Availyx

Privacy Policy

Last updated: October 19, 2026

Availyx ("we", "us") provides scheduling pages that let people ("guests") book time with an Availyx account holder ("host"). This policy explains what information we collect, how we use it, and the choices you have. It applies to availyx.com and any subdomains.

Information we collect

From hosts

  • Account details when you sign in with Google or Microsoft: your account identifier (for Microsoft, your tenant and object ID), email address, name and (from Google) profile image.
  • Settings you create: public username, timezone, availability rules, booking types and their descriptions.
  • Calendar data from Google Calendar or Microsoft Outlook, described in the next sections, only after you connect a calendar.
  • Team details if you create or join a team: the team's name, URL, logo, favicon and colors, its custom domain, member roster and roles, groups, pending invitations (the invited email addresses) and team events.
  • Payment details if you charge for bookings: your connected Stripe account reference (for a team, the team's one account, connected by its owner), whether it can accept payments, its currency, and for each paid booking the amount, currency, our fee, the payment and refund status, and Stripe references to the payment. Your bank and identity details are given to Stripe, not to Availyx.
  • Contacts: a list of the people who have booked with you (the name, email address and phone number they gave, or that you entered yourself), and any notes you choose to write about them. We keep this list for every account, but contacts belong to a team and are shared by everyone on it (viewing them needs the Team plan); someone with no team keeps a personal list that only they can see, and it joins the team's list when they start or join a team. Meeting history and payment totals shown on a contact are worked out from the bookings of everyone on the team, not stored separately. If you use Evie, each email she handles also adds a line to that contact's conversation log, which teammates can see: a one-line summary of what was asked and what she did, never the email itself.
  • Evie, the email assistant, if you use her: the email threads you copy her on are read to schedule the meeting. We do not store the text of those emails. We keep her settings (default booking type and how many times she offers), the guest's name and email address for the thread, the proposed times, the message identifiers needed to recognize a reply, and a short activity log (what she did, the subject line, and usage counts), which is deleted after 90 days.
  • Billing details if you subscribe to a paid plan: your plan, billing period, subscription status and renewal dates, and a Stripe customer reference. Card numbers are entered on Stripe's pages and are never received or stored by Availyx.

From guests

  • Details you enter on a booking page: name, email address, an optional phone number and an optional message.
  • The timezone you select and the time you book.
  • Details you enter to sign up for an event: your name and email address. The host sees them and can see whether you are confirmed, on the waitlist or have paid. When you are confirmed, your email address is added as a guest on the host's calendar event, which means the host's calendar provider (Google or Microsoft) receives it and sends you an invitation. Other guests on the same event may be able to see who else is invited, depending on the host's calendar. We email you your confirmation, any waitlist update and a cancellation notice.
  • If you pay for a booking or an event ticket: the payment is made to the host through Stripe. Your card details are entered on Stripe's page and are never received or stored by Availyx; we keep the amount, currency, status and Stripe references so we can confirm, show and refund the booking or ticket.
  • A long random token that lets you cancel or reschedule from your confirmation page or calendar invitation (or cancel an event signup from the link in your confirmation email). We store only a hash of it.

Automatically

  • Standard server logs (IP address, browser type, requested page, timestamp) kept briefly for security, abuse prevention and debugging.
  • Product usage events such as "booking confirmed" or "calendar connected". These never include calendar contents or guest messages.
  • A session cookie for signed-in hosts, and on our public pages a random visitor id cookie that lets us measure how visits turn into sign-ups (not set if your browser sends Do Not Track or Global Privacy Control). We do not use advertising or cross-site tracking cookies.

Google Calendar data and Limited Use

When a host connects Google Calendar, we request permission to list their calendars, read free/busy time on the calendars they choose for conflict checking, and create, update and delete the events Availyx schedules. We do not read the titles, descriptions, attendees or locations of existing events; free/busy lookups return only "busy" time ranges.

Availyx's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide the scheduling features you asked for. It is never sold, used for advertising, or shared with third parties except as needed to deliver the service (for example, a booking creates a calendar event that Google then shares with the guest).

We do not use Google user data, raw or aggregated, to develop, improve or train artificial intelligence or machine learning models, and we do not transfer it to any third-party AI or machine learning service. No human at Availyx reads your calendar data except with your explicit consent to resolve a support request, for security or abuse investigation, or where required by law.

Specifically, the Google Calendar permissions we request are used as follows: the calendar list permission shows you your calendars so you can choose which ones count for conflicts and where bookings go; the free/busy permission reads only busy time ranges on those calendars to hide times you are unavailable; the events permission creates the booking event with the guest invited and a Google Meet link, updates it when a booking is rescheduled, and cancels it when a booking is canceled. We only modify events Availyx created.

OAuth tokens are encrypted at rest with a key held separately from the database and are never sent to the browser. You can revoke access at any time from Availyx (Settings → Calendar → Disconnect) or from your Google Account security settings; either way the stored tokens are deleted immediately and Availyx can no longer access your calendar.

Microsoft calendar data

When a host connects a Microsoft (Outlook or Microsoft 365) calendar, we request the Microsoft Graph permission to read and write their calendars, plus basic profile access and offline access so the connection keeps working. We use it only to provide the scheduling features you asked for: to list your calendars so you can choose which ones count for conflicts and where bookings go; to read the start time, end time and busy/free status of events on the calendars you chose, so times you are unavailable are hidden (we do not request event titles, descriptions or attendees); and to create the booking event with the guest invited (with a Microsoft Teams meeting link where your account supports it), move it when a booking is rescheduled, and cancel it when a booking is canceled. We only modify events Availyx created.

We do not use Microsoft user data, raw or aggregated, to develop, improve or train artificial intelligence or machine-learning models, for advertising, or for any purpose unrelated to the scheduling features above, and we do not sell it or transfer it to third parties except as needed to provide those features or to comply with law. Tokens are encrypted at rest and never sent to the browser. You can disconnect at any time from Availyx (Settings → Calendar → Disconnect), which deletes the stored tokens immediately; to remove Availyx's access entirely, also remove it from your Microsoft account's app permissions or, for a work or school account, from your organization's My Apps page. Some organizations require an administrator to approve apps before their users can connect.

How we use information

  • To show hosts' availability accurately and to create bookings without conflicts.
  • To create calendar events that invite the guest, and to update or cancel them when a booking changes.
  • To let guests and hosts manage bookings, and to show hosts their upcoming and past bookings.
  • To keep the service secure, prevent abuse and fix problems.
  • To understand which features are used so we can improve the product.

We do not send marketing email. Booking invitations and updates are delivered by your calendar provider (Google Calendar or Microsoft Outlook).

Who can see what

  • A host's name, profile image, username and active booking types are public on their booking pages.
  • A guest's details are shared with the host they book with, and appear on the calendar event created for both parties. For a team event the host is the team member assigned to the booking; for an event where everyone attends, the guest's details and the event also go to each teammate who attends, and the guest sees those attendees' names and email addresses on the invitation.
  • A team's name, logo, colors, members' names and profile images, and their active booking types are public on the team page (and on the team's custom domain, if it has one).
  • Team owners and admins can see the team's roster, roles and pending invitations. They cannot see a member's calendar, bookings or guests' details.
  • Availyx's own administrators can see account and subscription details to give support and manage plans (for example granting or ending a plan). They do not read calendar contents, and every such change is logged.
  • Guests never see other guests' bookings, and a management link only opens the one booking it belongs to.
  • Contacts, and the notes written about them, are visible to the members of the team that owns them (and to you alone while you have no team). They are never shown to guests. A personal list is deleted with your account; a team's contacts belong to the team, so they stay with it when a member leaves or deletes their account, and are deleted if the team is deleted.

Service providers

Availyx runs on Cloudflare (hosting, database, file storage and network security) and integrates with Google and Microsoft (sign-in and calendars). Payments for paid plans are processed by Stripe, which receives your name, email address, payment details and billing address directly when you check out, and which sends us subscription status updates. When a host charges for bookings, Stripe also processes those payments on the host's own Stripe account (a team's members are paid through the team's account): the host is the seller, and Stripe shares transaction details with the host under Stripe's terms. Evie's email handling uses Anthropic, which receives the text of an email thread (without attachments) to decide what to do, and Resend, which delivers the replies Evie sends, the confirmation, waitlist and cancellation emails for event signups, the reminder emails hosts can switch on before a booking or event, and the team invitations admins send, and receives their recipients and content. Product analytics uses Mixpanel, which receives a host's name and email address and records which features they use (for example signing in, connecting a calendar, creating a booking type) and how bookings on their pages progress, using ids and counts rather than guests' names, email addresses or answers. Each event also carries the visitor's approximate location (country, region and city, from their network address, which is not stored), browser, operating system and device type, and, on our public pages, the site or campaign link that brought them. On the home, Solutions and sign-in pages we also set a random visitor id in a first-party cookie so a visit can be connected to the account created afterwards; it is not set if your browser sends Do Not Track or Global Privacy Control. Mixpanel also records sessions on signed-in pages and on booking pages (not on the home page): what you click and type, scroll and where you pause, shown as the page appears on your screen, so we can see where the product is confusing. That includes names, email addresses and answers entered on booking pages; passwords and payment details are never recorded (Stripe collects card details on its own page). This uses your browser's local storage rather than cookies, and is skipped if your browser sends Do Not Track or Global Privacy Control. Stripe also sends receipts and billing emails, and hosts its checkout pages (including on secure.availyx.com), where it sets its own cookies. These providers process data on our behalf under their own privacy commitments, and data may be processed in the United States and other countries where they operate. We do not sell personal information.

Retention and deletion

  • Host accounts and their data are kept until the host deletes the account from Settings, which removes the profile, calendar connection, availability, booking types and booking records from Availyx. Events already on your calendar remain there.
  • Disconnecting a calendar deletes its stored tokens immediately.
  • Booking records, including guest details, are kept for the host's history until the host's account is deleted. Guests may ask a host, or contact us, to have a booking removed.
  • Server logs are retained for a short period, typically under 30 days.
  • Leaving a team removes you from its roster and groups; deleting a team removes its page, branding, groups, team events and invitations. Bookings already made stay in the assigned host's history.
  • A log of administrative changes to plans (who changed what, and when) is kept for security and accounting and may outlast the account it concerns.
  • Billing records (invoices and subscription history) are kept by Stripe and by us for as long as tax and accounting law requires, typically seven years, even after an account is deleted.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to certain processing. Hosts can do most of this directly in Settings. For anything else, email us and we will respond within 30 days.

Security

All traffic uses HTTPS. Session cookies are HTTP-only and restricted to our site. Calendar tokens are encrypted at rest, and guest management links use unguessable tokens stored only as hashes. No method of transmission or storage is perfectly secure, so please report any concerns to us promptly.

Children

Availyx is not directed to children under 16 and we do not knowingly collect their information.

Changes

We may update this policy as the service evolves. The date at the top shows the latest revision. Material changes will be announced on the site before they take effect.

Contact

Questions or requests about privacy: privacy@availyx.com.