Privacy Policy

Last updated: September 17, 2026

CalFlow ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered scheduling platform.

1. Data Controller

The data controller for CalFlow is:

2. Information We Collect

2.1 Personal Information

When you register for CalFlow, we may collect:

  • Name and email address
  • Profile information (timezone, language preferences)
  • Phone number (for AI phone assistant features)

2.2 Payment Information

Payment processing is handled by Waffo Pancake, our payment processor and Merchant of Record. Waffo Pancake is PCI-DSS compliant and securely handles all payment information. We do not store your full credit card number or CVV on our servers.

2.3 Calendar Information

When you connect your calendar, we collect:

  • Calendar access tokens (securely encrypted)
  • Busy/free time information
  • Event details necessary for scheduling
  • Attendee information from scheduled meetings

2.4 Usage Data

We may automatically collect:

  • Device and browser information
  • IP address and location data
  • Pages visited and features used
  • Booking and scheduling activity

3. How We Use Your Information

We use collected information for:

  • Providing, maintaining, and improving our services
  • Processing transactions and sending related information
  • Sending notifications about bookings and reminders
  • Providing AI-powered phone assistant (Cal.ai) services
  • Ensuring calendar synchronization accuracy
  • Complying with legal obligations

4. Legal Basis for Processing

We process your data under the following legal bases:

  • Contract Performance: Providing and maintaining the service
  • Legitimate Interest: Security, fraud prevention, service improvement
  • Consent: Marketing communications (you can opt out at any time)
  • Legal Obligation: Tax, accounting, and regulatory compliance

5. Information Sharing

We do not sell your personal information. We may share information with:

  • Service Providers: Third parties who assist in operating our platform (calendar APIs, AI services, cloud infrastructure)
  • Payment Processing: Waffo Pancake handles all payment data as Merchant of Record
  • Legal Requirements: When required by law or to protect our rights
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

6. Data Security

We implement industry-standard security measures including:

  • Encryption of data in transit (TLS/HTTPS) and at rest
  • Secure API authentication
  • Regular security audits and vulnerability scans
  • Access controls and monitoring
  • Incident response plan with 72-hour notification timeline

7. Cookies and Tracking

We use cookies and similar technologies to:

  • Strictly Necessary: Maintain authentication sessions (cannot be disabled)
  • Functional: Remember your preferences
  • Analytics: Analyze site traffic and usage (Google Analytics)

You can control cookies through your browser settings. For analytics opt-out, you may use available browser extensions.

8. Your Rights

Depending on your location, you may have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Export your data in machine-readable format
  • Restrict certain processing
  • Object to processing based on legitimate interests
  • Withdraw consent at any time
  • Lodge a complaint with your local data protection authority

To exercise your rights, contact us at privacy@calflow.app. We will respond within 30 calendar days.

9. Data Retention

We retain your data for the following periods:

  • Account data: Retained while account is active, deleted within 90 days of account closure
  • Transaction records: Retained for 7 years for tax and accounting compliance
  • Usage logs: Retained for 90 days
  • Support correspondence: Retained for 2 years

You may request deletion of your personal data at any time, subject to legal retention requirements.

10. Payment Data

Payment processing is handled exclusively by Waffo Pancake as our Merchant of Record. Waffo Pancake is PCI-DSS compliant and securely handles all payment information. We do not store your full credit card number, CVV, or payment credentials on our servers.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States. We ensure appropriate safeguards are in place through:

  • Standard Contractual Clauses (SCC) with data processors
  • Data processing agreements with appropriate protections
  • Compliance with applicable data protection laws

12. Children's Privacy

CalFlow is not intended for users under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, please contact us immediately.

13. Third-Party Links

Our service may contain links to third-party websites or services. This Privacy Policy does not apply to third-party services. We recommend reviewing their privacy policies before providing any personal data.

14. Policy Changes

We may update this Privacy Policy at any time. Material changes will be communicated via email at least 15 days before effective date. Continued use of the service constitutes acceptance of updated terms.

15. Contact Us

For privacy-related questions or to exercise your rights:

We will respond within 30 calendar days.