Privacy policy

1. Data controller

The Calenoo service is operated by Ekylibr SA ("we", "Calenoo"). For any question about your personal data, write to us at privacy@calenoo.ch.

Postal address: Avenue du Mail 18, CP 389, 2002 Neuchâtel, Switzerland.

2. Data we collect

We only collect the data necessary to operate the service:

• Account data: email address, display name, preferred language and, if you share your availability, the email addresses of the people you have chosen. Your password is stored hashed and is never accessible in clear text.
• Poll data: title, description, location, proposed time slots, as well as the name, email address and responses of the organizer and participants.
• Technical data: IP address (stored hashed), browser type and error logs, for security and abuse-prevention purposes. Our analytics (AlpiStats) are aggregated and use no tracking cookie.
• Prepare a meeting (feature open to accounts linked to BeMyTalent): the starting address and the meeting address are used to calculate the travel time. The starting address you enter stays on your device; if your account is linked to BeMyTalent, the company address is suggested by default, read from BeMyTalent when the assistant opens and never stored by Calenoo; the poll only keeps the meeting place and the chosen travel time, which is never shown to participants. If the organizer opens the assistant from a BeMyTalent case, Calenoo sends BeMyTalent the poll title, the proposed slots, the public link, the number of responses per slot (yes, maybe, no), then the chosen date or the cancellation; with a team, who takes part and who is free on each slot (BeMyTalent identifiers only); never the participants' names or email addresses. The BeMyTalent link key you paste in your settings is stored encrypted and only used for these updates.

3. Calendar data (Google, Microsoft 365 / Outlook, Apple iCloud, Infomaniak)

If — and only if — you choose to link an external calendar, we process the specific data described below. This feature is optional and disabled by default.

• What data is collected? For Google and Microsoft: OAuth access and refresh tokens, stored encrypted. For Apple and Infomaniak: your email address and a dedicated app-specific password, stored encrypted. The events in your calendar are never stored on our servers: they are read on the fly and displayed only in your browser.
• What is it used for? Two uses, both visible to you: (a) reading (Google: calendar.readonly; Microsoft: Calendars.Read; Apple and Infomaniak: CalDAV), to display your busy times in the background while you create or answer a poll (for you alone, with the title of your events — never their attendees or description), and to compute the free slots of your booking page (your availability minus your busy times); (b) writing (Google: calendar.events; Microsoft: Calendars.ReadWrite; Apple and Infomaniak: CalDAV), when you confirm a poll's date or a guest books a slot on your booking page, to create the corresponding event in your calendar and, if you enabled it, add a video call link (Google Meet or Microsoft Teams), and to delete that event if the meeting is cancelled. If you ask for it when answering or creating a poll, Calenoo also creates tentative events there for your “Available” answers or for the slots you propose (travel included, if you entered it), and removes them on its own once a date is set, the poll is closed, cancelled or expired, the date has passed, or you ask for it. Calenoo never modifies or deletes events it did not create.
• How long is it kept? Until you unlink the calendar or delete your account. Deletion is immediate upon your action.
• Is it shared? Only if you decide so. From your settings, you can share your availability with other Calenoo users, designated by their email address: they then see your name and email address and, when they create a poll, your busy times — never the title, location, attendees or content of your events. You can remove a share at any time, with immediate effect. Apart from that choice, no calendar data is shared with other Calenoo users or with third parties, nor used for advertising purposes. If you also allow it, a person you share with can book in your calendar: Calenoo then adds, in the calendar that receives your appointments, the confirmed appointment and the tentative slots of a poll you take part in. This permission can be withdrawn at any time.
• What are your rights? You can unlink a calendar in one click from your dashboard, and remove a share from your settings. Deleting your account results in the complete deletion of the associated credentials and of your shares and revocation of access at the provider.

4. Compliance with the Google API policy

Calenoo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google Calendar data only to provide and improve the user-facing features described above (reading your availability and, for you alone, the title of your events; showing your busy times to the users you choose to share them with; creating or deleting the booking events that Calenoo creates). We do not sell this data, we transfer it to no one other than the users you have designated, for that feature only, and we allow no human to read it, except with your explicit consent, for security reasons, to comply with the law, or as part of internal operations on aggregated and anonymized data.

5. Legal basis for processing

We process your data on the following bases: performance of the contract (providing the scheduling service), our legitimate interest (service security and abuse prevention), and your consent (in particular for linking an external calendar, which you can withdraw at any time).

6. Retention period

Account data is kept as long as your account is active. Polls and their responses are automatically deleted after 90 days without activity (this period is extended with each new response); the organizer can delete them at any time. Calendar credentials are deleted as soon as you unlink the calendar or delete your account. When you delete your account, all your personal data is erased, unless a legal retention obligation applies.

If you request the deletion of your account, it takes effect after a 7-day grace period during which you can cancel it by signing in again. As soon as you request it, your linked calendars are unlinked and their access revoked, and your still-open polls are cancelled (their participants are notified). After the 7 days, your account and personal data are permanently deleted; your past polls and responses are anonymised and kept for the benefit of other participants. Erasure takes place within 30 days of your request at the latest (art. 32 nFADP).

7. Processors and sharing

We never sell your data. We rely on carefully selected processors, strictly to operate the service:

• Supabase (database hosting, Switzerland — Zurich).
• Vercel Inc. (frontend hosting).
• Resend (sending transactional emails: invitations, confirmations).
• Cloudflare Turnstile (anti-spam protection of forms).
• AlpiStats, a service by Ekytec (aggregated analytics, no cookie, usage data hosted in Switzerland).
• Travel time calculation (“Prepare a meeting”): a server operated by Ekylibr SA in Geneva (Infomaniak, Switzerland), based on the free OpenStreetMap map. Addresses are completed as you type and converted into coordinates by the Swiss federal service geo.admin.ch, from our server; the route calculator only receives coordinates.

8. International transfers

Your personal data (Supabase database) is hosted in Switzerland, in the Zurich region. Anonymised audience statistics are hosted in Switzerland (AlpiStats). However, some processors are based in the United States: Resend (email delivery), Vercel (application delivery via its CDN) and Cloudflare (Turnstile anti-spam protection). These transfers outside Switzerland and the EU are governed by standard contractual clauses (SCCs) or equivalent safeguards.

9. Security

Sensitive secrets — OAuth tokens and calendar app-specific passwords — are encrypted at rest. Communications are protected by TLS. Access to data is restricted and logged.

10. Your rights

Under the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the GDPR, you have the right to access, rectify, delete, restrict and port your data, as well as a right to object. To exercise these rights, write to privacy@calenoo.ch. You may also lodge a complaint with the competent data protection authority.

11. Cookies

Calenoo uses no advertising or tracking cookies. We only use necessary technical cookies (for example to remember your language and your session).

12. Changes to this policy

We may update this policy. The last-updated date appears at the top of the page. In case of a significant change, we will inform you by appropriate means.

Opt out of analytics

Audience measurement: this site uses AlpiStats, a Swiss cookie-free visit statistics service. Traffic data is collected, stored and backed up in Switzerland; it does not allow you to be identified. You can refuse this measurement in your browser from the banner provided for this purpose on calenoo.ch.