Nuvalani Website Privacy Policy

Effective date: October 15, 2026
Operator: David Lee, owner and operator of Nuvalani
Privacy contact: rdlee1996@gmail.com

Nuvalani helps business owners manage their availability and helps clients book appointments. This policy explains how we handle personal information through nuvalani.com, including its owner dashboard, booking pages, and optional Google Calendar connection.

Only what’s needed for scheduling. Personal information is not our business model. We use information to provide appointments, account access, support, and service security. We do not sell personal information, use it for targeted advertising, or build marketing profiles.

This policy covers the website. The Android app’s device permissions and local calendar features require separate disclosures and are not described as part of the website’s Google Calendar connection below.

Intended users

Nuvalani is currently offered to businesses and clients in the United States. Business-owner accounts are intended for people age 18 or older.

Nuvalani is not directed to children under 13. Parents or guardians should arrange appointments on behalf of children rather than having children submit personal information themselves. If you believe a child under 13 has provided personal information to Nuvalani, contact rdlee1996@gmail.com so we can review and address it.

Information we collect

Owner accounts and business setup. We process information supplied when you request access, create an account, or configure a business. This may include your name, email address, business name, phone number, business contact information, an optional profile photo, services, prices, opening hours, and blocked time. Account credentials and sign-in are handled through Firebase Authentication. Changing a business’s contact email does not change its sign-in email.

Appointments and clients. New website bookings ask for a client's name and phone number, together with the selected service, appointment date and time. We also process booking status. Business owners may enter appointments themselves. Older records and bookings made through older versions of the Android app may include optional email addresses or notes; removing those fields from the current forms does not erase existing records.

Technical information. Our hosting and authentication providers process technical information needed to deliver and protect the service. This can include IP addresses, browser and device information, request times, and diagnostic or security records. The website also uses browser storage and an authorization cookie to maintain sign-in and protect the calendar connection process.

Clients do not need to register an email-and-password account to book on the website. The booking system uses Firebase anonymous authentication to assign a technical session identifier for access controls. This does not mean bookings are anonymous: the selected business receives the name, phone number, and other information entered with the appointment.

How we use information

We use information to create and administer accounts, process business access requests, display business booking pages, manage services and availability, arrange and manage appointments, prevent scheduling conflicts, respond to support requests, and maintain the reliability and security of Nuvalani.

Business information intended for a booking page, such as the business name, selected photo, services, prices, and offered appointment times, is visible to people who visit that page. Booking details are provided to the business receiving the appointment.

Optional Google Calendar connection

Business owners can choose to connect a Google account from the website’s settings. The Google account may be different from the email used to sign into Nuvalani. Google asks you to authorize the connection; Nuvalani does not ask for or store your Google password.

What we access. We request permission to view the list of Google calendars available to your account and to check their availability. The calendar list provides identifiers, display names, primary-calendar status, and time-zone information so that you can select calendars. For calendars you select, we request busy start and end times for the relevant scheduling period.

What we do not request. This website connection does not request event titles, descriptions, attendees, locations, or attachments. It does not create, edit, or delete Google Calendar events and does not send Nuvalani appointments to Google Calendar.

How we use calendar information. We use selected calendars’ busy times to exclude conflicting appointment times on Nuvalani’s website. Calendar events marked free do not block availability. Calendars stored only on a phone or in another provider, such as iCloud, are not included unless they are available through the connected Google account and selected in Nuvalani.

What we store. We store an encrypted Google authorization credential that lets the service check availability while you are away, the identifiers of calendars you selected, your business time zone, the connection’s enabled status, and records linking the connection to your Nuvalani owner account and business. Calendar list information is displayed during setup. Busy intervals are processed for availability checks and may be temporarily cached in the browser; the integration does not save a permanent copy of Google event contents or busy-time history in its connection database.

What others can see. Clients see the resulting available appointment choices. The booking interface does not display your calendar names or personal event details. Busy intervals are sent to the booking browser to calculate availability, so the times you are unavailable can be inferred; this feature should not be treated as concealing the existence of personal commitments.

Limited use. Nuvalani’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use this information to provide the calendar and scheduling features described here. We do not sell it, use it for advertising or credit decisions, or use it to train general-purpose AI models. Human access to Google-derived information is limited to circumstances permitted by that policy, such as your affirmative permission for specific support assistance, necessary security investigations, or legal obligations.

Optional iCloud Calendar connection (beta)

Owners may connect selected iCloud calendars using their Apple Account email and an Apple app-specific password. Do not provide your regular Apple Account password. Nuvalani stores the connection credentials encrypted, together with selected calendar addresses, the business time zone, connection status, and the account/business association.

Apple may return calendar event data, including details, in response to an availability request. Nuvalani processes these responses to determine occupied time ranges; it does not persist event titles, descriptions, locations, or a copy of your iCloud events. Calendar names are shown to the owner during selection. Nuvalani does not create, edit, or delete events in Apple Calendar. Busy time ranges are returned to booking browsers to calculate available appointments, so unavailable times can be inferred.

Choosing Disconnect iCloud Calendar removes that business’s stored iCloud connection and credential and stops future checks. It does not change Apple events or disconnect another Nuvalani business. You can separately revoke the Nuvalani app-specific password in your Apple Account. Revoking it at Apple does not itself remove Nuvalani records. If an enabled calendar cannot be checked, website booking pauses to help avoid conflicts. Calendars kept only on a device are not included. This beta connection has not yet been verified with a real iCloud account.

Sharing and service providers

We use Google Firebase for authentication and application data, Cloudflare for website hosting and calendar connection storage, and Google Calendar or Apple iCloud for optional calendar connections. These providers process information needed to supply their services.

We share appointment information with the business to which the appointment relates. That business is responsible for its own handling of client information, including any information it copies or keeps outside Nuvalani. Contact that business directly about its services and records.

We may disclose information when necessary to comply with applicable legal requirements or protect the security of the service. Any disclosure of Google-derived information remains subject to the Google API Services User Data Policy. We do not sell personal information or share Google Calendar data for advertising.

Retention and deletion

Account, business, client, and appointment records are retained to provide the service, including appointment history, unless removed through an available feature or a deletion request. Canceling an appointment changes its status and can preserve its history; it does not necessarily erase the record.

Calendar connection credentials and settings are retained while the connection remains configured. Choosing Disconnect Google Calendar in that business’s settings removes its active connection record and stored credential from Nuvalani’s connection database and stops future checks through that connection. It does not delete Google events or revoke a connection belonging to another Nuvalani business. Previously loaded pages may briefly retain cached availability.

You can also remove Nuvalani’s access in your Google Account’s third-party connections settings. Revoking access in Google stops authorized access but does not itself erase Nuvalani business or appointment records. Disconnect in Nuvalani as well, or contact us to request removal of stored connection information.

Business-owner account deletion. Owners can visit Delete my account, sign in again, review the records to be removed, and confirm deletion. For supported accounts, an automatic background process removes the owner login, business profile, services, availability, client and appointment records, public booking links, and stored Google Calendar and iCloud connections. Booking access and further writes are blocked while deletion is processed. The status page reports progress or asks you to contact support if the request needs review. Accounts that cannot be processed automatically require support assistance. Deleting a Nuvalani account does not delete events from Google Calendar or Apple Calendar.

We retain limited technical identifiers and deletion-status records to track the request and prevent old devices from restoring deleted records. These retained deletion records do not contain client names, phone numbers, or appointment details. Account deletion does not erase copies already stored on a device or independently retained by a business.

Client and other privacy requests. To request access, correction, or deletion of your information, contact the business you booked with or email rdlee1996@gmail.com. Client-only deletion is handled through support, rather than the business-owner deletion page. We may need to verify your identity and authority over the records before acting. Some information may need to be retained for security or legal obligations. Copies in provider backups and diagnostic records may remain until those providers’ retention periods expire.

Security and your choices

We use HTTPS, account access controls, and encryption of stored Google refresh credentials and iCloud connection credentials to help protect information. No online service can guarantee complete security.

Connecting Google Calendar or iCloud Calendar is optional. Owners can instead enter blocked time manually. You can update business information through available owner settings, change selected calendars, or disconnect the calendar connection. If an enabled calendar connection cannot be checked, website booking may be temporarily unavailable to help avoid conflicts; owners can reconnect it or disconnect it and manage their blocked time manually.

Changes and contact

We will update this policy when our practices change and show the revised effective date. If we introduce a new use of Google data, we will provide the required disclosure and obtain consent before using that data for the new purpose.

For privacy questions or requests, contact rdlee1996@gmail.com.