Privacy Policy

Effective October 19, 2026

1. Who we are and what this covers

GVX Digital, LLC ("GVX Digital," "we," "us" or "our") is a Kentucky company based in Louisville that operates CronSlot. This policy covers personal information we handle through cronslot.com, the application at app.cronslot.com, booking pages and embedded booking widgets powered by CronSlot, and our related support and communications (together, the "Service").

A booking page may appear on a business's own website or address and carry that business's brand instead of ours. This policy still applies to the information the Service processes there. The business's own website and its other services are covered by its own privacy policy, not this one.

2. Our role for businesses and bookers

• Businesses. For the businesses that use CronSlot and their staff ("Businesses"), we decide how account and billing information is used, and we act as a controller of it.
• Bookers. For people who view a booking page or book, change, cancel or pay for an appointment ("Bookers"), we process booking information on behalf of the Business you are booking with. The Business is the controller and decides how your information is used. We act as its service provider or processor.

If you are a Booker and want to access, correct or delete your information, or have questions about how a Business uses it, contact that Business directly. If you contact us instead, we will forward your request to the Business where we can identify it, and help the Business respond.

3. Information we collect

Information you give us

• Account information: name, email address, password (stored in hashed form), business name, time zone, and the settings, availability and event types you configure.
• Brand materials: logos, colors, fonts and other content a Business uploads to style its booking pages.
• Booking information: the Booker's name, email address and, if the Business asks for them, phone number, notes and answers to booking questions. Also the appointment's date, time, time zone, location and status, including reschedules, cancellations and no-shows.
• Communications: messages you send us, such as support requests, and the contents of booking-related emails sent through the Service.
• Billing information: for Businesses that pay us, billing contact details and payment records.

Payment information

Deposits, card holds and fees are processed by Stripe on behalf of the Business. Card numbers and security codes are entered into Stripe's secure fields and sent directly to Stripe. They never pass through or are stored on our servers. We receive limited details from Stripe, such as payment status, amount, the last four digits and brand of the card, and transaction identifiers. Stripe's handling of payment data is described in the Stripe Privacy Policy.

Information collected automatically

• Device and log data: IP address, browser and device type, operating system, referring page, pages viewed, and the date and time of requests. We use this to operate, secure and troubleshoot the Service.
• Approximate location: derived from IP address or browser settings, mainly to show times in the right time zone.
• Cookies and similar technologies: see section 7.

Information from connected services

If a Business connects a calendar, video conferencing or payment account, we receive information from that service as described in section 4 and in the Business's connection settings.

4. Google and Microsoft calendar data

When a Business connects a Google or Microsoft calendar, we access only the calendar data needed for the features they turn on:

• reading busy times and events on selected calendars, so the Business is not double-booked;
• creating, updating and deleting events for bookings made through CronSlot; and
• reading the list of calendars, so the Business can choose which ones to check and write to.

We use calendar data only to provide these features. We do not sell it, use it for advertising, or use it to train generalized artificial intelligence or machine learning models. People at GVX Digital do not read it except with the Business's permission, to investigate security issues or abuse, to comply with law, or in aggregated, anonymized form for internal operations. A Business can disconnect a calendar at any time in its settings or in its Google or Microsoft account. When it does, we stop accessing that calendar.

CronSlot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use information

We use personal information to:

• provide the Service: show availability, take and manage bookings, sync calendars, process payments through Stripe, and send confirmations, reminders and other booking messages;
• create and manage accounts, set up and style booking pages, and provide support;
• bill Businesses and keep financial records;
• secure the Service, prevent fraud and abuse, and fix problems;
• understand how the Service is used, so we can maintain and improve it, using aggregated or de-identified information where practical;
• send Businesses service announcements and, with the option to opt out, information about CronSlot and GVX Digital; and
• comply with law, enforce our Terms of Service, and protect the rights and safety of our users, the public and us.

We use Booker information only to provide the Service to the Business the Booker is booking with, and for the security, legal and improvement purposes above. We do not use it to market our own services to Bookers. We do not make decisions about anyone based solely on automated processing that produce legal or similarly significant effects.

Where the EU or UK GDPR applies, our legal bases are performance of a contract, our legitimate interests in running and securing the Service, compliance with legal obligations, and consent where we ask for it.

6. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows:

• With the Business you book with. Booking information is available to the Business and the staff it authorizes.
• With service providers who process information for us under contracts that limit their use of it:

  Provider	Purpose
  Railway	Application hosting and database
  Cloudflare	Website hosting, DNS, network security and email routing
  Stripe	Payment processing for Business deposits and fees, and our billing
  Email delivery provider	Sending booking confirmations, reminders and account emails
  Google, Microsoft	Calendar sync and video meeting links, only when a Business connects them

  You can ask us at support@cronslot.com for our current list of service providers.
• With services a Business connects, such as calendars or webhooks to its own systems, at the Business's direction.
• For legal reasons: when we believe in good faith it is required by law, subpoena or court order, or needed to protect the rights, property or safety of anyone, or to investigate fraud or security issues.
• In a business transfer: as part of a merger, acquisition, financing, reorganization or sale of assets, subject to this policy's protections.
• With consent or at your direction.

7. Cookies and similar technologies

The app and booking pages use cookies and local storage that are necessary to sign in, keep sessions secure, prevent fraud, and remember preferences such as time zone and display settings. Stripe sets its own cookies on payment forms for fraud prevention. cronslot.com does not use advertising cookies or third-party advertising trackers. If we add analytics, we will use it only to measure and improve the Service, and we will update this policy first.

We honor Global Privacy Control signals as a request to opt out of sale and targeted advertising. We do neither, so the signal requires no further change. Most browsers let you block or delete cookies, but the Service may not work properly without the necessary ones.

8. How long we keep information

• Account and booking information: while the Business's account is active. After an account closes, we keep it for 30 days so the Business can export it, then delete it from active systems within a further 60 days. A Business can delete individual bookings and data sooner.
• Backups: deleted data may remain in encrypted backups for up to 90 days until they are overwritten.
• Logs: generally up to 90 days, longer when needed to investigate a security incident.
• Billing and transaction records: as long as tax and accounting laws require, typically seven years.

We may keep information longer when the law requires it, to resolve disputes, or to enforce our agreements. De-identified information may be kept indefinitely.

9. Security

We protect information with measures appropriate to its sensitivity. These include encryption in transit (HTTPS), hashed passwords, access to production systems and connected-account tokens limited to people who need it, and monitoring for misuse. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the Business concerned as the law requires.

10. Your privacy rights

Depending on where you live, you may have the right to:

• confirm whether we process your personal information, and access it;
• correct inaccurate information;
• delete your information;
• receive a portable copy of it;
• opt out of sale, targeted advertising and certain profiling (we do not do these);
• object to or restrict certain processing, or withdraw consent; and
• not be discriminated against for exercising these rights.

How to make a request. Businesses can change most information in their account settings. Bookers should contact the Business they booked with (see section 2). Anyone can also email support@cronslot.com. We will verify your identity, usually by confirming control of the email address involved, and respond within 45 days. We may extend that by another 45 days where the law allows, and will tell you if we do. An authorized agent may submit a request for you with your signed permission, and we may still ask you to verify your identity.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing support@cronslot.com with "Privacy appeal" in the subject line. We will respond within 60 days. If you are not satisfied, you may contact your state attorney general. Kentucky residents may contact the Office of the Attorney General of Kentucky.

Marketing email. You can unsubscribe from marketing emails at any time with the link in the email. We will still send messages about your account and bookings.

11. Notice for U.S. state residents

This section supplements the rest of this policy for residents of states with comprehensive privacy laws, including California, Kentucky, Virginia, Colorado, Connecticut, Utah, Texas and others.

In the past 12 months we have collected these categories of personal information: identifiers (such as name, email, phone number and IP address); customer records (such as billing details); commercial information (such as bookings and transactions); internet or network activity (such as log data); approximate geolocation; and any other information you choose to provide in booking notes or answers. We collect it from you, from the Business you book with, from your device, and from services a Business connects. We use and disclose it for the purposes in sections 5 and 6, which are business purposes.

We do not sell or share personal information as those terms are defined by law, and we have no actual knowledge of selling or sharing personal information of anyone under 16. We do not use or disclose sensitive personal information to infer characteristics about anyone, or for any purpose that would give rise to a right to limit its use.

12. International users

The Service is operated in the United States, and information is stored and processed in the United States and in other countries where our service providers operate. Data protection laws there may differ from those where you live. Where the law requires it, we rely on appropriate safeguards for transfers, such as standard contractual clauses.

13. Children

The Service is not directed to children under 13, and Businesses may not use it to knowingly collect personal information from children under 13. If a parent or guardian books on behalf of a child, the parent or guardian is the Booker. If you believe a child under 13 has provided personal information to us, contact support@cronslot.com and we will delete it.

14. Changes to this policy

We may update this policy. We will post the new version here with a new effective date. If we make material changes, we will notify Businesses by email or in the Service before the changes take effect. We will not use previously collected personal information in a materially different way without notice and, where the law requires it, consent.

15. Contact

Questions or requests about privacy:

GVX Digital, LLC
Louisville, Kentucky, USA
support@cronslot.com