Privacy policy

Hlela is a scheduling app: hosts share a booking link, invitees pick a free time, and Hlela puts the meeting in the host's calendar and emails both sides an invitation. This policy explains what data Hlela handles, why, and how you control it. Contact: hello@auxodigital.africa.

What we collect

• Hosts sign in with Auxo ID. We keep their name, email address, profile picture URL, time zone, booking link, event types, availability and settings.
• Invitees who book a meeting give their name, email address, any guest email addresses and any answers to the host's questions. We store these with the meeting time and time zone so the host can meet them and both sides get invitations.
• People who fill in a routing form give the answers that form asks for (often a name and email). We store the submission so the form's owner can see it, and use it to send them to the right booking page.
• Technical data: IP addresses are used briefly for rate limiting and abuse protection (Cloudflare Turnstile) and are not kept with your bookings.

Google user data

Hosts can choose to connect a Google account (Integrations → Google Calendar). Hlela then asks Google for these permissions, and only these:

• openid, email, profile: to identify which Google account you connected and show its email address in your settings.
• See the list of your calendars (calendar.calendarlist.readonly): to show your calendars (name and access level) so you can choose which ones are checked for conflicts and which one bookings are added to.
• See your availability (calendar.freebusy): to read the free/busy times of the calendars you chose, so Hlela never offers a slot when you are already busy. This permission returns only busy start and end times, never event details.
• View and edit events on your calendars (calendar.events): to add each meeting booked through Hlela to the calendar you picked (with a Google Meet link if you chose Meet), and to update or delete that event when the meeting is rescheduled or cancelled.

How we use it

Google data is used only to provide Hlela's scheduling features that you can see in the app: hiding busy times from your booking page, and creating, updating and cancelling the events for meetings booked through Hlela. Hlela has no permission to read the titles, descriptions, attendees or contents of your other events; it sees only when you are busy. Hlela only edits or deletes events that Hlela itself created.

What we store

• Your Google account email address and the list of your calendars (name, ID, whether it's primary, whether Hlela can write to it), plus your choices of which calendars to check and where to add bookings.
• The OAuth access and refresh tokens, encrypted with AES-256-GCM before they are saved and only decrypted on our server.
• For each meeting booked through Hlela: the ID of the calendar event Hlela created and its Meet link, so we can update or cancel it.
• Busy times are not stored. They are fetched when an invitee views your booking page and held in server memory for at most 90 seconds.

All of this is kept in Google Cloud Firestore in Johannesburg (africa-south1), is not readable by any browser, and is accessible only to Hlela's server.

Sharing

We do not sell Google user data or share it with anyone. It is not used for advertising, it is not used to train AI or machine-learning models, and it is not transferred to third parties, except where necessary to provide the feature you asked for (for example, the invitee receives the meeting invitation you were booked into), to comply with the law, or as part of a merger or acquisition with your prior consent. No person at Auxo Digital reads your Google data unless you ask us to for support, it's needed for security reasons, or the law requires it.

Limited Use

Hlela's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting your Google data and revoking access

• In Hlela, go to Integrations → Manage and disconnect the Google account. Hlela revokes its access with Google and immediately deletes the stored tokens, account email and calendar list.
• You can also remove Hlela at any time at myaccount.google.com/permissions. Hlela then can no longer read or write your calendar; disconnect in Hlela too, or ask us, to delete what we stored.
• Events Hlela already added to your calendar stay there, because they are your meetings; you can delete them in Google Calendar.
• To delete your whole Hlela account and all its data, email hello@auxodigital.africa. We do this within 30 days.

Microsoft calendars

If a host connects Outlook, Hlela uses Microsoft Graph in the same way: it reads free/busy times, and writes, updates and cancels the meetings booked through Hlela (with a Teams link). Tokens are encrypted at rest.

CRM integrations (Fikelela)

A host can connect Fikelela, Auxo Digital's CRM, under Integrations. If they do, the details of the host's bookings are sent to the host's own Fikelela workspace as leads: the invitee's name, email address and phone number, their answers to the booking questions, the event type, the meeting time and the meeting link, and whether the meeting was booked, rescheduled or cancelled. If the host also turns on routing forms, each routing-form submission with a name and email (the answers given) is sent the same way, even if no meeting is booked. Guest email addresses are not sent. Bookings of team events and submissions of workspace routing forms go through the host (or the form's creator) while they are a member of that workspace; otherwise they may go to the Fikelela workspace connected by the workspace owner. The host controls this data in their CRM. Disconnecting Fikelela stops any further sending; data already sent stays in the host's CRM.

Service providers

Hlela runs on Vercel (hosting) and Google Cloud Firestore (database, africa-south1). Emails are sent through Resend. Bot protection on booking forms uses Cloudflare Turnstile. They process data only to run Hlela.

How long we keep data

Account and booking data is kept while the host's account exists. Calendar connection data is deleted when the calendar is disconnected. A Fikelela key and any leads still waiting to be sent are deleted when Fikelela is disconnected; a lead that Fikelela refused is kept for 30 days (the error only, not the invitee's details) so the host can see what went wrong, and leads held back while the host's Fikelela key needs attention are deleted after 30 days if the key isn't fixed. Security records (rate-limit counters, sign-in state) expire within hours to days.

Cookies

Hlela uses only essential cookies: a sign-in session cookie for hosts, and short-lived security cookies during sign-in and calendar connection. No advertising or analytics cookies are set, so there's nothing to opt out of.

Your rights

To see, correct or delete your data, email hello@auxodigital.africa. Under the Protection of Personal Information Act (POPIA) you may also complain to the Information Regulator of South Africa.

Changes

If we change how Hlela uses Google user data, we will update this page and ask for your consent again before the new use.