Privacy Policy

Account details for hosts (name, email, timezone, profile), booking records (guest name, email, answers to your intake questions, timing and timezone), connected-calendar tokens, and technical logs such as IP address and user agent needed to run and secure the service.

We process host data to perform our contract with you, guest data on the legitimate interest of arranging the meeting the guest asked for, and security logs on the legitimate interest of protecting the service. Where we rely on consent (non-essential cookies) you can withdraw it at any time.

When you connect Google Calendar we request only the scopes needed to read busy times and to write the events for your bookings. Tokens are encrypted at rest and used solely for those calls. Disconnecting the app in Integrations, or revoking access with the provider, stops all access immediately.

Booking records are kept for the life of the workspace so both sides keep a history, then deleted or anonymised 30 days after the workspace closes. Security and audit logs are kept for 12 months. Deletion requests are handled as described under your rights.

We share data with the processors listed on the Subprocessors page, with a calendar provider you connect yourself, and where the law compels us. We do not sell personal data and do not use booking content to train models.

You can request access, correction, deletion, a portable export, restriction of processing, or object to processing. Use the data request form; we verify the request and respond within 30 days. You may also complain to your local supervisory authority.

Where a processor operates outside your region, the transfer is covered by Standard Contractual Clauses or an equivalent mechanism recorded on the Subprocessors page.