Privacy Policy

This policy explains how Calendoria ("Calendoria", "we", "us") collects, uses, shares, retains, and protects personal information when people use the Calendoria platform.

1. Scope and our role

This policy applies to Calendoria account holders, tenant owners, staff, visitors to our platform pages, and people who communicate directly with Calendoria. It also explains our platform-level practices when a customer books with a business using Calendoria.

A business using Calendoria is normally responsible for deciding why and how its customer information is used. Calendoria processes that information to provide the service to that business. Each business must publish its own privacy notice for its customers. Calendoria is directly responsible for account, billing, security, support, and platform-usage information that we collect for our own purposes.

2. Information we collect

• Account and business information: name, email, telephone number, business details, staff roles, authentication records, language, and account preferences.
• Booking and customer information: services, appointment times, customer contact details, notes supplied to a business, consent preferences, waitlist entries, loyalty activity, coupons, memberships, and gift-card records.
• Payment information: plan, subscription, invoices, transaction status, connected Stripe account identifiers, application fees, refunds, and limited card metadata. Full card numbers are handled by Stripe and are not stored by Calendoria.
• Communications: support requests, campaign configuration, email and SMS delivery records, unsubscribe events, and notification preferences.
• Calendar and integration information: authorization tokens, external calendar identifiers, busy-time data, webhook events, and integration status.
• Content and files: logos, business images, service and product images, website-builder content, forms, and other material uploaded by account holders.
• Technical and security information: IP address, device and browser details, login history, audit logs, cookies, error reports, and information used to detect fraud, abuse, or security incidents.

3. Why we use information

We use personal information to provide and secure the platform; create and administer accounts; process subscriptions and transactions; operate bookings, calendars, websites, campaigns, credits, and integrations; provide support; deliver required service communications; prevent fraud and abuse; maintain records; improve reliability and accessibility; and meet legal, tax, accounting, and regulatory obligations.

Marketing email and SMS require a separate choice where required. Accepting the Calendoria Terms does not subscribe a person to marketing.

4. Consent and other permitted uses

We seek meaningful consent where Canadian privacy law requires it and provide choices for uses that are not necessary to deliver the service. Some information is necessary to create an account, process a payment, secure the platform, or perform a contract. We may also use or disclose information where permitted or required by law.

You may withdraw consent for optional uses at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing already lawfully completed.

5. When we share information

We do not sell personal information. We disclose information only as needed to operate Calendoria, including to:

• the business with which a customer books and its authorized staff;
• Stripe for subscriptions, connected-account payments, fraud prevention, refunds, and payouts;
• Twilio and Resend for SMS and email delivery;
• Google and other calendar or meeting providers when an account holder enables an integration;
• hosting, storage, security, monitoring, and support providers acting for Calendoria;
• professional advisers, regulators, law enforcement, or courts where legally required; and
• a purchaser or successor in a proposed or completed business transaction, subject to appropriate safeguards.

6. Processing outside Canada

Some service providers process information in the United States or other countries. Information processed elsewhere may be subject to the laws and lawful-access rules of that jurisdiction. We use contractual, technical, and organizational measures appropriate to the service and information involved.

7. Retention and deletion

We retain information only as long as reasonably necessary for the purposes described in this policy, to provide an active account, resolve disputes, prevent fraud, maintain security, and satisfy legal, tax, accounting, and regulatory requirements. Retention periods differ by category. When information is no longer required, it is deleted, anonymized, or access-restricted according to our retention practices.

Closing an account does not require immediate deletion of financial records, security records, backups, or information that Calendoria or a tenant must retain by law. Tenant businesses are responsible for their own customer-retention decisions, subject to their agreement with Calendoria and applicable law.

8. Security

We use administrative, technical, and physical safeguards proportionate to the sensitivity of the information, including access controls, encryption in transit, password hashing, tenant isolation, audit logging, rate limits, backups, monitoring, and incident-response procedures. No online service can guarantee absolute security.

9. Cookies and similar technologies

Calendoria uses cookies and local storage that are necessary for authentication, security, language, session continuity, and application preferences. Optional analytics or advertising technologies should be used only where configured and permitted by the applicable consent settings. Browser controls can restrict cookies, but necessary features may stop working.

10. Your privacy rights

Depending on where you live, you may request access to or correction of personal information, ask how it has been used or disclosed, withdraw optional consent, request deletion where legally available, or submit a complaint. We may need to verify identity and may retain information where the law permits or requires it.

If your request concerns information controlled by a business using Calendoria, contact that business first. Calendoria will assist the business as required by our agreement and applicable law.

11. Quebec residents

For activities subject to Quebec's private-sector privacy law, Calendoria maintains privacy-governance practices addressing accountability, access, retention, destruction, complaints, service providers, and confidentiality incidents. A person may contact our Privacy Officer using the details below.

12. Children

Calendoria business accounts are not intended for people under the age of majority who cannot enter a binding business agreement. Businesses using the platform must obtain any legally required parental or guardian consent when collecting information about minors.

13. Changes to this policy

We may update this policy to reflect material changes to our services, providers, or legal obligations. We will change the version and effective date and provide additional notice or request renewed consent when required.

14. Contact the Privacy Officer

Questions, access or correction requests, withdrawal requests, and privacy complaints may be sent to the Privacy Officer of Calendoria at [email protected]. We may request information reasonably necessary to verify identity and locate the relevant records.