Legal
Privacy Policy
Last updated: 12 November 2026
This Privacy Policy describes how WhenTap ("we", "us", "our") collects, uses, and protects your personal data when you use our Webflow app ("Service").
1. Who we are
WhenTap is scheduling and booking software for Webflow sites. We are the controller for the account, activity and billing data we collect about you as a customer. Where we process the personal data of your own end customers (the people who book with you), we act as your processor under the Data Processing Agreement.
WhenTap, a registered trade name of a Dutch sole proprietorship (eenmanszaak), Beeklaan 38, 4702JL Roosendaal, Netherlands. KvK 97282812, VAT NL005260736B22. For any legal or data-protection matter, reach us at support@whentap.com or through our support form.
2. What we collect
| Category | Examples | Lawful basis (GDPR) |
|---|---|---|
| Account data | Your email address (from Webflow), your encrypted Webflow authorization and its scopes, your plan and trial dates | Contract performance |
| Team data | Emails of people you invite and of your team members | Contract performance |
| Connection data | Encrypted Webflow, Google and Microsoft access tokens | Contract performance |
| Site data | Webflow site IDs, the CMS content and fields you map, service and staff records, and the logo, brand colour and notes you set for your customer emails | Contract performance |
| Booking data | Names, emails, phone numbers, addresses (for "we come to you"), timezones, intake answers, appointment and payment-status details of the people who book with you | Contract performance (as your processor) |
| Activity log | Who did what in your account (for example a booking cancelled), shown to you in Activity | Legitimate interest (account security, support) |
| Billing data | Stripe customer ID, plan, payment method (held by Stripe, not us) | Contract performance |
| Support data | Messages you send us | Contract performance |
| Technical data | IP address, used in memory for rate limiting and not stored; session timestamps | Legitimate interest (security) |
3. How we use it
- To provide the Service: compute availability, sync your Webflow CMS, render your dashboard, and serve the booking widget on your site
- To bill you and handle subscription payments, via Stripe
- To send transactional email (sign-in links, team invitations, booking confirmations, reminders and changes, plan confirmations, a notice when a staff calendar needs reconnecting, and a notice when WhenTap loses access to your Webflow account)
- To respond to your support requests
- To comply with legal obligations
We do not sell your data. We do not use your data for advertising. We do not use your data, or your end customers' data, to train AI or machine-learning models.
4. Sub-processors
We use the following third parties to operate the Service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server and database hosting | EU |
| Webflow, Inc. | The platform WhenTap integrates with; source of the CMS content and OAuth processed for the customer | US (EU SCCs) |
| Google LLC | Google Calendar sync (when a staff member connects Google); storage of encrypted offsite database backups (Google Drive, encrypted before upload, so Google cannot read them); the mailbox where email to our @whentap.com addresses is delivered (Gmail), including support messages | US (EU SCCs) |
| Microsoft Corporation | Outlook / Microsoft 365 calendar sync via Microsoft Graph (when connected) | US / EU (EU SCCs) |
| Stripe Payments Europe, Ltd. | Subscription billing, and booking payments routed to the customer's own connected account | EU (Ireland) / US |
| Resend, Inc. | Transactional email delivery | US (EU SCCs) |
| Cloudflare, Inc. | DNS and email routing for whentap.com: email sent to our @whentap.com addresses passes through it | US / global (EU SCCs) |
| Functional Software, Inc. (Sentry) | Error monitoring of WhenTap's server: error messages and stack traces, with email addresses removed and no cookies, headers, request bodies, URL query strings or IP addresses | EU (Germany; EU SCCs) |
We will notify you of any intended change to this list, giving you the opportunity to object.
Emails you send us
When you email a whentap.com address or use a form on whentap.com, your message passes through Cloudflare, Inc., which forwards mail for our domain, and is delivered to our mailbox at Google (Gmail). To answer faster, we use Claude, an AI assistant made by Anthropic, PBC (United States), to read your message and draft our reply. Anthropic receives your message and the earlier emails in the same conversation, nothing else from your account. A person reads every reply and decides whether to send it; no reply is sent automatically. We use your message only to answer you, and keep it for up to 2 years (see section 5).
For this correspondence WhenTap is the controller. It is not part of the data we process on your behalf under the Data Processing Agreement, so please do not paste your own customers' personal data into an email to us.
5. Data retention
- Account and site data: retained while your account exists. Deleting your account removes it from the live database at once; it disappears from our rolling database backups within 30 days.
- Booking data: held on your behalf while your account exists. You can export it at any time, and it is removed when you delete your account (and from backups within 30 days).
- Accounts that never start a paid plan are kept so you can come back to them; you can delete yours at any time from the panel. While your account has no active plan (the trial ended without one, or the plan was cancelled), WhenTap stops receiving your Webflow CMS content: it stops syncing at once and takes its webhooks off your sites at its next hourly check. Your data stays. Pick a plan and syncing resumes; the webhooks are put back at the next hourly check.
- If you uninstall WhenTap from your Webflow sites (Site settings, Apps & integrations, for each site) and do not authorize it again, we notice within a day, email you once, and delete the account and all its data 30 days later. Authorizing WhenTap again before then keeps everything.
- Deleting your account also removes WhenTap's booking script and webhooks from every Webflow site WhenTap can still reach (publish a site to make the script removal live), and ends WhenTap's access to any Stripe account you connected. If a webhook cannot be removed then, WhenTap names the site so you can delete it in Webflow; WhenTap's tokens are deleted with the account, so it cannot try again. It does not uninstall WhenTap from Webflow; to remove its access to your workspace, uninstall the app in Webflow.
- Uninstalling WhenTap removes its webhooks and booking script (the script leaves the live site at your next publish). What stays in your Webflow site is your content: every booking item WhenTap wrote into your write-back Collection (drafts unless you published them) and the Divs you placed for the widget. To remove them, delete the booking items in that Collection in the Webflow CMS, delete the Divs carrying data-whentap-service in the Designer, and publish.
- Removing or pausing a site: If Webflow does not accept the removal of a webhook, WhenTap tells you and tries again automatically for up to 7 days, keeping that site's Webflow token only for this; you can also delete the webhooks yourself in Webflow, under the site's Site settings, Apps & integrations, Webhooks.
- Billing data: invoices are kept by Stripe as long as tax law requires (7 years in the Netherlands); WhenTap's own copy of your Stripe customer ID is deleted with your account.
- Support data: support messages are kept in our mailbox for up to 2 years and deleted by hand after that.
- Webhook event logs: retained 90 days for debugging and abuse prevention.
- Activity log: kept until you clear it or delete your account.
- Team members' sign-in emails: kept until the member asks us to delete them.
6. Your rights (GDPR)
- Access: request a copy of the data we hold about you. Most of it is a one-click export from the panel.
- Rectification: correct inaccurate data.
- Erasure: delete your account and all associated data (from the Account dialog, type "delete my account" to confirm; immediate, and out of backups within 30 days).
- Portability: receive your data in machine-readable JSON.
- Objection: object to processing based on legitimate interest.
- Restriction: limit how we process your data.
- Complaint: file a complaint with your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).
To exercise any right you cannot self-serve in the panel, contact us through our support form. We respond within 30 days.
7. International transfers
Where data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions. See the DPA for specifics.
8. Security
We encrypt stored OAuth tokens with AES-256-GCM. All connections are HTTPS-only. Access to production systems is restricted to authorized personnel and uses SSH keys only (no passwords). Vulnerability reports can be sent via the contact in our security.txt or through the support form.
9. Google and Microsoft user data
This section covers the data WhenTap receives when a staff member connects a Google or Microsoft calendar. Connecting a calendar is optional.
Google user data
What we access. WhenTap requests two Google Calendar permissions: calendar.freebusy and calendar.events.owned. With calendar.freebusy we receive only the start and end times of the periods when the connected person is busy, never the titles, descriptions, attendees or other details of their events. With calendar.events.owned we create, update and delete the one event that belongs to each WhenTap booking on that person's own calendar; that event carries the service name, the customer's name and email, and the booking's start and end time. We do not read, change or delete any other event. We do not create aggregated or anonymized data from Google user data.
How we use it. Busy times are used only to leave those times out of the slots the booking widget offers, so nobody can book a time when that person is already busy. The event permission is used only to add each booking to the person's calendar, move it when the booking is rescheduled, and remove it when the booking is cancelled.
Who we share it with. We do not sell Google user data and we do not share it with any third party, advertiser or data broker. It is processed only on our own servers, hosted by Hetzner Online GmbH in the EU (see section 4). The OAuth tokens and event IDs are part of our database, which is backed up nightly to Google Drive, encrypted before upload so that the copy cannot be read there.
How we protect it. The OAuth access and refresh tokens are encrypted at rest with AES-256-GCM and stay on our servers: they are never sent to the browser, written to logs or included in exports. All connections use HTTPS. Access to production systems is limited to authorized personnel with SSH keys (see section 8).
How long we keep it, and deletion. Busy times are fetched from Google when the widget asks for available times and are not written to our database; the free slots worked out from them are kept in memory for at most 60 seconds. We store only the OAuth tokens and the IDs of the events we create. You can disconnect at any time in the panel: that deletes the stored tokens and revokes WhenTap's access at Google, so WhenTap no longer appears under your Google Account's third-party access. Removing a staff member who has no bookings, or a site, or deleting your account does the same; a staff member with past bookings is archived and keeps the calendar connection until you disconnect it. Event IDs are kept with their booking and deleted with it, and with your account. Our encrypted backups age out within 30 days.
Limited Use. WhenTap's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the calendar features described above. We do not use it for advertising, we do not sell or transfer it, humans do not read it except with your permission, for security or to comply with the law, and we do not use it to develop, improve or train generalized or non-personalized AI or ML models.
Microsoft user data
For Microsoft Outlook, Microsoft only offers full calendar read and write permission (Calendars.ReadWrite); WhenTap uses it only to read the start, end and busy status of events and to create, update and delete its own booking events. The tokens are protected and deleted in the same way as Google's. Disconnecting deletes the stored tokens; to remove WhenTap from your Microsoft account, remove it under your Microsoft account's app permissions.
10. Cookies and tracking
The app panel uses one essential cookie to keep you signed in, plus short-lived cookies that protect sign-in and connection flows (Webflow, Stripe, calendars) against forgery. Fonts are served from our own servers, so loading our pages does not contact any third party. The booking widget sets no cookies. Our website and the app panel also keep a few settings in your browser's local storage: your light or dark theme choice, the panel view you last opened, and, while you accept a team invitation, that invitation's code until it is used. These stay on your device and are not sent to us for tracking. We do not use analytics, advertising or cross-site tracking cookies.
11. Children
The Service is not directed at children under 16. We do not knowingly collect data from children.
12. Changes
Material changes to this policy will be communicated by email at least 30 days in advance.
13. Contact
For any privacy question or data request, contact us through our support form.