Privacy Policy — Open Slot

Ava Research LLC · Last updated: October 5, 2026

This policy covers Open Slot (the "Service"), a connector that lets a business accept appointment requests through Muse, and lets a customer find and request appointments with businesses that use it. It applies whether you use the Service directly or through Meta's Muse, and whether you use it as a business owner or as a customer — both roles are covered below.

What we store, and why

Account ID: an internal ID from your sign-in, used to keep your data separate from everyone else's. Sign-in is handled by Microsoft Entra External ID with a one-time code sent to your email — there is no password, and it asks for nothing but your email address. The Service itself never stores your email address.
If you're a business owner: your business name, time zone, weekly hours, the services you offer (name, duration, and an optional price), and your cancellation policy.
If you're a customer: the service and time you request, and contact details you choose to give (for example a name or phone number) so the business can reach you about that one booking. We don't connect to your email, calendar, or any other account to get this — you or Muse provide it directly.
Booking records: status (pending, approved, declined, or cancelled), when it was requested, and when it was decided.
Technical logs: request type, outcome, and timing. Logs never contain your business details, booking contact information, or sign-in tokens.

What we don't collect

The Service only accepts the fields above. We don't ask for or store payment card or bank account numbers, government ID numbers, precise location, photos, or health information. Open Slot doesn't process payments at all in this version.

Permissions Muse asks for

One permission, OpenSlot.ReadWrite: it lets Muse act on your behalf — as a business owner, to manage your services and bookings; as a customer, to request and manage your own appointments.

How we use it

To let a business owner publish their services and hours, and review and decide on booking requests.
To let a customer find a business's open times and request an appointment.
To operate, secure, and improve the Service.

We do not sell your personal information, and we do not use it for advertising.

How business and customer data are kept apart

A business's own data (name, hours, services) and customer data (bookings, contact details) are stored in structurally separate systems — not just separated by a filter on one shared system. A business's hours and services can be looked up by anyone with its booking link, without exposing who has booked with it or any customer's contact information.

Who can see it

You, through your own account.
The business you book with sees the details of your booking with them (service, time, the contact information you gave) — never your bookings with any other business.
Meta's Muse, if you connect it, acting on your behalf with the permission above.
Service providers that host and run the Service (Microsoft Azure, East US 2 region) and handle sign-in (Microsoft Entra External ID), bound by their own security and confidentiality commitments.
No one else. We don't sell, rent, or share your data with advertisers or data brokers.

How we protect it

Your data is isolated by account and, for businesses, by business — no business can read another business's data, and no customer can read another customer's data. Access to the underlying systems is limited to what each part of the Service needs to do its job, and administrative access is limited to Ava Research LLC personnel who need it to operate the Service.

Data retention

Business and booking data: kept until you delete it or your account.
Technical logs: 30 days.

Delete your data

Deletion is self-service — ask Muse directly, no email required:

If you're a business owner: ask Muse to delete your business, for example “Delete my business.” This permanently removes your business profile and every booking ever made with it. This can't be undone.
If you're a customer: ask Muse to delete your data, for example “Delete all my Open Slot data.” This permanently removes every booking you've made, across every business. This can't be undone.
Disconnect: remove Open Slot from your connectors in Muse. Disconnecting stops Muse's access but doesn't delete your data — use the self-service deletion above first if you want it gone.

Children's privacy

The Service is not directed at children, and we don't knowingly collect information from anyone under 13.

Changes to this policy

If we make a material change, we'll update the date at the top of this page and, for significant changes, make a reasonable effort to notify active users.

Contact us

Ava Research LLC
privacy@avaresearchllc.com