Privacy Notice

1. Who is responsible for your data

Haab Calendar is operated by Bernardo Soriano, an individual sole proprietor based in Mexico, reachable at bsorianodev@gmail.com. This notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).

Two different relationships are covered here, and the difference matters. When a business signs up to run a booking page, Haab Calendar is the data controller for that business's own account data. When that business takes bookings from its clients, the business is the data controller for its clients' information and Haab Calendar acts only as its service provider, storing and transmitting that information on the business's instructions.

In practice: if you booked an appointment through a booking page, your relationship is with the business that runs that page. Haab Calendar holds the booking on their behalf. Requests about that data are answered by the business, and we will help them respond.

2. What we collect from businesses

Account identity: the email address used to sign in, and the authentication records that keep the session valid.

Booking page configuration: business name, public URL slug, time zone, language, services and prices, availability rules, booking policies, and any images uploaded for the page.

Subscription state: the plan a business is on, and the identifiers needed to reconcile it with the payment processor. Card numbers are never sent to, or stored by, Haab Calendar.

3. Booking data handled for businesses

When someone books, the booking page collects the name, email address, phone number, and any notes the client chooses to add, together with the service, date, and time.

This information is used to create and manage the booking and nothing else. It is not sold, not rented, not used to build advertising profiles, and not used to train machine learning models.

Each booking gets a private management link containing an unguessable token. Anyone holding that link can view, reschedule, or cancel that booking, which is why those pages are served with instructions not to index them and are excluded from search engines.

4. Google Calendar data and Limited Use

Connecting a Google Calendar is optional and is initiated by the business. Nothing is requested from Google unless a business connects an account.

When connected, Haab Calendar requests exactly four scopes and no others: openid and email, to show which account is connected so a business can audit it; https://www.googleapis.com/auth/calendar.events, to create and update the events representing bookings; and https://www.googleapis.com/auth/calendar.calendarlist.readonly, to list the calendars a business could write to. The broader calendar scope is deliberately not requested, because it would grant read access to the contents of every event on every calendar, which this feature has no use for.

Events written into a business's calendar carry the service name and an opaque internal identifier. They do not carry a client's name, email address, phone number, or notes. A calendar can be shared, and Haab Calendar does not decide who may read a client's name. This is enforced by an automated test, not only by policy.

Google refresh tokens are encrypted with AES-256-GCM before they are written to the database, so a copy of the database alone does not yield a usable token. Disconnecting a Google account from the settings page revokes the token with Google and removes it.

Haab Calendar's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Who else processes this data

Supabase — database, authentication, and file storage. Holds account and booking records.

Vercel — application hosting and image storage. Processes requests and serves uploaded images.

Stripe — subscription payments. Handles card data directly; Haab Calendar never receives it.

Google — processes website usage data through Google Analytics as described below. For businesses that connect a Google Calendar, Google also processes calendar data under the scopes listed above.

PostHog — when landing analytics are enabled, processes the website usage data described below. This integration uses PostHog's United States region.

These providers process data on our behalf under their own terms. Some of them operate infrastructure outside Mexico, which means personal data may be transferred and stored abroad.

6. Cookies

Haab Calendar uses essential cookies: an authentication cookie that keeps a business signed in, a language preference cookie, short-lived cookies that secure the Google sign-in exchange, and an administrative cookie used when editing example pages.

On the production marketing pages, gallery, and legal pages, Google Analytics uses first-party analytics cookies to distinguish visitors and sessions. It measures page views, public page URLs, referring domains, campaign tags, approximate location, and browser and device information. Initial page URLs exclude query strings and fragments; campaign tags are included separately and should not contain personal information. Collection stops when you navigate outside these pages and remains off until a full page load. It does not initialize on booking pages, account setup, dashboards, or private booking management pages. Browser Do Not Track and Global Privacy Control signals disable collection. Reports and retention follow the Google Analytics property's settings. You can block these cookies through your browser or an analytics blocker. When configured, the landing page also uses the separate cookieless PostHog analytics described below.

Public booking pages count visits without cookies so the business can see how its page and campaign links perform. Each visit is recorded as an anonymous identifier that changes every day and differs on every business's page, together with the campaign tags in the link, the referring website's domain and the device type. A second identifier of the same kind, derived from the network alone, is used only to limit abusive traffic. No IP address, browser fingerprint or personal data is stored, and these records are deleted after 13 months.

7. Landing page analytics

When enabled on the production landing page, PostHog measures page views, referring website domains, campaign tags, approximate location, browser and device categories, language, sections viewed, button clicks, FAQ opens, video engagement, and scroll depth. We use these reports to understand traffic sources and improve the landing page.

The integration uses cookieless server hash mode, without analytics cookies, browser storage, person profiles, session recordings, or automatic capture of form contents and arbitrary interactions. It does not send account emails, customer booking details, URL query strings, or URL fragments. Campaign tags are deliberately included, so campaign links should not contain personal information in those tags.

Requests go to PostHog's United States endpoint. PostHog receives the network address and browser request information needed to derive temporary visitor identifiers and approximate location, according to the project's settings. This integration does not run on booking pages, account setup, dashboards, or private booking management pages. Browser Do Not Track and Global Privacy Control signals disable collection.

Landing analytics follow the PostHog project's retention settings; the free plan currently retains analytics for one year. Browser restrictions, analytics blockers, and missing referrers can make reports incomplete. These reports do not identify individual customers.

8. How long data is kept, and deletion

Account data is kept while the account is active. Booking records are permanently deleted during daily cleanup once their scheduled date is more than one calendar month in the past, using the business timezone. Future bookings are kept regardless of when they were created. Records exactly at the cutoff are kept; cleanup may run later.

Premium businesses can enable one calendar year of booking history in Settings. This option is off by default and takes effect after saving. Turning it off or losing Premium access restores one-month retention at the next cleanup. Deleted bookings cannot be recovered. Related booking history and internal integration records are removed with the booking; anonymous page analytics retain their separate 13-month policy. Cleanup does not delete events already held in an external Google Calendar.

Deleting an account is permanent. It removes the account, the booking page and its configuration, the bookings held under it, and the uploaded images, and it revokes any connected Google account. There is no recovery afterwards.

If you booked through a business's page and want that booking removed, contact the business. They control it, and deletion on their side removes it from our systems too.

9. Security

Access to booking data is enforced in the database itself through row-level security, so a business can only reach its own records regardless of how a request arrives.

Google refresh tokens are encrypted at rest with AES-256-GCM. Booking management links use unguessable tokens rather than sequential identifiers.

No system is perfectly secure, and this notice does not claim otherwise. If you believe you have found a vulnerability, please write to bsorianodev@gmail.com.

10. Your ARCO rights

Under the LFPDPPP you may exercise your ARCO rights: Access, to know what personal data is held about you; Rectification, to correct it when it is inaccurate or incomplete; Cancellation, to have it removed; and Opposition, to object to a particular use of it. You may also withdraw consent at any time.

To exercise any of these, write to bsorianodev@gmail.com describing which right you are exercising and enough detail to locate your records. We will respond within the periods the law establishes.

If your data was submitted through a business's booking page, the request is properly directed to that business, which is the data controller. Send it to us anyway if you cannot reach them and we will help identify the right contact.

11. Changes to this notice

This notice may change as the service changes. The effective date at the top of this page always reflects the current version, and material changes will be announced in the application before they take effect.

12. Contact

Questions about this notice, or about how your data is handled, go to bsorianodev@gmail.com.