Security and your data
WaitlistPing connects to Calendly with Calendly's own secure login (OAuth). Here's what we can access, how we protect it and how to disconnect.
The access we ask Calendly for
When you connect, Calendly asks you to approve these permissions:
users:read: your Calendly name, email and timezone, so your dashboard shows the right times.event_types:read: your event types, so we can make a waitlist page for each.availability:read: your open times, so we only offer slots Calendly shows as bookable.scheduled_events:read: details of bookings and cancellations, so we can spot freed slots.webhooks:write: to set up the notification Calendly sends us when a booking is made or cancelled.
We can't change or cancel your bookings, edit your event types or availability, or book on anyone's behalf. Clients always book on your normal Calendly page.
How we protect your connection
- You log in on Calendly's own page. We never see your Calendly password.
- The access and refresh tokens Calendly gives us are encrypted with AES-256-GCM before they're stored. The key is kept as a separate secret, not in the database.
- The key that signs Calendly's notifications to us is encrypted too, and we check the signature on every notification, so fake ones are rejected.
- Each Calendly login uses a one-time, short-lived security code to block forged requests.
- Your dashboard session cookie is signed, HttpOnly and Secure, and forms in your dashboard are protected against cross-site requests.
- Every page is served over HTTPS only.
Payments stay with Stripe
Card details are entered on Stripe's own checkout and billing pages, never on WaitlistPing. We only store your Stripe customer and subscription IDs and whether your plan is active.
Verified on Stripe. Payments are handled by Stripe, and you can view our public Stripe business profile.
What we keep
Your Calendly profile and event types, your clients' waitlist entries (name, email and time preferences), and a record of the openings we found and the emails we sent. Details are in our privacy policy.
How to disconnect
- If you're on a paid plan, cancel it first from Billing in your dashboard (see refunds and cancellation).
- In Calendly, go to Integrations & apps and remove WaitlistPing's access. Once it's revoked, we can no longer read your account. If you can't find it there, email us and we'll disconnect your account for you.
- Email support@waitlistping.com from your Calendly email address to have your data deleted. We delete it within 30 days and confirm when it's done.
Report a security problem
Email support@waitlistping.com with "Security" in the subject. We read every report and reply as soon as we can.