SkillLink — GDPR-Compliant C2C Skill-Sharing Marketplace for Japanese Expats in Europe

SkillLink connects Japanese expatriates living in Europe with Japanese-speaking service providers across six categories: language lessons, career consulting, local tours, beauty, photography, and translation. The marketplace operates under German company law — which means EU VAT compliance, GDPR-compliant calendar integration, Widerrufsrecht (right-of-withdrawal) for digital services, and multilingual support across English and Japanese.

Founder Seiichiro Kashimori (Berlin) brought a 36-page specification with mockups, flowcharts, and Definition-of-Done criteria for every task. We're delivering the full platform across 6 milestones on Sharetribe Extend — replacing an initial Cal.com calendar plan (discovered to have per-seat pricing that would have cost €600/month at scale) with a custom Google Calendar OAuth integration that creates a dedicated "SkillLink Bookings" calendar per seller, keeping personal calendar data off the platform entirely.

Calendar Integration That Respects GDPR

The initial spec called for Cal.com for seller availability management. During contract finalization, we discovered Cal.com's team plan charges per seat — at scale, this would cost €600+/month just for the calendar layer. More critically, a third-party calendar tool would require reading sellers' personal Google Calendar data, creating GDPR exposure for a German-operated platform. We proposed and the client accepted a pivot to custom Google Calendar OAuth: each seller authorizes a single dedicated "SkillLink Bookings" calendar — the platform never reads or enumerates the seller's personal events. This is GDPR-compliant, zero incremental cost, and gives SkillLink full control of the booking data.

Atomic Double-Booking Prevention

Calendar-based bookings create a race condition: two buyers attempting to book the same time slot simultaneously. Sharetribe is the authoritative lock. The booking flow must attempt the Sharetribe slot reservation first, then write to Google Calendar only after the reservation succeeds. If the reservation fails (slot taken), the Google Calendar write must not happen. This "Sharetribe-first" pattern had to be enforced at every booking path.

EU VAT Invoicing with Conditional Logic

German tax law requires automatic invoice issuance for every transaction, with different formats for:

• Business sellers (company name + country + VAT number from Account Settings) → full VAT invoice
• Private individual sellers → simplified receipt with no VAT number

The invoice type is determined at payout time based on the seller's account type setting — all automated with no operator intervention.

Service Completion Without Webhooks

Sharetribe needs to know when a booked session ends to trigger the review window and eventual payout. The spec originally anticipated polling jobs. We implemented it using Sharetribe Extend's :at parameter on the transition — the session end time is calculated as start_time + session_duration and set at booking time. Sharetribe fires the completion transition automatically. No polling job, no webhook receiver.

3-Rule Cancellation Policy Under German Law

German consumer law (Widerrufsrecht) gives buyers a 14-day right of withdrawal for digital services unless the service has already begun. SkillLink's cancellation rules had to be reviewed by a German-law advisor (Margaret) and codified in both the T&C and the transaction process states. The rules vary by how far in advance the cancellation occurs and whether the service has started.

Type A vs Type B Booking Flows

SkillLink has two fundamentally different service types:

• Type A — scheduled time services (language lessons, tours, photography): buyer picks a specific date/time slot from the seller's availability calendar
• Type B — async/flexible services (translation, document work): no calendar booking; buyer and seller agree on timeline via messaging after initial booking

These two flows required completely different listing creation experiences, booking UIs, and transaction process branches.

Custom Google Calendar OAuth Integration

Each seller goes through Google OAuth during listing creation. The authorization scope is restricted to a single named calendar ("SkillLink Bookings") that our integration creates automatically on first authorization. The platform:

• Never reads the seller's personal calendar events
• Creates calendar events only for confirmed bookings
• Deletes calendar events automatically on cancellation
• Stores OAuth refresh tokens encrypted in Sharetribe user extended data

Microsoft Outlook OAuth is architected but deferred to post-Beta, per client instruction.

Sharetribe Extend Transaction Process with :at Completion

The transaction process uses Sharetribe Extend's :at transition parameter to auto-complete Type A bookings:

• At booking confirmation, start_time + session_duration is calculated and set as the :at value on the complete transition
• Sharetribe fires the completion transition automatically at that UTC timestamp
• No background job, no webhook, no polling — the platform's only time-sensitive code is the :at value set at booking time

Type B bookings use a manual completion trigger (buyer confirms delivery) since there's no fixed end time.

Availability Rules Editor

Custom UI built on top of Sharetribe's availability management API:

• Default working hours with per-day enable/disable
• Exception date blocking (single day, full week shortcuts)
• Buffer time between sessions (15/30/60 min options)
• Session length configuration per listing
• Buyer-facing slot picker with DST-aware timezone display
• Atomic booking lock: Sharetribe reservation fires first; Google Calendar write only on success

Storybook Design System

Rather than building components ad-hoc, we established a Storybook component library at the project start. This gives the client a visual reference for every UI component, makes QA faster (Seiichiro can review components against his spec mockups in isolation), and ensures visual consistency across all six service categories.

EU VAT Invoice Automation

Invoice generation is triggered by the payout transition:

• Seller account type checked (Private vs Business) from Sharetribe user extended data
• Business seller → full VAT invoice generated with company name, address, country, VAT registration number
• Private seller → simplified receipt, no VAT number required
• Both sent automatically via email at payout time
• All invoice amounts in EUR with Stripe SEPA payout to seller

Multilingual Support (English + Japanese)

Both buyer and seller flows support English and Japanese:

• Sharetribe's built-in i18n system extended with Japanese locale strings
• All custom UI components (availability editor, booking calendar, invoice emails) translated
• Legal notices (§5b UWG, Widerrufsrecht disclosure) verified by German-law advisor in both languages

6-Milestone Delivery — Beta Launch September 1, 2026

• M1 — Seller process: listing creation flow, Google Calendar OAuth, availability rules editor, Type A/B distinction, account settings, legal notices
• M2 — Purchase process: booking calendar UI, atomic double-booking lock, cancellation policy, Stripe Connect SEPA, Widerrufsrecht flow
• M3 — Transaction process: custom process.edn, Extend :at completion, VAT invoice automation, review system
• M4 — Admin dashboard: operator tools, dispute resolution, payout management, analytics
• M5 — Polish and QA: Storybook finalization, mobile responsiveness, accessibility audit
• M6 — Launch: go-live checklist, production Stripe, domain configuration, handoff documentation

Technical Outcomes

• GDPR-compliant calendar integration with zero personal calendar data exposure
• Zero-polling session completion via Sharetribe Extend :at parameter
• German-law reviewed T&C and cancellation rules in English and Japanese
• Automated EU VAT invoicing conditioned on seller account type
• Storybook component library for long-term maintainability
• Replaced Cal.com (€600+/mo at scale) with zero-cost custom OAuth — saving the client thousands annually

Contract Value

€4,500 fixed-fee engagement across 11 weeks — covering full Sharetribe Extend marketplace, Google Calendar OAuth, EU compliance layer, Storybook design system, multilingual support, and complete go-live preparation.

Architecture Decisions

Why Sharetribe Extend Over Build

The :at transition parameter — essential for automatic session completion — is only available on the Extend plan. We started the project on the cheaper Build plan ($39/mo) for the first 7 weeks, covering M1, M2, and early M5 work. We upgraded to Extend ($299/mo) only when M3 Phase 3 began, saving approximately €500–700 in subscription costs vs. starting on Extend from day one.

The Cal.com Discovery

Cal.com's free plan does not support Google Calendar OAuth for multi-user setups. Their team plan, which does, charges per seat. At 500 active sellers, this would cost €600+/month — a recurring cost the client had not budgeted for and would not accept. The custom Google OAuth integration adds approximately 20 hours of development but eliminates a perpetual third-party cost entirely and gives the platform full control over calendar data. This discovery was made during contract finalization and reported immediately.

Sharetribe as Lock Authority

A common mistake in calendar-integrated marketplaces: write to the external calendar first, then confirm in the platform. This creates a gap where a double-booking can occur if two buyers reach the Sharetribe confirmation step simultaneously. Our pattern:

1. Buyer submits booking → Sharetribe slot reservation attempted (atomic, database-level lock)
2. If reservation succeeds → Google Calendar event created
3. If reservation fails (slot already taken) → error returned to buyer, no Google Calendar write

Sharetribe's reservation API is the lock authority. Google Calendar is a mirror, never the source of truth.

Type A vs Type B Transaction Branch

The two booking types require different branches in the transaction process:

• Type A — listing extended data records bookingType: "scheduled"; availability tab shown in listing creation; booking UI shows calendar picker; :at parameter set at confirmation
• Type B — listing extended data records bookingType: "flexible"; availability tab hidden in listing creation; booking UI shows inquiry form; completion triggered manually by buyer

The transaction process detects the booking type at the first transition and routes accordingly.

GDPR Design Principles Applied

• Data minimization: We access only the "SkillLink Bookings" calendar — scope restricted in OAuth consent screen
• Purpose limitation: Calendar data used only for booking management, never for analytics or profiling
• Retention: Calendar events deleted automatically on transaction cancellation or completion
• Transparency: GDPR disclosure in T&C (reviewed by Margaret) explains exactly what calendar access is requested and why