Privacy Policy & Data Handling
How we handle your data and integrate with third-party services.
Last updated: January 2026
About This Service
StackFoundry Labs provides managed website services to business clients. This is a B2B service — the platform is not open to the general public. Each client is individually onboarded by our team.
Website hosting & SaaS platform
Appointment booking for your website
Calendar Integration
When you connect your calendar, we request access to enable appointment booking. Events are created only after explicit user action.
✓What We Do
- •Check availability (free/busy only)
- •Create events when bookings confirmed
- •Generate meeting links (when available)
- •Block time slots to prevent double-booking
✕What We Don't Do
- •Read, modify, or delete existing events
- •Access event titles or descriptions
- •Create events automatically
- •Use data for analytics or advertising
Data Usage for Bookings & Appointments
StackFoundry Labs provides a managed booking and appointment feature for websites built and operated by us on behalf of our clients.
When a visitor books an appointment through a client website, we may temporarily process the following information solely for the purpose of completing the booking:
- Name
- Email address
- Optional phone number
- Optional message or purpose of the meeting
This information is used only to:
- Create a calendar event in the client's Google Calendar,
- Add the visitor as an attendee and generate a Google Meet link (where applicable), and
- Send the visitor (and, if configured, the session host) a confirmation email. When the client uses Gmail (OAuth) for email, that email is sent via Google's Gmail API; when the client uses another email provider (e.g. SMTP), we do not use Gmail for sending.
We do not store booking or appointment data in our own databases. Booking details are transmitted securely to the client's Google Calendar account and are retained there according to the client's Google account settings and Google's privacy policies. Confirmation emails sent via Gmail are processed by Google in accordance with Google's Privacy Policy and Google API Terms of Service.
When a visitor books an appointment, we send them a confirmation email with the session details and meeting link. A copy of this confirmation is BCC'd to the session host (the client website owner) so they can prepare for the appointment. The host receives only what is in the confirmation email; no additional visitor data is shared.
StackFoundry Labs does not:
- Maintain a separate booking database or CRM of visitors
- Use booking data for marketing, analytics, or profiling
- Share booking data with third parties other than Google (Calendar and, when used for email, Gmail) for the purposes described above
Booking data is processed on behalf of the client website owner, who remains the controller of that data. Visitors who wish to modify or delete booking information should do so via the calendar invitation or by contacting the website owner directly.
Access to Google Calendar and (when the client chooses Gmail for email) Gmail is granted explicitly by the client during setup and can be revoked at any time through the client's Google Account permissions.
Google APIs We Use
We use the following Google APIs to provide booking and confirmation emails:
| Google API | Purpose | Data involved |
|---|---|---|
| Google Calendar API | Read busy/free times to prevent double bookings; create calendar events; add attendees; generate Google Meet links | Visitor name, email, optional phone/message; event time and duration |
| Gmail API | (When client uses Gmail for email) Send booking confirmation emails (and BCC to session host if configured) on behalf of the client's connected Google account | Recipient email addresses; subject and body of the confirmation email (session details and meeting link) |
These APIs are used only for the purposes listed. Our use of Google APIs is subject to Google's Privacy Policy and Google API Terms of Service. We do not use Google APIs for advertising, profiling, or unrelated purposes.
Data Storage
We follow a data minimization principle. Your calendar remains the single source of truth.
What We Store
- ✓OAuth tokens (encrypted AES-256)
- ✓Availability cache (date/time slots only)
- ✓Free/busy status (expires in 24h)
What We Don't Store
- ✕Event titles or descriptions
- ✕Attendee information
- ✕Personal calendar content
Booking Visitor Data
When visitors book appointments, their name, email, and message are used to create the calendar event and send confirmations. This data is passed through but not persisted as booking records.
Your Control
You retain full control over your account access at all times.
Revoke via Your Account
Revoke access directly from your calendar provider's account settings. When revoked:
- • Tokens immediately invalidated
- • Booking auto-disabled
- • No further access possible
Request Disconnection
Email us to disconnect your calendar. We will:
- • Delete stored tokens
- • Disable booking
- • Confirm completion via email
Security
- ✓Encryption: AES-256 at rest
- ✓Isolation: Per-client data separation
- ✓Server-side: Tokens never in browser
- ✓EU Hosting: Hetzner Cloud, Germany
We Never
- ✕Use data for analytics or ads
- ✕Train AI/ML on your data
- ✕Share with third parties (except as required for booking and confirmation emails, e.g. Google Calendar and Gmail)
- ✕Sell or monetize your data
Data Retention & Compliance
Retention Periods
- •OAuth tokens: Until revoked or disconnected
- •Availability cache: 24 hours (auto-expires)
- •Booking data: Not persisted (pass-through)
Legal Compliance
- ✓GDPR: EU data protection compliant
- ✓CCPA: California privacy rights supported
- ✓Data portability: Export available on request
- ✓Legal basis: Contractual necessity & legitimate interest
Limited Use Disclosure
Our use and transfer of information received from Google APIs (Calendar and, when used for email, Gmail) adheres to Google's Privacy Policy and Google API Terms of Service, including use limitations. This data is used solely to provide appointment booking and confirmation emails and for no other purpose.
Third-Party Services
We integrate with Google Calendar and, when the client uses Gmail for email, Gmail, solely to provide booking and appointment functionality and to send confirmation emails. Data shared with Google (e.g. calendar event details and email content/recipients) is used only for those purposes and is governed by Google's Privacy Policy and Google API Terms of Service.
Cookies & Tracking
We use necessary cookies for site functionality (e.g., session management). We do not use cookies for advertising or cross-site tracking. No third-party trackers are used for marketing purposes.
View Cookie Policy →Children's Privacy
This service is intended for business use only. We do not knowingly collect information from children under 16. If you believe a child has provided us with personal information, please contact us immediately.
Your Data Rights
You have the right to access, correct, or delete your personal data. To exercise these rights, submit a request to:
contact@stackfoundrylabs.comPolicy Updates
We may update this policy periodically. Material changes will be communicated via email to active clients.
Update History
- Jan 2026Added Google Calendar API and Gmail API disclosure; confirmation email and Gmail revocation wording.
- Jan 2026Added BCC / session-host disclosure for booking confirmation emails.
- Jan 2026Added "Data Usage for Bookings & Appointments" section; added Third-Party Services disclosure.
- Jan 2026Initial policy published with calendar integration details, GDPR/CCPA compliance, and data handling practices.