Summary
- The app reads your HighLevel calendars, team member names and your business account’s name and time zone, and creates and deletes block slots.
- It doesn’t read contacts, the contents of appointments, conversations or payments.
- We store only what the app needs to work, in Cloudflare D1. Access tokens are encrypted with AES-256-GCM.
- We don’t sell or share your data, show ads or use analytics or tracking cookies.
- When you uninstall, your data is deleted within 24 hours.
Who we are
Holiday & Closure Blocker is provided by Dylan Powell trading as ImpactLayer, a sole trader based in Bridgend, UK (“we”, “us”). We are the data controller for the information described here, except where we act as a processor for a business that manages client accounts (see If you manage client accounts).
Contact: support@impactlayer.co.uk
What the app reads from HighLevel
When installed in a HighLevel business account, the app reads:
- the list of calendars: their names, IDs and team members;
- team member names (the users list), to show who a block applies to;
- the business account’s name and time zone.
It creates and deletes block slots in the calendars you choose. It does not read contacts, the contents of appointments, conversations or payments.
What we store
For each business account where the app is installed, we store:
| Data | Why |
|---|---|
| HighLevel account ID and company ID | To know which business account and company the installation belongs to. |
| OAuth access and refresh tokens, encrypted with AES-256-GCM | To call HighLevel on your behalf. |
| If you install for several client accounts at once: one company-level OAuth token, encrypted with AES-256-GCM | Used only to get a token for each business account you installed the app in. |
| App settings: regions, chosen calendars, closure days, working preferences, auto-sync on or off | To work out which dates to block. |
| The IDs, calendar IDs and times of block slots the app created | So Remove deletes only the app’s own blocks, and auto-sync doesn’t create duplicates. |
| Activity log: what was blocked or removed and when, with the HighLevel user ID and name of the person who did it | So you can see who changed what. The user ID and name come from HighLevel’s single sign-on user context. |
| Cached public holiday data | To avoid fetching the same public dates repeatedly. This contains no personal data. |
Where it’s stored
Data is stored in Cloudflare D1, a database run by Cloudflare, Inc. We ask for the database to be placed in Western Europe using Cloudflare’s EU (Western Europe) location hint. A location hint is a preference, not a guarantee. Requests to the app are processed in Cloudflare’s network, which may include data centres outside the UK.
Who we share it with
We don’t share your data with anyone else, we don’t sell it and we don’t use it for advertising. We use these sub-processors to run the app:
| Who | What for |
|---|---|
| Cloudflare, Inc. | Hosting and database. |
| HighLevel | The platform the app runs on. |
To get holiday dates, the app calls GOV.UK (UK bank holidays) and Nager.Date (other countries). No personal data is sent to them.
Cookies and tracking
We don’t use advertising or analytics cookies. The app’s settings page inside HighLevel uses no tracking cookies. This website sets no cookies.
How long we keep it
- While installed: we keep your settings, tokens and block records so the app can work.
- Activity log: each entry is deleted after 12 months.
- Server logs: Cloudflare’s request logs are short-lived, kept for up to 7 days.
- When you uninstall: HighLevel tells the app, and we automatically delete that business account’s tokens, settings, block records and activity log within 24 hours.
- Company-level token: if the app was installed for several client accounts at once, its company-level token is deleted within 24 hours of the app being uninstalled at company level.
Blocks stay in your calendars after uninstalling
Uninstalling deletes our data, but it can’t remove block slots already in your calendars, because the app no longer has access. If you want them gone, click Remove in the app before you uninstall.
Our lawful basis
We use this data to provide the app you installed (performance of a contract). We keep the activity log and server logs because we have a legitimate interest in running the app securely and showing you who changed what.
If you manage client accounts
If you install the app in your clients’ business accounts, we act as your processor for your clients’ data where that applies, and only process it to provide the app.
Security
OAuth tokens are encrypted at rest with AES-256-GCM. Data travels between HighLevel, Cloudflare and your browser over HTTPS.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of the data we hold about you (access);
- correct it;
- delete it;
- stop using it (objection).
Email support@impactlayer.co.uk. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
Changes to this policy
If we change this policy, we’ll update this page and the date at the top.