Privacy policy — Cal.com

Cited by

Facts read from this source

• Controller processor split Report an error

  “For bookings made through your Cal.com account, you are the controller and we are the processor, under the Data Processing Agreement at cal.com/dpa, which is part of our Terms of Service for every account, free or paid.”

• No data sale Report an error

  “We handle it on your behalf and we don’t sell it, to anyone, ever.”

• No third party cookies product Report an error

  “No third-party cookies in the product. Our marketing site does run analytics and ad measurement.”

• Export and deletion Report an error

  “You can get your data out, or delete it. Any time, self-serve or by email. Deleting means deleted, including at our subprocessors.”

• Privacy contact Report an error

  “Questions: privacy@cal.com. Real humans, not a form.”

• DPA signed by default Report an error

  “Processor. We process attendee data on your instructions, under our DPA (cal.com/dpa). If you have a separately signed DPA with us, that one applies instead.”

• Own service providers Report an error

  “To run our own business we use service providers that see our customers’ contact details, for example Documenso and Fusial for e-signing contracts and DPAs (United States). They act on our instructions and are not subprocessors of your data.”

• Collected account data Report an error

  “Account data: name, email, username, password hash or SSO identity, time zone, profile photo, and your availability.”

• Avatarapi profile photo Report an error

  “At signup we may look up a profile photo for your email address through AvatarAPI; you can replace or remove it.”

• Card data stripe Report an error

  “The card goes straight to Stripe, and we never see or store it.”

• No minors data Report an error

  “We don’t knowingly collect data from anyone under 18.”

• No ad profiles Report an error

  “We don’t build advertising profiles out of booking data, and we don’t sell or rent personal data.”

• Legal bases Report an error

  “Run the product you signed up for Contract Bill you and chase unpaid invoices Contract / legitimate interests Keep the service secure, prevent abuse and fraud Legitimate interests Product analytics and diagnostics Legitimate interests (opt-out available) Marketing emails and ad measurement Consent, where required Respond to legal demands Legal obligation”

• Change notice Report an error

  “Before a new or replacement subprocessor starts processing Customer Personal Data, we give you prior written notice by email to your account administrator or privacy/legal contact, by in-product notification, or by another documented electronic method.”

• Objection right Report an error

  “If you object on reasonable and substantiated data-protection grounds, you can do so as described in the DPA.”

• Gpc honored Report an error

  “Anywhere else, you can turn them off by declining marketing cookies, or by using Global Privacy Control.”

• Calendars Report an error

  “Calendars: Google Calendar, Microsoft Outlook, Apple/CalDAV, Zoho: event titles, descriptions, times, locations, organizer and attendee names and emails, and free/busy data.”

• Video Report an error

  “Video: Zoom, Google Meet, Microsoft Teams and others: meeting details needed to create the link.”

• CRM Report an error

  “CRM and automation: Salesforce, HubSpot, Pipedrive and similar: attendee name and email, meeting details, and your booking-question answers.”

• Automation Report an error

  “Automation and links: Zapier, Dub, Close and similar app-store integrations you connect run under your own account with that provider.”

• Custom webhooks smtp Report an error

  “Webhooks and your own SMTP server: you supply the endpoint or mail server; it receives whatever the events you subscribed to contain.”

• HIPAA baa Report an error

  “ask us for a Business Associate Agreement (available on Teams plans and up; email privacy@cal.com or ask support or sales) and have it signed before you collect it, unless your Order Form or other signed agreement with us expressly permits it”

• Retention export window Report an error

  “You get an export window of at least 30 days; we then delete the data we process for you, normally within 90 days, except what we must keep by law.”

• Retention tax records Report an error

  “As long as tax law requires (typically 7-10 years)”

• Retention sentry Report an error

  “Error diagnostics (Sentry) 90 days; internal user and organization IDs only, no names, email addresses or IP addresses”

• Cal video recordings Report an error

  “Cal Video recordings and transcripts from bookings: stored in our own cloud storage until you delete them or ask us to.”

• Processing location Report an error

  “We’re a US company and data is processed in the United States; some subprocessors process it elsewhere (see the table).”

• Dpf certified Report an error

  “For transfers from the EEA and the UK, Cal.com, Inc. participates in and has certified its compliance with the EU-U.S. Data Privacy Framework and its UK Extension.”

• Scc fallback Report an error

  “Where the Data Privacy Framework does not cover a transfer, and for Switzerland, we rely on the 2021 EU Standard Contractual Clauses, the UK Addendum and the Swiss amendments, all completed in our SCC Schedule at cal.com/dpa-scc”

• EU residency Report an error

  “If you need EU data residency, contact us at privacy@cal.com.”

• Dpf switzerland not applicable Report an error

  “The Swiss-U.S. Data Privacy Framework does not currently apply.”

• Dpf UK inquiries Report an error

  “EU and UK individuals should first send DPF inquiries or complaints to Cal.com, Inc., Privacy & Compliance, 2261 Market Street #4382, San Francisco, CA 94114, United States; privacy@cal.com”

• Dpf response time Report an error

  “We will respond to DPF complaints within 45 days.”

• Dpf ftc enforcement Report an error

  “Cal.com, Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission for its compliance with the EU-U.S. DPF and UK Extension.”

• No dnt sale Report an error

  “If you’re in California, add: know what we collect, delete it, correct it, and opt out of sale or sharing. We don’t sell or share it, so there’s nothing to opt out of.”

• User rights Report an error

  “you can ask us to: access your data, correct it, delete it, export it, restrict or object to processing, or withdraw consent.”

• Security measures Report an error

  “Encryption in transit and at rest, least-privilege access, SSO and 2FA, audited infrastructure, and a bug bounty. Details and our current reports: cal.com/security.”

• Breach notification Report an error

  “if something goes wrong we’ll tell affected customers without undue delay after becoming aware of a personal-data breach, as our DPA requires.”

• Policy change notice Report an error

  “For anything material, such as a new subprocessor category or a new use of data, we’ll notify you before it takes effect by email, in-product notification or another documented electronic method.”

• Entity address Report an error

  “Formal notices: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, United States, copy to legal@cal.com”

• EU representative Report an error

  “EU representative (GDPR Art. 27): Felix Kolodziej, CAYA Postbox 1040588, 96035 Bamberg, Germany, privacy@cal.com”

• AI features opt in Report an error

  “AI features are opt-in and narrow. AI meeting notes send the transcript text (no titles, no attendee list, no links). AI phone agents send the phone number and the guest details needed to place the call. Nothing is used to train anyone’s models.”

• Log personal data ban Report an error

  “Our own engineering rules ban personal data from logs, error reports, and analytics events. We send IDs, not people.”

• Trust center listing Report an error

  “The full table and their purpose is in our Trust Center; before a new one starts, we give account owners prior written notice by email, in-product notification or another documented electronic method, early enough for you to review the change and object.”

• No minor health collection Report an error

  “We don’t collect special-category data on purpose. Your booking questions might, though. If you ask about health, that’s health data in your Cal.com account, and it’s on you to ask for it lawfully.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Independent Consultant Calendar sync & availability rules
• The Independent Consultant Integrations, API & data export
• The Independent Consultant European sovereignty
• The Data Protection Officer Calendar sync & availability rules
• The Data Protection Officer Integrations, API & data export
• The Data Protection Officer European sovereignty
• The Practice Owner Calendar sync & availability rules
• The Practice Owner Integrations, API & data export
• The Practice Owner European sovereignty
• The Sales Team Lead Calendar sync & availability rules
• The Sales Team Lead Integrations, API & data export
• The Sales Team Lead European sovereignty
• The Salon Owner Calendar sync & availability rules
• The Salon Owner Integrations, API & data export
• The Salon Owner European sovereignty
• The Skeptic Calendar sync & availability rules
• The Skeptic Integrations, API & data export
• The Skeptic European sovereignty