Privacy Policy
Last updated: How Calendaty handles your data.
When it is finished, this policy will explain what Calendaty collects, why we collect it, and what you can ask us to do with it.
Template only — not legal advice. Every section below is a [PLACEHOLDER] and must be written or reviewed by a qualified lawyer or a compliance service (e.g. Termly or iubenda) before publishing. Calendaty handles payments and personal data across MENA and the EU, so accurate terms matter.
What we collect
[ PLACEHOLDER ] Data we collect
This is a placeholder, not a description of what Calendaty actually holds. The finished section has to name every category of data the product collects and say whether it came from you, from the people who book with you, or from a connected calendar or payment provider.
[Add: account and profile data, booking and calendar data, information entered by the people who book with you, payment metadata, device and log data, AI conversation transcripts, and the lawful basis for each category]
How we use it
[ PLACEHOLDER ] Purposes of processing
Placeholder text, to be replaced before this page is published. Each purpose Calendaty processes data for belongs here individually; one line saying data is used to provide the service is not a policy.
[Add: every processing purpose listed separately, the lawful basis for each, whether AI features read customer conversations, what is used to train or improve models, and an explicit statement that data is not sold]
Payment data
[ PLACEHOLDER ] Payment & card data
Placeholder text, and one of the sections that most needs a specialist. Money moves through third-party processors, so what Calendaty stores and what the processor stores has to be stated outright rather than left to inference.
[Add: which processors handle cards (Stripe, PayPal), confirmation that Calendaty never stores full card numbers, what payment metadata is kept and for how long, PCI-DSS scope, and how refunds and chargebacks are recorded]
Third-party services
[ PLACEHOLDER ] Sub-processors & sharing
Placeholder text awaiting a real list. Calendaty passes data to calendar, payment, messaging and AI providers, and every one of them has to be named here with what it receives and why.
[Add: the current sub-processor list with each provider's role, country and safeguards, how customers are told before a new one is added, and a link to the data processing agreement]
Data retention
[ PLACEHOLDER ] Retention periods
Placeholder text, to be replaced. Real retention periods come from how the product is built and from what the law requires, so this section is written after the engineering answer, not before it.
[Add: a retention period for each data category, what happens to bookings and customer records when an account is deleted, backup and log windows, and any period tax or accounting law requires]
Your rights (GDPR)
[ PLACEHOLDER ] Data subject rights
This is a placeholder, and it must not end up as a paraphrase of the regulation. The finished section has to say how a person actually exercises each right with Calendaty and how quickly we answer.
[Add: access, rectification, erasure, restriction, portability, objection and withdrawal of consent, the channel a request is made through, the response deadline, the supervisory authority for complaints, and the equivalent rights under the MENA data protection laws that apply]
International transfers
[ PLACEHOLDER ] Cross-border transfers
Placeholder text, and another section that needs a specialist. Calendaty serves customers in MENA and the EU, so where data physically sits and what makes each transfer lawful has to be stated precisely.
[Add: the hosting regions, which transfers leave the EEA, the mechanism relied on for each (standard contractual clauses or an adequacy decision), the transfer impact assessment, and any local data residency rule Calendaty has to meet]
Contact us
[ PLACEHOLDER ] Controller & contact details
This is a placeholder. The legal entity behind Calendaty and the address a privacy request goes to belong here — a support email on its own is not enough.
[Add: the registered company name and address, who the data controller is, a dedicated privacy contact address, whether a DPO or an EU representative has been appointed, and where a complaint goes if we do not resolve it]
Ready when you are
Start free — no credit card required.