You’re viewing an archived version of our Privacy Policy. Please visit the latest version for up-to-date information.

Effective date: 1 October 2026 - 31 October 2026

The short version

Nobody reads privacy policies. So here's the whole thing in ten lines, and the full version below it.

• You own your data. For bookings made through your Cal.com account, you are the controller and we are the processor. We handle it on your behalf and we don't sell it, to anyone, ever.

• We collect the minimum. Names, emails, phone numbers, and whatever your booking questions ask for. Plus the boring technical stuff every website gets: IP address, browser, pages viewed.

• The database is where personal data lives. Not in our logs, not in our analytics, not in a spreadsheet. Our own engineering rules ban personal data from logs, error reports, and analytics events. We send IDs, not people.

• We use subprocessors, and we name all of them. Email, SMS, video, payments, AI, storage, support. The full table and their purpose is in our Trust Center.

• AI features are opt-in and narrow. AI meeting notes send the transcript text (no titles, no attendee list, no links). AI phone agents send the phone number and the guest details needed to place the call. Nothing is used to train anyone's models.

• Your apps are your choice. When you connect Google Calendar, Zoom, Salesforce, or a webhook, data flows there because you told it to. Those are your integrations, under your instructions.

• No third-party cookies in the product. Our marketing site does run analytics and ad measurement. See the cookies section.

• You can get your data out, or delete it. Any time, self-serve or by email. Deleting means deleted, including at our subprocessors.

• Questions: privacy@cal.com. Real humans, not a form.

Who's who: controller vs. processor

This trips people up, so it goes first.

What it means: if you're an attendee who booked a meeting and you want your data deleted, the fastest route is the person you booked with. We'll help either way, and we'll pass the request on.

What we collect

Data you and your bookers give us

• Account data: name, email, username, password hash or SSO identity, time zone, profile photo, and your availability.

• Booking data: attendee names and emails, phone numbers where SMS reminders or phone calls are used, meeting titles and locations, answers to your booking questions, notes, guest lists, cancellation and reschedule reasons.

• Billing data: company name, billing address, and payment card details. The card goes straight to Stripe, and we never see or store it.

• Support data: whatever you write to us, plus the account context attached to the conversation.

Data we collect automatically

• IP address, browser and device, referring URL, pages viewed, and timestamps.

• Product usage events (which features you used, how often) tied to an opaque ID, not to your email.

• Error and performance diagnostics when something breaks.

What we deliberately don't do

• We don't collect special-category data on purpose. Your booking questions might, though. If you ask about health, that's health data in your Cal.com account, and it's on you to ask for it lawfully. See "Health information".

• We don't knowingly collect data from anyone under 18.

• We don't build advertising profiles out of booking data, and we don't sell or rent personal data.

What it means: we hold what's needed to put a meeting on two calendars, bill you, and support you. The interesting personal data, your bookers' answers, we hold for you, not for us.

Why we're allowed to (legal bases, GDPR Art. 6)

Subprocessors: who else touches personal data

We use other companies to run Cal.com. Every subprocessor has a data-processing agreement with us, only gets what it needs, and only processes data on our instructions. What they do and where they process data are listed in our Trust Center.

How you hear about changes. In accordance with our Data Processing Agreement, we may add or replace subprocessors to provide, operate, secure, and support Cal.com. Where required by the DPA, we will tell you before a new or replacement subprocessor starts processing Customer Personal Data.

If you object on reasonable and substantiated data-protection grounds, you can do so as described in the DPA. If you have questions about a subprocessor, write to privacy@cal.com.

Advertising and lead identification (marketing site and marketing tools, not the product)

These are managed by our marketing team rather than wired into the product code, and they only ever see marketing-site and marketing-list data, never booking data, attendee answers, or anything from your Cal.com account.

What it means: if you're in the EEA or UK, the audience-matching and visitor-identification vendors don't run on you. Anywhere else, you can turn them off by declining marketing cookies, or by using Global Privacy Control.

Apps and integrations you connect

When you connect an app, you're telling us to send data to it. We do exactly that and nothing more.

• Calendars: Google Calendar, Microsoft Outlook, Apple/CalDAV, Zoho: event titles, descriptions, times, locations, organizer and attendee names and emails, and free/busy data.

• Video: Zoom, Google Meet, Microsoft Teams and others: meeting details needed to create the link.

• CRM and automation: Salesforce, HubSpot, Pipedrive and similar: attendee name and email, meeting details, and your booking-question answers.

• Webhooks and your own SMTP server: you supply the endpoint or mail server; it receives whatever the events you subscribed to contain.

What it means: these are your processors, not ours. Their privacy policies apply, and disconnecting the app stops the flow. We can't delete what's already in your CRM.

Health information (PHI)

Cal.com isn't a health product, but bookings can carry health information: an intake question, a meeting title, notes. If you use Cal.com for anything HIPAA-regulated, that data is only as protected as the agreement behind it: get a BAA in place at go.Cal.com/BAA before you collect it, and keep it out of booking fields that get copied into third-party apps.

How long we keep it

Where your data goes

We're a US company and data is processed in the United States. Some subprocessors process it elsewhere. For transfers out of the EEA or UK to the United States, we rely on the EU-U.S. Data Privacy Framework and its UK Extension where applicable, as described below. We also use Standard Contractual Clauses where appropriate, including for transfers from Switzerland. If you need EU data residency, contact us at privacy@cal.com.

EU-U.S. Data Privacy Framework and UK Extension

Cal.com, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. Cal.com, Inc. has certified to the Department that it adheres to the EU-U.S. DPF Principles for non-HR personal data received from the European Union and European Economic Area in reliance on the EU-U.S. DPF, and from the United Kingdom and Gibraltar in reliance on the UK Extension. This commitment does not cover employee HR data transferred for use in an employment relationship. If this policy conflicts with the DPF Principles, the Principles govern. Learn about the program and, once Cal.com appears on the Data Privacy Framework List, view its listing at dataprivacyframework.gov.

The covered data may include names, email addresses, phone numbers, account and profile details, availability, booking and meeting details, answers to booking questions, billing and support information, and website, device, usage, and security information. Customers may configure booking questions that collect sensitive data. We use covered data to provide scheduling and related services, manage accounts, bookings and payments, communicate with users and attendees, provide support, secure and improve the service, and conduct marketing where permitted. Other sections of this policy describe these data and purposes in more detail.

We disclose relevant covered data to service providers and subprocessors for hosting, storage, email and SMS, video, payments, support, analytics, security and optional features, and to integrations selected by customers. Our Trust Center lists subprocessors and their purposes. We may also disclose personal data when required by law. Under the DPF Accountability for Onward Transfer Principle, Cal.com remains liable if an agent processes covered data inconsistently with the Principles, unless Cal.com proves it was not responsible for the event giving rise to the damage.

Individuals may request access to covered data and ask us to correct, amend or delete data that is inaccurate or processed in violation of the Principles. Where the DPF Choice Principle requires it, individuals may opt out before covered data is disclosed to a third party or used for a materially different purpose. Where that Principle requires affirmative consent for sensitive information, we will obtain it before the relevant use or disclosure. Send requests to privacy@cal.com. For booking data we process on a customer’s instructions, we will coordinate with that customer to address the request.

EU and UK individuals should first send DPF inquiries or complaints to Cal.com, Inc., Privacy & Compliance, 2261 Market Street #4382, San Francisco, CA 94114, United States; privacy@cal.com; +1 415 212 6667. Felix Kolodziej, Compliance Lead, can also be reached at felix@cal.com. We will respond to DPF complaints within 45 days. For unresolved complaints about covered data, we commit to cooperate with and comply with the advice of the panel established by the EU data protection authorities for EU data, and the UK Information Commissioner’s Office and Gibraltar Regulatory Authority for UK and Gibraltar data. These independent recourse mechanisms are available to individuals free of charge.

Cal.com, Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission for its compliance with the EU-U.S. DPF and UK Extension. Under certain conditions, individuals may invoke binding arbitration for residual claims about DPF compliance. We may be required to disclose covered data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Cookies

• In the app: cookies for logging you in, remembering preferences, and security. No third-party advertising cookies.

• On the marketing site: the analytics and ad-measurement cookies listed above. You can decline them.

• We honour Global Privacy Control and Do Not Track signals.

Your rights

Wherever you live, you can ask us to: access your data, correct it, delete it, export it, restrict or object to processing, or withdraw consent. If you're in California, add: know what we collect, delete it, correct it, and opt out of sale or sharing. We don't sell or share it, so there's nothing to opt out of. If you're in the EEA or UK, you can also complain to your data protection authority.

Most of this is self-serve in your settings. Otherwise email privacy@cal.com and we'll respond within 30 days. We'll ask you to verify who you are first, and we won't treat you worse for asking.

Security

Encryption in transit and at rest, least-privilege access, SSO and 2FA, audited infrastructure, and a bug bounty. Details and our current reports: cal.com/security. No system is perfectly secure; if something goes wrong we'll tell affected customers without unnecessary delay and per our DPA.

Changes to this policy

We'll post the new version here and update the effective date. For anything material, such as a new subprocessor category or a new use of data, we'll email you before it takes effect.

Contact

Data Protection Officer: privacy@cal.com
Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, United States

EU representative (GDPR Art. 27): Felix Kolodziej, felix@cal.com, address on request

Everything else: privacy@cal.com