Under Planning, Online booking, create a service: a name, a duration and the staff who do it. For each service you create a booking link. You see that link once; put it on your site or in an email. A new link replaces the old one, and you can revoke it at any time.
A visitor picks a day and a time and leaves a name and email address. They only see times, never which staff member it will be and never other appointments or customers. A time is only offered if a staff member works according to the schedule, is not absent, has no appointment and, if a Google Calendar is connected, is free there. If something is unknown, for example a calendar that cannot be read, it counts as not available.
A request is a proposal. Nothing is in the calendar yet and the visitor has not heard anything. You confirm or decline under Requests. Confirming creates the appointment, declining frees the time again. Both propose a message to the visitor. That message only goes out after you sign it under To sign. It goes only to the address the visitor gave, in your workspace's brand, and mentions only the service and the time: never the visitor's name or note. At most three messages per day go to one address. Two requests for the same time with the same staff member cannot both come in.
The page is protected against abuse: a limit per visitor and per address, a bot check and a cap on requests that are still waiting for a decision.
Via MCP and the director
planning_boekingen_lezen shows the requests from visitors (open only or all) without email address and phone number; name and remark are under onvertrouwd, because they come from a visitor. planning_boeking_beslissen confirms or rejects (planning.beheren, a planner's key). Confirming creates the appointment. The message to the visitor is a proposal that a person signs; no email ever goes out by itself. Setting up a service and creating or withdrawing a booking link stays with a person: the link is a secret for the public.