Privacy Policy for calendra.si and Calendra
This policy explains how Calendra processes personal data when users interact with the website, platform, tenant app, Calendra Guest app, integrations and support.
1. Controller and contact
For processing where Calendra determines the purposes and means of processing, the controller is:
2. When Calendra is controller and when it is processor
Calendra acts as controller for data processed for its own business: website, inquiries, sales, subscriptions, billing, support, security, legal obligations and communication with prospective or existing tenants.
Calendra generally acts as processor where it processes customer, guest, appointment, invoice, communication, file and other records on behalf of a tenant. In those cases, the tenant is usually the controller and determines the purpose of processing.
Where an individual exercises rights regarding data held in Calendra by a tenant, Calendra may redirect the request or assist the tenant with handling it.
3. Categories of personal data
- tenant and user data: name, email, phone, company, role, login data and account settings,
- guest and tenant customer data: name, contact details, appointment, service, communication, memberships, entitlements, courses and related records,
- billing data: orders, invoices, payments, tax and address data where required,
- integration data: Google, Zoom, Stripe, Apple, Firebase/push and other enabled connections,
- technical data: IP address, device, browser, logs, security events and message delivery statuses,
- files and content uploaded or created by a user or tenant in the platform where the feature is enabled.
4. Purposes and legal bases
- providing and maintaining the Calendra platform,
- creating and managing user accounts, appointments, orders, invoices, payments, messages and notifications,
- performing subscription relationships and user support,
- security, abuse prevention, debugging and diagnostics,
- complying with legal obligations, especially accounting, tax, legal and security obligations,
- processing on tenant instructions where Calendra acts as processor.
5. Google API Services User Data Policy and Limited Use disclosure
The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell Google user data, do not use it for advertising or third-party profiling, and share it only to the extent needed to provide functionality that the user enables in Calendra.
6. Data retention
We keep data only for as long as needed for the described purposes, legal obligations, security, claims or tenant instructions.
Invoices, payments and business records
Kept for as long as required by accounting, tax, evidentiary or other statutory periods.
Tenant and user accounts
Kept for the duration of service use and a limited period after termination, unless longer retention is required for law, security or claims.
Guest and tenant customer data
Processed on the tenant's instructions. On account deletion, data is deleted or anonymised unless retention is needed for legal or legitimate reasons.
Security and technical logs
Kept for a limited period for security, abuse prevention, diagnostics and event evidence.
Backups
Data in backups is removed according to backup rotation; restoring a backup may temporarily restore older data, which is then handled again under the applicable rules.
7. Recipients, subprocessors and transfers
Data may be processed by our infrastructure, payment, communication, mobile service, integration, support and security providers where required to operate Calendra.
The current subprocessor list is published on the Subprocessors page. If data is transferred outside the European Economic Area, we use appropriate safeguards or another valid legal basis.
8. Cookies and analytics
We measure baseline traffic with Umami, a cookieless analytics tool we self-host on EU infrastructure. Google Analytics 4 uses Advanced Consent Mode: the Google tag loads with analytics storage denied by default. Before consent it does not set analytics cookies, while Google may receive limited cookieless measurements. More detailed measurement is enabled after consent. Advertising consent types remain disabled.
We do not send form contents, names, email addresses or phone numbers to Google Analytics. Visitors can change the Google Analytics choice at any time in cookie settings. Details are described in the Cookie Policy.
9. AI features
AI features are not enabled at production launch. If we enable them later, we will inform users and update the AI Transparency page and related settings.
10. Data subject rights
According to applicable law, you may request access, rectification, erasure, restriction, objection, portability and withdrawal of consent where the conditions are met.
For data held in Calendra by a tenant as controller, the correct first contact is usually the tenant. Calendra will assist the tenant where it acts as processor.
11. Contact
For privacy questions, contact: info@calendra.si.