Privacy Notice

1. Who we are

Calenkli ("we", "us") is an online appointment scheduling service available at calenkli.com. The data controller is GTA Go To Agency SAS (see our legal notice). For any question about your data or to exercise your rights, contact us at [email protected]. We may update this notice from time to time; the last-updated date above always reflects the current version.

2. Data we collect

• Host account: name, email address, password (stored only in hashed form), timezone, and the availability and event types you configure.
• Bookings: the invitee's name, email address, optional phone number, the chosen slot, their timezone, and any answers they provide on the booking form.
• Google sign-in (if you use it): we receive only your name, email address, and profile picture in order to create or link your account. We do not access any other data from your Google account without your explicit authorization.
• Google Calendar connection (host, optional): if you connect your Google Calendar, Calenkli uses the calendar.freebusy and calendar.events scopes to (a) read your busy/free times so it never offers a slot when you are already busy, and (b) create, update, and delete the calendar events for bookings made through Calenkli. We do not read the content or details of your other events. Your access and refresh tokens are stored encrypted (see “How we protect your data”) and are deleted when you disconnect the integration.
• Apple sign-in (if you use it): we receive your Apple account identifier and email address — which may be an Apple private relay address if you chose "Hide My Email" — and your name on first sign-in, solely to create or link your account.
• Invitee calendar overlay (optional): when booking, a visitor may connect their own Google Calendar to see their busy times on the page. We read only free/busy availability — never event details — and keep the access token in a short-lived session cookie only; it is never stored on our servers and is dropped when the session ends.
• Zoom: if you connect Zoom, we store your Zoom access and refresh tokens (encrypted) to create, update or delete the meeting for your online bookings, plus your Zoom user and account id. We never access your meetings, recordings or contacts. This data is deleted when you disconnect Zoom or uninstall the app.
• Support chat: if you contact us through the chat widget, your messages are handled by our chat provider. When you are signed in, your name and email address are passed to the widget so you do not have to re-enter them and your conversations stay tied to your account.
• Technical data: server logs (IP address, timestamps) kept briefly for security and abuse prevention.

3. Purposes and legal bases

Your data is used exclusively to provide the service: managing your account, displaying your availability, recording bookings, and sending confirmation, cancellation, and reminder emails (performance of the contract), as well as keeping the platform secure (legitimate interest). We do not sell your data and we do not send marketing emails without your consent.

4. How we share your data

We do not sell your personal data, and we never use or transfer Google user data for advertising, ad targeting, credit or lending decisions, or to data brokers. Google user data (your calendar availability and the booking events we manage) is processed only to provide the features you enabled and is not shared with any third party other than Google's own APIs. To operate the service, a limited number of providers acting strictly on our instructions may process other data on our behalf (for example email delivery and the support chat). We disclose data only with your consent or where required by law.

5. How we protect your data

We apply technical and organizational safeguards appropriate to the sensitivity of the data. All traffic is encrypted in transit with HTTPS/TLS. Account passwords are stored only as salted hashes, never in clear text. OAuth access and refresh tokens for connected Google and Microsoft calendars are encrypted at rest with AES-256-GCM before being written to our database. We request only the minimum scopes each feature needs, access is restricted on a need-to-know basis, and data is hosted on servers located in the European Union. The invitee calendar-overlay token is kept only in a short-lived session cookie and is never stored on our servers.

6. Cookies

Calenkli sets a single strictly necessary session cookie to keep you signed in. The support chat widget may store its own functional identifiers to keep your conversation history. No advertising cookies or analytics trackers are set. See our Cookie Notice for details.

7. Data retention

Your account data is kept for as long as the account is active. Bookings (including invitee details) are kept for up to 24 months after the meeting date, then deleted, unless the host removes them sooner. When you delete your account — which you can do at any time from Settings — your personal data and all related bookings are erased immediately, except where we are legally required to keep specific records. Access tokens for connected calendars are deleted as soon as you disconnect the integration or delete your account.

8. Your rights

Under the GDPR, you have the right to access, rectify, and erase your data, as well as the right to restrict or object to its processing and the right to data portability. To exercise these rights, write to us at [email protected]. You may also lodge a complaint with a supervisory authority, such as the CNIL in France (cnil.fr).

9. Google user data and Limited Use

Calenkli's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the booking features you enabled; we do not transfer it to others except as described above or with your consent; and we do not use it for advertising or to develop, improve, or train generalized AI or machine-learning models. You can revoke Calenkli's access at any time from your Google Account or by disconnecting the integration in Settings.