Privacy policy

Last updated 27 September 2026. Curbslot is run by BYBOWU (bybowu.com). Questions: [email protected].

Two kinds of people use Curbslot

Pros (mobile detailers, groomers and others) make an account and publish a booking page. Clients book through a pro's page. For client data, the pro decides what happens to it; Curbslot processes it on the pro's behalf.

What we collect from pros

• Name, email and password (stored hashed) to run your account.
• Your booking page: business name, first name, photo, bio, phone, services, hours, policy.
• Your start point address and its map coordinates. It is encrypted, never shown to clients, and used only to time your first drive and check your service area.
• If you connect them: your Stripe account id and status, and Google Calendar access tokens (encrypted).

What we collect from clients

• The service address, entered first so we can show only reachable times. It is encrypted, never put in a web address, and never shown to other clients. We convert it to map coordinates to plan drive times; coordinates are deleted when the booking is cancelled or its day has passed. Addresses are deleted 12 months after the booking.
• Name, email and phone, so the pro can reach you and we can send your confirmation, reminder and change link.
• The cancellation policy you accepted, saved with your booking.

We never see or store card numbers: deposits are paid on Stripe's page.

Analytics

We count product events (for example “a booking page was viewed” or “a booking was confirmed”) in our own database, without addresses, names, emails or phone numbers. On our marketing pages, Google Analytics loads only if you allow it in the cookie bar, and you can change your choice from “Cookie choices” in the footer. It never runs on pros' booking pages.

Who processes data for us

• Stripe: deposits (on the pro's own Stripe account) and Pro plan billing.
• Google Maps Platform (Geocoding and Routes): turning addresses into map points and drive times, when enabled.
• Google Calendar: only for pros who connect it; reads busy times and adds bookings.
• Postmark (or Google Workspace email as a fallback): sending emails.
• Google Analytics: marketing pages only, with consent.
• DigitalOcean and Cloudflare: hosting and network.

ZIP code locations come from the US Census Bureau's public ZIP Code Tabulation Area file, stored on our server.

Google user data

If a pro connects Google Calendar, Curbslot requests only two permissions: to see free/busy times, and to manage events on calendars you own. Curbslot uses the second only to add, update and remove its own bookings. We use busy times to hide unavailable slots and write only Curbslot bookings. We don't read event details, share Google data with anyone, or use it for ads. Disconnecting deletes the stored tokens. Curbslot's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your choices

• Pros can download their bookings and clients as CSV, delete a client, or delete their whole account from the Account page. Deleting the account removes the page, services, bookings, clients and connections. Stripe keeps its own payment records as the law requires.
• Clients can cancel through the link in their confirmation email, and can ask the pro, or us, to delete their details.

Security

Addresses, tokens and the start point are encrypted at rest. Manage links are long random tokens, one per booking. Everything is served over HTTPS.

Changes

If this policy changes, we'll update the date above and, for important changes, email pros.