Skip to main content
Exlink

Lulo Solutions LLC

Privacy Policy

Version 2.2 Last Updated: June 22, 2026

This Privacy Policy, originally published as a standalone document, has been superseded in its entirety by Section 14 of the Terms of Service, effective June 20, 2024. As of that date, this standalone Privacy Policy is no longer in effect and carries no independent legal force.

For the current and binding privacy provisions governing the use of the Exlink platform and the handling of personal information, please refer to the Terms of Service, Section 14.

The Terms of Service, Section 14 addresses the following subject matter:

(a) Personal Information Collection. The categories of personal information collected from users, including but not limited to name, address, email address, telephone number, date of birth, government-issued identification, immigration-related information, and health and insurance information.

(b) Uses of Information. The purposes for which collected information is used, including the provision and maintenance of the platform, the facilitation of Exchange Services, communications with users, ensuring regulatory compliance, and the improvement of Exlink.

(c) Data Sharing. The circumstances under which personal information may be disclosed to third parties, including consenting individuals, service providers, third-party integrations, and disclosures required by applicable law.

(d) Data Transfers. The user’s consent to the transfer of personal information to the United States and other jurisdictions as necessary for the operation of the platform.

(e) User Access Rights. The rights of users to access, correct, update, or request the deletion of their personal information held by Exlink.

(f) Third-Party Calendar Integrations. The data Exlink accesses when you connect a Google or Microsoft calendar to enable meeting scheduling, the specific permissions involved, how that data is used and stored, and how to disconnect or revoke access. This disclosure is reproduced in full below and is binding under the Terms of Service, Section 14.

Third-Party Calendar Integrations

The following disclosure describes how Exlink handles data from connected Google and Microsoft calendars. It is reproduced here for transparency; the binding provisions remain in the Terms of Service, Section 14.

Exlink lets you connect your Google or Microsoft calendar so people can book meetings with you and so those meetings stay in sync. The data we access is used solely to provide this scheduling feature — we do not sell it, share it for advertising, or use it for any unrelated purpose.

Google Calendar

When you connect Google Calendar, you grant Exlink permission to:

  • See and edit events on your calendars (calendar.events) — create the meeting event (with a Google Meet link) when someone books you, update it on reschedule, delete it on cancellation, and watch for changes you make directly in Google Calendar so they sync back to Exlink.
  • View free/busy information (calendar.events.freebusy) — used only to find your open times so your booking page offers genuinely available slots; we do not read the titles, attendees, or details of your other events.
  • View your list of calendars (calendar.calendarlist.readonly) — so you can choose which calendar Exlink writes to and reads availability from.
  • Your basic Google profile (name, email) — to identify the connected account.

Limited Use. Exlink’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft / Outlook Calendar

When you connect a Microsoft (Outlook or Microsoft 365) calendar, you grant Exlink permission to:

  • Read and write your calendars and events (Calendars.ReadWrite) — create the meeting event (with a Microsoft Teams link) when someone books you, update it on reschedule, delete it on cancellation, read your availability so your booking page only offers open slots, list your calendars so you can choose which one Exlink uses, and subscribe to changes so edits you make in Outlook stay in sync with Exlink.
  • Sign you in and read your basic profile (User.Read) — your name and email, to identify the connected account.
  • Maintain the connection (offline_access) — so Exlink can perform the above on your behalf without asking you to sign in every time.

Exlink’s access to and use of Microsoft data complies with the Microsoft APIs Terms of Use.

Data Storage and Disconnection

We store the OAuth access and refresh tokens for your connected account (encrypted at rest) so Exlink can act on your behalf, together with the identifiers of the events we create and the calendars you select. We retain this only while your calendar is connected. You can disconnect at any time from your calendar settings in Exlink, which deletes our stored tokens. You can also revoke Exlink’s access directly through your provider — Google at myaccount.google.com/permissions, Microsoft at myaccount.microsoft.com (work/school accounts) or account.live.com/consent/Manage (personal accounts).

How We Protect Your Data

Exlink safeguards all data it accesses — including data obtained from Google APIs, such as your calendar events and free/busy information — using strong, industry-standard measures:

  • Encryption in transit and at rest. All data is encrypted in transit using TLS (HTTPS) and at rest using AES-256 encryption. The OAuth access and refresh tokens for your connected Google account are stored encrypted at rest.
  • Access controls. Access to data is limited on a strict need-to-know basis, and administrative access requires multi-factor authentication.
  • Secure infrastructure. Data is hosted on Amazon Web Services (AWS) and encrypted using AES-256 both in transit and at rest; AWS does not have access to unencrypted data.
  • Retention and deletion. We retain Google user data only while your calendar remains connected. You can disconnect at any time, which deletes the stored OAuth tokens and the associated Google data we hold.
  • Incident response. If we confirm unauthorized access to your data, we notify the affected account’s designated security contact within 24 hours.

Limited Use. Exlink’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data solely to provide the calendar scheduling features you request; we do not sell or transfer this data, use it for advertising, or allow humans to read it except (a) with your consent, (b) for security purposes, (c) to comply with applicable law, or (d) as strictly necessary to operate and improve the feature.

All questions regarding privacy practices should be directed to security@exlink.org.