1. Information We Collect
- Contact details, such as your name, email address, and any information you provide through forms or direct communication.
- Booking details, when you book a call: your name, email address, phone number (optional), time zone, the answers you give on the booking form, and the time you choose.
- Project information, including business goals, tools, workflows, and implementation requirements you share.
- Technical data, such as IP address, approximate location (country, region, and city provided by our hosting provider), device or browser information, pages visited, and Google Ads click identifiers (such as gclid) collected for security, troubleshooting, traffic measurement, and site improvement.
- Payment records, when you pay an invoice, an order or a support plan. Payments are processed by PayPal or by Whop (for cards, Apple Pay and Google Pay): your card, bank and wallet details are handled by them and are never received or stored by us. We keep the amount, currency, payment status, the provider's transaction and subscription references, and the payer name and email address returned with the receipt.
2. How We Use Your Information
- To respond to inquiries and communicate with you.
- To schedule, confirm, reschedule and remind you about calls you book, and to send quotes, invoices, receipts and follow-up emails about your project.
- To deliver and improve consulting services.
- To maintain website security and prevent misuse.
- To comply with legal obligations and enforce contractual rights.
3. Google User Data (Google Calendar)
This website's booking system connects to one Google account: the site owner's own Google Calendar, so that bookings appear in that calendar. Visitors are never asked to sign in with Google or to connect their own Google account.
Data accessed. With the owner's permission, through Google OAuth, the site requests these scopes: "calendar.freebusy" (to see which times are busy), "calendar.events" (to create, update and delete the calendar events for calls booked on this site), and "openid" and "email" (to show which Google account is connected).
How it is used. Busy times are read only when the booking page calculates available slots, so that people cannot book a time that is already taken; they are used in memory and not stored. When someone books a call, an event is created in the owner's calendar with the booking's title, time, the invitee's name, email address and booking answers, and a Google Meet link; the invitee is added as an attendee so Google sends them the invitation. The event is updated or deleted if the booking is rescheduled or cancelled.
What is stored. The connected account's email address, the OAuth refresh and access tokens, and, for each booking, the Google Calendar event ID and Meet link. These are kept in our database, which only our own server can access, and are never shown to visitors.
Sharing. Data obtained from Google APIs is not sold, not shared with third parties, not used for advertising, and not used to develop, improve or train artificial intelligence or machine-learning models. It is not read by people except with the owner's consent, for security purposes, or to comply with applicable law.
Retention and deletion. Google data is kept only while the calendar is connected. Disconnecting the calendar in the site's admin revokes the token with Google and deletes the stored tokens immediately; access can also be removed at any time at https://myaccount.google.com/permissions. Event IDs stored with past bookings are deleted on request, together with the booking.
Nevil Paul's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
4. Legal Bases for Processing
Where applicable law requires a legal basis, we process personal data based on one or more of the following: your consent, the performance of a contract, compliance with legal obligations, and legitimate business interests.
6. Data Sharing and Disclosure
We do not sell personal data. We may share data with trusted service providers supporting hosting, analytics, communication, and project delivery, subject to appropriate safeguards. We may also disclose information when legally required.
Service providers we use include: Supabase (database and account sign-in), Vercel (hosting), Resend (sending emails), Google (Google Calendar and Google Meet for booked calls), PayPal and Whop (payments), Slack (internal notifications to the site owner), and, when the site owner uses the admin assistant, Anthropic or OpenAI to process the owner's own business records. Each receives only the data needed for its task.
Payments are handled by PayPal (PayPal Holdings, Inc.) acting as an independent controller of the payment data you give it. When you pay or subscribe, you are passed to PayPal and your payment details are collected by PayPal directly under its own privacy policy at paypal.com. We receive back only the transaction outcome and the receipt details described above. Payment and subscription records are retained for as long as needed to service the order and to meet accounting and tax obligations.
7. International Data Transfers
Your information may be processed in countries other than your own. Where required, we use reasonable safeguards to protect personal data during cross-border transfers.
8. Data Retention
We retain personal data only for as long as reasonably necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce agreements.
9. Data Security
We implement commercially reasonable technical and organizational safeguards to protect personal data. However, no method of transmission or storage is completely secure.
10. Your Privacy Rights
Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of personal data, and to request data portability.
11. Children's Privacy
This website and services are not directed to children under 13, and we do not knowingly collect personal data from children.
12. Third-Party Services and Links
The website may contain links to third-party services and platforms. We are not responsible for third-party privacy practices, and we encourage you to review their policies.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Updates become effective when posted on this page. Continued use of the website or services after updates indicates acceptance of the revised Policy.
14. Contact
For questions or requests related to this Privacy Policy, contact contact [at] nevilpaul.com.