Privacy policy
This policy explains what data WaitlistPing stores, why, and who helps us process it. WaitlistPing is run by the operator of WaitlistPing ("we", "us"). Questions: support@waitlistping.com.
We collect only what the service needs to work. We don't sell data, show ads or use tracking or analytics cookies.
1. Hosts (people who connect Calendly)
- Calendly access tokens. When you connect, Calendly gives us OAuth access and refresh tokens. We store them encrypted (AES-GCM) and use them only to read your event types and availability and to manage the webhook that tells us about bookings and cancellations.
- Profile. Your Calendly name, email address, timezone and Calendly user and organization IDs, so we can show your dashboard and use the right timezone.
- Event types. The names, durations and booking links of your Calendly event types, so we can make a waitlist page for each.
- A session cookie. One signed, strictly necessary cookie that keeps you logged in to your dashboard. It is not used for tracking.
2. People who join a waitlist
- Name and email address, and any day or time preferences you choose, so we can email you when a matching slot opens. You join by ticking a consent box, and every email includes a link to leave the list.
- Offer records. Which openings we emailed you about, when, and whether you clicked the link, so first-to-book works and links to taken slots show "sorry, it's gone".
3. Booking and cancellation events
When a booking on a connected Calendly account is created or cancelled, Calendly sends us a notification. We store the event time, the event type, an ID for the booking (to avoid processing it twice) and, when a freed slot is re-booked, the booker's email address, so we can take them off the waitlist and count slots refilled. We also keep a copy of the emails we send (recipient, subject, text and delivery status) to troubleshoot delivery.
4. Why we use this data
Only to provide the service: running waitlists, spotting freed slots, emailing offers, showing hosts their results, and answering support requests. The legal basis is performing the service you asked for and, for waitlist members, your consent.
5. Service providers (processors)
- Calendly: the scheduling service you connect. We read data from it through its API, under your authorization.
- Cloudflare: hosts the app and its database (Cloudflare Workers and D1).
- Resend: delivers our emails. It receives the recipient's address and the email content.
These providers process data on our behalf, under their own privacy and security terms. Data may be processed in the United States and other countries where they operate.
6. Retention and deletion
We keep host data while the account is connected, and waitlist entries until the person leaves the list, books, or the host asks us to remove them. To delete your data, email support@waitlistping.com from the address involved. We'll delete it within 30 days and confirm when it's done. Hosts can also revoke our access at any time from their Calendly settings, which stops us using the tokens immediately.
7. Security
Data travels over HTTPS. Calendly tokens and webhook signing keys are encrypted at rest, and incoming Calendly notifications are checked against a signature. No system is perfectly secure, but if we ever learn of a breach affecting your data we'll tell the people affected and the relevant parties promptly.
8. Your rights
You can ask us for a copy of your data, to correct it, or to delete it, by emailing support@waitlistping.com. Depending on where you live, you may also have the right to complain to your local data protection authority.
9. Children
WaitlistPing is not meant for children under 16, and we don't knowingly collect their data.
10. Changes
If we change this policy, we'll update this page and the date above, and tell connected hosts about significant changes by email.
WaitlistPing works with Calendly but is not affiliated with Calendly.