Privacy policy

For bookings, the controller is the business or person you book with; their name is shown on the booking page. Calendo processes booking data on their behalf under the data processing agreement.

For Calendo user accounts, the controller is the service operator Salovuori Mikko Heikki (support@calendo.fi).

• People who book: name, email address, optional phone number, other attendees' email addresses, answers to booking questions (including an image or PDF file, if the organiser's form asks for one), notes, the booked time, language and time zone, and the company name and meeting address if they are recorded on the booking. If you book through Google Search or Maps, also Google's booking identifiers. If you reply to a text message reminder, the reply (confirm or cancel) and its time.
• AI booker: if the organiser uses it and you message them by text message, WhatsApp, Instagram or Messenger, your phone number (or your Instagram or Messenger user ID) and the messages of the conversation (including your name and email address if you give them). The replies are written by AI, and a booking is made, moved or cancelled only after you confirm it. The organiser can read the conversation in Calendo and reply personally. If the AI booker is not used, the organiser sees in the same way the messages you send them on these channels or in reply to a text message reminder, and AI can suggest a reply to them. The conversation is deleted 24 hours after the last message.
• Other organiser features, when used: joining a waiting list (name, email address and language), feedback on a meeting (rating and comment), answers to a scheduling poll (name, email address and suitable times), buying a punch card (name, email address, code and payment status), a loyalty reward code, and notes the organiser keeps about you as a customer.
• Monthly memberships: if you buy a membership from the organiser, your name, email address and language, your member code, the membership's status, price and billing period, Stripe's subscription and customer identifiers, and the bookings made with the membership.
• Apple Wallet: if you add a booking to Apple Wallet, the pass is created on request and saved on your device. It contains the organiser's name, the service, time, address or video link, your name and a link to manage the booking. Calendo does not send the pass to Apple.
• Marketing consent: if you tick the optional box "You may send me offers and news", the consent and its time, and the time you withdraw it. With consent you may also get messages about the organiser's last-minute openings; they are sent to customers who have previously visited for the same service. Sent offer e-mails are logged per recipient, together with whether a booking was made through the message.
• Abuse prevention: a one-way hash derived from the network address and browser; deleted after 48 hours.
• Calendo users: name, email address and account identifier from Google, Microsoft or Apple sign-in (with Apple, the address may be a private relay address provided by Apple), settings, and encrypted calendar access tokens (Google or Microsoft). If you connect a calendar by its subscription address (for example iCloud), the address is stored and only busy times are read from it. For paid plans also the plan, subscription status and the Stripe customer identifier or, for App Store subscriptions, Apple's transaction identifier, product and expiry date. If you turn on notifications by text message, your phone number. If you choose to be listed in the Calendo directory (calendo.fi/haku), your business name, logo, industry, city, services and free times are shown publicly.
• Mobile app (iPhone and Android) and notifications: the device's notification token, so that we can tell you about new and cancelled bookings. The token is deleted when you sign out of the app, turn notifications off or remove the app. App notifications do not contain your customers' names. The app keeps its sign-in token in the device's secure storage.
• Help assistant: a question you type into "Ask for help" is used only to produce the answer and is not stored by Calendo.
• Team members: name, email address and encrypted calendar access tokens (Google or Microsoft).

Data is used to make, confirm, remind of, reschedule and cancel bookings (performance of a contract or steps before one) and to keep the service secure (legitimate interest). Data of Calendo users is used to provide the account, subscription, app notifications and help (contract) and to meet bookkeeping obligations (legal obligation). An AI booker conversation is used only to make, move or cancel the booking you ask for (contract), and nothing is decided automatically without your confirmation.

Offers and news are sent by e-mail only with your consent (consent). The box is optional and not ticked in advance, and booking does not depend on it. You can withdraw consent at any time with the link in every message or by contacting the organiser; withdrawal does not affect booking messages. A loyalty discount code is sent to regular customers as part of the booking service (legitimate interest of the organiser).

When you connect a Google or Microsoft account, Calendo uses its data only to provide the booking features you see in the app: signing in, checking free and busy times, creating, moving and cancelling booking events in the calendar you choose, and sending booking messages to your customers from your own address. From the calendars you select, Calendo shows the time and title of your other events only to you in your own booking calendar and does not store them. Calendo does not read the contents of your mailbox. With Sign in with Apple, Calendo receives from Apple only an account identifier, an email address and, on first sign-in, your name.

Calendo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The data is not used for advertising, is not sold, is not used to train AI models, and is not shared with third parties except as needed to provide the service or as required by law. You can revoke access at any time in the app's settings or in your Google account.

• Cloudflare, Inc.: hosting and database.
• Google Ireland Ltd: ad measurement on marketing pages, only with consent.
• Anthropic, PBC: optional AI features. For the Pro plan's preparation summary, booking answers and notes are sent only when the account holder requests a summary. A question typed into the "Ask for help" assistant is sent to produce the answer. If the organiser uses the AI booker, the messages of the text message, WhatsApp, Instagram or Messenger conversation and the organiser's services and free times are sent to produce the replies. When the organiser asks for a reply suggestion, the conversation and your upcoming bookings with them are sent. If the organiser uses Ask Calendo, a summary of their bookings is sent to answer their question: customer names, visit counts and dates, services and prices, but no contact details. The data is not used to train AI models.
• Stripe Payments Europe, Ltd.: payments for Calendo subscriptions (card details are handled only by Stripe). When an organiser asks for payment at booking or sends a payment link after the meeting, you pay on Stripe's payment page (or in person on the organiser's iPhone with Tap to Pay) to the organiser's own Stripe account; Stripe and the organiser are responsible for that payment data, and Calendo stores only the amount, the payment status and Stripe's reference numbers. Monthly memberships sold by an organiser are likewise billed as a Stripe subscription on the organiser's own Stripe account.
• Twilio Inc.: text message and WhatsApp confirmations and reminders, payment links, replies to reminders and AI booker conversations, when the organiser uses them and you gave a phone number or sent a message. Also notifications a Calendo user has chosen to receive by text message (customer name and time). WhatsApp messages are also delivered by Meta Platforms Ireland Ltd (WhatsApp).
• Meta Platforms Ireland Ltd: AI booker conversations on Instagram and Messenger, if the organiser has connected their Facebook Page or Instagram account and you message them there. Meta processes its own users' data under its own privacy policy.
• Zoom Communications, Inc.: the video meeting and its link, when the organiser holds the meeting on Zoom (meeting topic, time and your name).
• Services the organiser connects with webhooks (for example Zapier or their own CRM) receive the booking details; the organiser is responsible for them.
• Google LLC: calendar events, Google Meet links and confirmation emails, sent through the Google account the organiser has connected. If the organiser has turned on Reserve with Google, Calendo sends Google the business details, services and free times, receives the name, email address and phone number of people who book through Google Search or Maps, and tells Google the status of those bookings and whether a booking that started from Google was confirmed. Google processes the data of its own users under its own privacy policy.
• Microsoft Ireland Operations Ltd and Microsoft Corporation: calendar events, Microsoft Teams links and confirmation emails, sent through the Microsoft account the organiser has connected.
• Apple Inc. and Apple Distribution International Ltd: Sign in with Apple, App Store subscriptions and notifications in the iOS app (Apple Push Notification service). Apple handles App Store payments under its own terms; Calendo receives only the subscription identifiers and status.
• 650 Industries, Inc. (Expo): delivers the mobile app's notifications to Apple (iPhone) and to Google Firebase Cloud Messaging (Android). The device token and the notification text are passed on, without customer names. Browser notifications are sent without content through the browser maker's push service.

These processors may process data outside the EU/EEA; such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Bookings, including their attachments, are deleted automatically after the retention period set by the organiser (by default 365 days after the meeting). Calendar events created in the organiser's own calendar follow their calendar's settings. Conversations (the AI booker and messages to the organiser) are deleted 24 hours after the last message and waiting list entries once the day has passed. Calendo account data is deleted within 30 days of the account being deleted; bookkeeping records are kept for the period required by law.

You may request access to, correction or deletion of your data, restrict or object to processing and ask for data portability. You can download the booking data linked to your email address, or delete it, yourself at calendo.fi/omat-tiedot; the organiser is notified of a deletion. For other requests about bookings, contact the organiser; for Calendo accounts, contact support@calendo.fi. You can delete your Calendo account and all its data yourself: in the mobile app under Settings → Delete account, or on the web under Settings → Sign-in → Delete account. You may also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

People who book get no cookies. The booking form keeps an unsent draft in the browser's session storage until the tab is closed. If you arrive at a booking page from Google Search or Maps, the browser's local storage remembers Google's referral identifier for 30 days so that a confirmed booking can be reported to Google, as Google requires. Calendo users get strictly necessary sign-in cookies (a signed session cookie for 7 days and short-lived sign-in state cookies).

On Calendo's marketing pages (such as calendo.fi/esittely and the sign-up page) we use Google Ads cookies to measure our ads only if you accept them. They record whether a visitor who clicked an ad created an account. You can change your choice at any time from "Cookie settings" in the page footer. Booking pages, embedded booking forms and the dashboard never use them.

All traffic is encrypted, the dashboard requires sign-in, calendar access tokens are stored encrypted and the booking form has abuse protection. Files attached to a booking can be downloaded only by the organiser. More details: calendo.fi/tietoturva.

Page visits are counted with Cloudflare Web Analytics, which uses no cookies and does not identify or track individual visitors across sites.

This policy may be updated when the service changes. The current version is always available at calendo.fi/privacy.