ImpactLayer Apps

Privacy policy

What Holiday & Closure Blocker for HighLevel reads, stores and deletes, where it’s kept, and how to use your rights.

Last updated

Summary

  • The app reads your HighLevel calendars, team member names and your business account’s name and time zone, and creates and deletes block slots.
  • It doesn’t read contacts, the contents of appointments, conversations or payments.
  • We store only what the app needs to work, in Cloudflare D1. Access tokens are encrypted with AES-256-GCM.
  • We don’t sell or share your data, show ads or use analytics or tracking cookies.
  • When you uninstall, your data is deleted within 24 hours.

Who we are

Holiday & Closure Blocker is provided by Dylan Powell trading as ImpactLayer, a sole trader based in Bridgend, UK (“we”, “us”). We are the data controller for the information described here, except where we act as a processor for a business that manages client accounts (see If you manage client accounts).

Contact: [email protected]

What the app reads from HighLevel

When installed in a HighLevel business account, the app reads:

  • the list of calendars: their names, IDs and team members;
  • team member names (the users list), to show who a block applies to;
  • the business account’s name and time zone.

It creates and deletes block slots in the calendars you choose. It does not read contacts, the contents of appointments, conversations or payments.

What we store

For each business account where the app is installed, we store:

Data stored per installed business account
DataWhy
HighLevel account ID and company IDTo know which business account and company the installation belongs to.
OAuth access and refresh tokens, encrypted with AES-256-GCMTo call HighLevel on your behalf.
If you install for several client accounts at once: one company-level OAuth token, encrypted with AES-256-GCMUsed only to get a token for each business account you installed the app in.
App settings: regions, chosen calendars, closure days, working preferences, auto-sync on or offTo work out which dates to block.
The IDs, calendar IDs and times of block slots the app createdSo Remove deletes only the app’s own blocks, and auto-sync doesn’t create duplicates.
Activity log: what was blocked or removed and when, with the HighLevel user ID and name of the person who did itSo you can see who changed what. The user ID and name come from HighLevel’s single sign-on user context.
Cached public holiday dataTo avoid fetching the same public dates repeatedly. This contains no personal data.

Where it’s stored

Data is stored in Cloudflare D1, a database run by Cloudflare, Inc. We ask for the database to be placed in Western Europe using Cloudflare’s EU (Western Europe) location hint. A location hint is a preference, not a guarantee. Requests to the app are processed in Cloudflare’s network, which may include data centres outside the UK.

Who we share it with

We don’t share your data with anyone else, we don’t sell it and we don’t use it for advertising. We use these sub-processors to run the app:

Sub-processors and external services
WhoWhat for
Cloudflare, Inc.Hosting and database.
HighLevelThe platform the app runs on.

To get holiday dates, the app calls GOV.UK (UK bank holidays) and Nager.Date (other countries). No personal data is sent to them.

Cookies and tracking

We don’t use advertising or analytics cookies. The app’s settings page inside HighLevel uses no tracking cookies. This website sets no cookies.

How long we keep it

  • While installed: we keep your settings, tokens and block records so the app can work.
  • Activity log: each entry is deleted after 12 months.
  • Server logs: Cloudflare’s request logs are short-lived, kept for up to 7 days.
  • When you uninstall: HighLevel tells the app, and we automatically delete that business account’s tokens, settings, block records and activity log within 24 hours.
  • Company-level token: if the app was installed for several client accounts at once, its company-level token is deleted within 24 hours of the app being uninstalled at company level.

Blocks stay in your calendars after uninstalling

Uninstalling deletes our data, but it can’t remove block slots already in your calendars, because the app no longer has access. If you want them gone, click Remove in the app before you uninstall.

We use this data to provide the app you installed (performance of a contract). We keep the activity log and server logs because we have a legitimate interest in running the app securely and showing you who changed what.

If you manage client accounts

If you install the app in your clients’ business accounts, we act as your processor for your clients’ data where that applies, and only process it to provide the app.

Security

OAuth tokens are encrypted at rest with AES-256-GCM. Data travels between HighLevel, Cloudflare and your browser over HTTPS.

Your rights

Under UK GDPR you can ask us to:

  • give you a copy of the data we hold about you (access);
  • correct it;
  • delete it;
  • stop using it (objection).

Email [email protected]. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this policy

If we change this policy, we’ll update this page and the date at the top.