1. The short version
We collect what we need to run your booking pages and events, and nothing more. We don’t sell personal data and we don’t show ads. The only analytics is Google Analytics on our marketing pages (home, pricing and the legal pages); booking pages, event pages and the app don’t load it.
Calera is run by Calera, a sole proprietorship based in Sri Lanka, which is responsible for your data. Contact support@calera.app with any privacy question.
2. What we collect
- Your account: name, email, password (stored hashed by our authentication provider), username, time zone and profile photo. If you sign in with Google, we receive your name, email and photo from Google.
- Your workspace: event types, availability, booking questions, widget settings, team members and invitations.
- Guests who book you: name, email, the time they chose, answers to your questions, notes and any voice note they record. Guests confirm their email with a one-time code, which we store only as a hash for 10 minutes.
- Guests who reply to an event: name, email, their reply, party size, meal choice and any message to the host.
- Connected calendars: if you connect Google Calendar or Outlook, the list of your calendars, your busy times, and the events we add for bookings. If you connect Zoom, your Zoom email and the meetings we create for bookings. Access tokens are encrypted.
- Billing: your plan, subscription status and Paddle customer ID. Card details go straight to Paddle; we never see or store them.
- Technical data: IP address and request details, used to rate-limit sign-ins, bookings and replies and to keep the service secure.
3. How we use it
- To run Calera: show your booking and event pages, offer free times, create bookings and calendar events.
- To send the emails Calera needs: sign-up codes, booking confirmations, reminders, reschedule and cancel notices, RSVP replies and your daily agenda.
- To prevent abuse and keep accounts secure.
- To bill paid plans and to answer you when you contact us.
We use account and workspace data because we need it to provide the service you signed up for, and security data because we have a legitimate interest in keeping Calera safe.
4. Hosts and guests
When someone books you or replies to your event, you (the host) decide what to collect and what to do with it, and we process it on your behalf. Guests who want to see, correct or delete their details should contact the host first. We’ll help hosts with those requests, and guests can always email us.
5. Who helps us run Calera
We share data only with the providers below, only as needed to run Calera, and under agreements that protect it:
- Supabase: database, authentication and file storage (photos, images and voice notes).
- Vercel: hosting.
- Resend: sending email.
- Microsoft and Zoom: Outlook, Teams and Zoom when you connect them.
- Paddle: payments and invoices, as our merchant of record.
- Google: “Continue with Google”, Google Calendar and Meet when you connect them, and Google Analytics, which counts visits to our marketing pages.
Calera’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use calendar data only to show your availability and add your bookings, never for ads, and people never read it unless you ask us to for support.
Some providers process data outside your country. Where that happens, they use safeguards such as standard contractual clauses. We may also share data if the law requires it.
7. How long we keep it
We keep your data while your account is open. When you delete your account in Settings › Profile, we delete your profile, personal workspace, event types, bookings, events and guest lists, and disconnect your calendars. Copies in backups expire on their normal schedule. Paddle keeps billing records as tax law requires.
8. Your choices and rights
You can see and change most of your data in Calera, and export bookings, contacts and guest lists as CSV. Depending on where you live, you can also ask us for a copy of your data, to correct or delete it, or to restrict or object to how we use it. Email support@calera.app and we’ll reply within 30 days. You can also complain to your local data protection authority.
9. Security
Data is encrypted in transit. Calendar tokens are encrypted at rest, verification codes are stored as hashes, and database access is checked row by row so each account sees only its own data. No system is perfectly secure; if a breach affects you, we’ll tell you promptly.
10. Children
Calera isn’t meant for anyone under 16, and we don’t knowingly collect their data.
11. Changes and contact
If we change this policy in a way that matters, we’ll tell you by email or in the app first. Questions or requests? Email support@calera.app.