PRIVACY
POLICY

→ Account Information

Email address, name, and authentication credentials when you sign up.

→ Google Calendar Data

We access the following Google user data through the Google Calendar API:

• Calendar events - Event start/end times, busy/free status
• Calendar metadata - Calendar names, IDs, time zones
• Event visibility - To determine if events should be synced

We DO NOT access or store: event titles, descriptions, attendees, locations, attachments, or meeting notes. We only read timing information needed to create blocking events.

→ Microsoft Calendar Data

For Microsoft/Outlook calendars, we access event timing and availability status through Microsoft Graph API. Same privacy-first approach: no event details, only times.

→ OAuth Tokens

Encrypted access tokens for Google, Microsoft, and Apple calendar services. Stored securely and never shared.

→ Usage Data

Sync logs, error reports, and performance metrics to improve the service.

→ Calendar Service Providers (Required for Service Operation)

To provide calendar synchronization, we must share data with:

• Google LLC - We send API requests to Google Calendar API containing OAuth tokens and calendar event data to read your events and create blocking events. Google processes this data according to their Privacy Policy.
• Microsoft Corporation - We send API requests to Microsoft Graph API for Outlook/Microsoft 365 calendar synchronization.
• Apple Inc. - If you connect Apple Calendar, we interact with Apple's CalDAV servers for event synchronization.

Purpose: These interactions are essential to read calendar events from your source calendars and create blocking events in your target calendars. Without this data sharing, the service cannot function.

→ Infrastructure & Service Providers

We use trusted third-party services to operate Caltsu:

• Vercel Inc. - Hosting and application infrastructure (servers in US/EU)
• Neon (Neon Inc.) - PostgreSQL database hosting with encryption at rest
• Stripe Inc. - Payment processing (we do not store credit card numbers)
• Inngest Inc. - Background job processing for calendar sync tasks

Purpose: These providers process data on our behalf to operate the service infrastructure. They are bound by data processing agreements and cannot use your data for their own purposes.

→ Legal Requirements

We may disclose user data if required by law, court order, or government regulation, or to protect the rights, property, or safety of Caltsu, our users, or others.

→ Encryption

In Transit: All data transmitted between your browser, our servers, and calendar APIs is encrypted using TLS 1.3 or higher.

At Rest: Database stored in Neon PostgreSQL with AES-256 encryption. OAuth access tokens and refresh tokens are encrypted separately using application-level encryption with unique per-user keys.

→ Infrastructure Security

Our infrastructure is hosted on enterprise-grade cloud providers:

• Vercel (SOC 2 Type II certified) - Application hosting with DDoS protection
• Neon (SOC 2 compliant) - PostgreSQL database with automated encrypted backups
• ISO 27001 certified data centers with physical security controls

→ Access Control

Principle of Least Privilege: Only authorized technical personnel have access to production systems. All access is logged and audited. Multi-factor authentication is required for all administrative access. Customer data access is restricted to support requests only.

→ Data Retention Policy

Google Calendar Data: We do not store event details (titles, descriptions, attendees). We only store:

• Event timing hashes (to detect changes) - Retained for 90 days
• Sync logs (timestamps, success/error status) - Retained for 90 days
• OAuth tokens - Retained until you disconnect the account or delete your account

Account Data: Your account information (email, name, connected accounts, sync configuration) is retained until you delete your account.

→ Data Location

Primary data storage: United States (Neon US region). Application servers: Global CDN with automatic routing to nearest region. Your data may be processed in the US and EU.

→ Right to Access

Request a complete copy of all personal data we store about you, including account information, connected calendars, sync configuration, and logs.

How to exercise: Email privacy@caltsu.com with "Data Access Request" in the subject line. We will respond within 30 days with a downloadable archive.

→ Right to Correction

Update your email address, name, or other account information directly in your account settings.

How to exercise: Log in to your dashboard → Settings → Account. Or email support@caltsu.com.

→ Right to Deletion (Right to be Forgotten)

You can delete your account and all associated data at any time. Deletion is permanent and includes:

• Your account information (email, name, profile)
• All connected calendar accounts and OAuth tokens
• Sync configuration and rules
• All sync logs and event hashes
• Billing information (Stripe customer ID)

Note: We will also delete all blocking events we created in your calendars. Original events in your calendars remain untouched.

→ Right to Data Portability

Export your sync configuration, connected accounts list, and sync rules in machine-readable JSON format.

How to exercise: Dashboard → Settings → Export Data, or email support@caltsu.com.

→ Right to Revoke Access

Disconnect any calendar account at any time from your dashboard. This immediately revokes our access to that calendar and deletes associated OAuth tokens.

How to exercise: Dashboard → Connected Calendars → Click "Disconnect" next to any account.

You can also revoke access directly through Google, Microsoft, or Apple account settings.

→ Right to Object & Restrict Processing

Object to specific data processing activities or request temporary restrictions. Contact privacy@caltsu.com with your specific request.

→ Google Calendar API

For syncing Google calendars. Subject to Google's privacy policy.

→ Microsoft Graph API

For syncing Microsoft/Outlook calendars. Subject to Microsoft's privacy policy.

→ Stripe

For payment processing. We don't store credit card information. Subject to Stripe's privacy policy.