HIPAA, or by a similar law where you work, do not use Slotghost with your patients or clients.

• Your account name and email address, and the name, email address and timezone from your connected Calendly profile.
• Your Calendly user and organization addresses, which is how Calendly tells us who you are.
• Access keys that let Slotghost talk to your Calendly. They are encrypted before they are saved, and the key that unlocks them is kept apart from the database.
• Your event types: name, length, booking link and location, and the settings you choose for each waitlist.
• Your plan, payment history and payment provider references. Stripe or PayHere collects your card details on its own checkout. For PayHere, we pass your billing name, email, phone and address to checkout. We store the billing name, email and address with your order and invoice, along with any tax identifier supplied. Billing emails go through FormSage.

We use account and waitlist information to sign you in, connect your calendar, match availability, send the alerts you requested and record booking outcomes. Billing information supports subscription payments, invoices and payment enquiries. We also use relevant records to answer support requests, investigate failures, prevent abuse and meet our accounting and legal obligations.

• Your name and email address.
• An optional mobile or WhatsApp number if you provide one. Saving a number does not subscribe you to messages. SMS alerts require a separate choice when they are available; providing a WhatsApp number does not activate WhatsApp alerts.
• Your timezone, which your browser tells us.
• The days, times and dates you said you can do.
• The offers we sent you, whether you claimed them, and the secret links in those emails.
• If you passed on an offer and said why, the reason you picked.
• Your bookings with that host on the event types that have a waitlist: the time, whether it was cancelled, and whether the host recorded that you came. A host can choose to pass over, for a while, somebody who missed two sessions.

We do not ask for anything else, and the form has no box for notes, so we never ask about your health or your reasons for booking. A reason typed when cancelling on Calendly does reach us (see the next section), so please do not put health details there. We do not sell this to anyone, and we do not use it for advertising or to contact you about anything but your place on that waitlist.

When someone cancels or books, Calendly sends us a notice, and we keep a copy so we can work out what went wrong if something does. A notice holds the invitee’s name, email address, timezone and any cancellation reason they gave. We keep these until the host deletes their account, or until the host erases that person, which deletes the notices that carry their address (see below).

• If you leave your email on our home page, we keep it with what you told us you book, so we can reply to you.
• To slow down abuse, we count requests against your IP address and a scrambled form of the email address you typed. These counters are deleted within a few days.
• We set cookies only to make the pages work: one keeps a host signed in for 30 days, one lasts ten minutes while you sign in with Calendly, and one lasts ten minutes after you join a waitlist so the next page can show what you asked for. There is no advertising or analytics tracking.

We pass details to these services, and only for the reason given.

• Calendly is where the host’s calendar lives. We ask it which times are free. When we book a slot for a client, we send it their name, email address and timezone so it can make the booking.
• FormSage, another product from Code Sage Labs, sends our email. It sees the address, the subject and the message of every email we send.
• Twilio sends text messages. It sees the mobile number and the message. We only use it when a host is on the Pro plan, has turned texts on, and the client opted in to SMS alerts. Messages identify Slotghost and the host. You can change your choice through the manage link in your email. Replying STOP to our shared sender stops Slotghost texts across waitlists.
• Stripe or PayHere takes payment from hosts on the Pro plan. The provider shown at checkout holds the card details and collects renewals. Clients never deal with it.
• Cloudflare hosts the application and database and processes requests to keep the service running.

These providers may process information outside your country. Beyond operating the service through these providers, we share details only if the law requires it. We do not sell personal information.

• A place on a waitlist lasts the number of days the host chose, 60 unless they changed it. When it runs out we stop offering you slots. The record stays with the host until the host erases it, as described below. Taking someone off a waitlist stops their offers but keeps the record, so they can join again.
• A host’s account stays until the host deletes it. Issued invoices remain in our accounting records after account deletion; they no longer link to an active account. Contact us with questions about these records. If a host only disconnects Calendly, we keep everything so they can pick up where they left off.
• Records of payments stay with the payment provider and with our accounts for as long as the law asks us to keep them.

Hosts. You can do all of this yourself, with no email to us.

• Download your data. Settings has a button that gives you a zip of spreadsheets: your event types, the people on your waitlists and what they asked for, every cancelled slot, every offer, Calendly’s notices and a record of what you did from your account. Your Calendly access keys and the private links in emails are left out.
• Erase a person. On the waiting list for an event type, Erase details deletes that person at their request: their name, email address, number, timezone and preferences, every offer sent to them, and Calendly’s notices that carry their address. It covers every waitlist of yours they are on, and it cannot be undone.
• Delete account. Settings has Delete account. We remove your account, your waitlists, the people on them, every offer, and Calendly’s notices about your event types, and we ask Calendly to stop sending us notices. Issued invoices remain in our accounting records. It cannot be undone. Disconnecting Calendly instead stops everything but keeps your record.

What erasing a person leaves. The host’s record of their own business stays. If the person had booked a cancelled slot through the waitlist, that slot still shows as booked again, and still counts in the host’s totals and monthly allowance, with no name or contact detail on it. A note that an erasure happened is kept in the host’s activity record, with no detail about who. The booking itself is in the host’s Calendly, which erasing here does not touch. Emails and texts we already sent are held by the services that sent them (see above), under their own rules.

Clients. Our emails to people waiting include a link to leave the waitlist. It stops the offers straight away and keeps your details. You cannot erase yourself yet. To have your details deleted, ask the host, who can do it from their dashboard, or email hello@codesagelabs.com from the address you joined with and tell us which host, and we will see it done. You can also ask to see what we hold about you. Neither is instant, so allow a few days.

Everything travels over HTTPS. Access keys for Calendly are encrypted in the database. Claim and leave links are long random strings, sent only to the person they are for. A claim needs a button press, so email scanners that open links cannot use up your offer. No system is perfectly safe, and if we find that your details were exposed we will tell the host and you.

If this page changes in a way that matters, we will say so by email to hosts and put the new date at the top. Questions and requests to access, correct or delete your personal information go to hello@codesagelabs.com. Slotghost is operated by Code Sage Labs (Pvt) Ltd.