Privacy Notice

1. Who we are

Calenkli ("we", "us") is an online appointment scheduling service available at calenkli.com. The data controller is GTA Go To Agency SAS (see our legal notice). For any question about your data or to exercise your rights, contact us at [email protected]. We may update this notice from time to time; the last-updated date above always reflects the current version.

2. Data we collect

• Host account: name, email address, password (stored only in hashed form), timezone, and the availability and event types you configure.
• Bookings: the invitee's name, email address, optional phone number, the chosen slot, their timezone, and any answers they provide on the booking form.
• Google sign-in (if you use it): we receive only your name, email address, and profile picture in order to create or link your account. We do not access any other data from your Google account without your explicit authorization.
• Google Calendar connection (host, optional): if you connect your Google Calendar, Calenkli uses the calendar.freebusy and calendar.events scopes to (a) read your busy/free times so it never offers a slot when you are already busy, and (b) create, update, and delete the calendar events for bookings made through Calenkli. We do not read the content or details of your other events. Your access and refresh tokens are stored encrypted (see “How we protect your data”) and are deleted when you disconnect the integration.
• Apple sign-in (if you use it): we receive your Apple account identifier and email address — which may be an Apple private relay address if you chose "Hide My Email" — and your name on first sign-in, solely to create or link your account.
• Invitee calendar overlay (optional): when booking, a visitor may connect their own Google Calendar to see their busy times on the page. We read only free/busy availability — never event details — and keep the access token in a short-lived session cookie only; it is never stored on our servers and is dropped when the session ends.
• Zoom: if you connect Zoom, we store your Zoom access and refresh tokens (encrypted) to create, update or delete the meeting for your online bookings, plus your Zoom user and account id. We never access your meetings, recordings or contacts. This data is deleted when you disconnect Zoom or uninstall the app.
• Support chat: if you contact us through the chat widget, your messages are handled by our chat provider. When you are signed in, your name and email address are passed to the widget so you do not have to re-enter them and your conversations stay tied to your account.
• Technical data: server logs (IP address, timestamps) kept briefly for security and abuse prevention.

3. Purposes and legal bases

Calenkli uses your data exclusively to provide the service: managing your account, displaying your availability, recording bookings, and sending confirmation, cancellation, and reminder emails (performance of the contract), as well as keeping the platform secure (legitimate interest). We do not sell your data and we do not send marketing emails without your consent. The advertising measurement tools a host may add to their booking pages serve that host's own advertising; in the European Economic Area, the United Kingdom and Switzerland, they load only with your consent, which you can withdraw at any time (see section 6).

4. How we share your data

We do not sell your personal data, and we never use or transfer Google user data for advertising, ad targeting, credit or lending decisions, or to data brokers. Google user data (your calendar availability and the booking events we manage) is processed only to provide the features you enabled and is not shared with any third party other than Google's own APIs. To operate the service, a limited number of providers acting strictly on our instructions may process other data on our behalf (for example email delivery and the support chat). On booking pages where a host has added their advertising measurement tools, those tools send browsing data from your browser directly to Meta or Google, as described in section 6. Apart from that, we disclose data only with your consent or where required by law.

5. How we protect your data

We apply technical and organizational safeguards appropriate to the sensitivity of the data. All traffic is encrypted in transit with HTTPS/TLS. Account passwords are stored only as salted hashes, never in clear text. OAuth access and refresh tokens for connected Google and Microsoft calendars are encrypted at rest with AES-256-GCM before being written to our database. We request only the minimum scopes each feature needs, access is restricted on a need-to-know basis, and data is hosted on servers located in the European Union. The invitee calendar-overlay token is kept only in a short-lived session cookie and is never stored on our servers.

6. Cookies and hosts' measurement tools

Calenkli sets a strictly necessary session cookie to keep you signed in, plus a few cookies that remember your choices (language, theme, answer to the consent window described below). The support chat widget may store its own functional identifiers to keep your conversation history. Calenkli itself sets no advertising cookies or analytics trackers. See our Cookie Notice for details.

A host may add their own advertising measurement tools (Meta Pixel, Google Analytics 4, Google Tag Manager) to their public booking pages, including when those pages are embedded on the host's website. The host uses them to measure their audience and their ads and to target their ads: these tools may set cookies on your device and send browsing data (page viewed, IP address, device type) to Meta or Google, and Google Tag Manager can load other tools chosen by the host. Meta and Google process this data under their own privacy policies. These tools never load on Calenkli's other pages. If you are in the European Economic Area, the United Kingdom or Switzerland, or if your country cannot be determined, a window asks for your consent: nothing loads until you click “Accept”, “Decline” is just as easy, and booking works normally either way. Your answer is kept on your device for 6 months (in a cookie and in the browser's local storage), separately for each host; you can change it at any time with the “Ad preferences” link at the bottom of the page. Elsewhere, these tools load directly. Everywhere, they never load if your browser sends the Global Privacy Control signal.

7. Data retention

Your account data is kept for as long as the account is active. Bookings (including invitee details) are kept for up to 24 months after the meeting date, then deleted, unless the host removes them sooner. When you delete your account — which you can do at any time from Settings — your personal data and all related bookings are erased immediately, except where we are legally required to keep specific records. Access tokens for connected calendars are deleted as soon as you disconnect the integration or delete your account.

8. Your rights

Under the GDPR, you have the right to access, rectify, and erase your data, as well as the right to restrict or object to its processing and the right to data portability. To exercise these rights, write to us at [email protected]. You may also lodge a complaint with a supervisory authority, such as the CNIL in France (cnil.fr).

9. Google user data and Limited Use

Calenkli's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the booking features you enabled; we do not transfer it to others except as described above or with your consent; and we do not use it for advertising or to develop, improve, or train generalized AI or machine-learning models. You can revoke Calenkli's access at any time from your Google Account or by disconnecting the integration in Settings.