Privacy policy

Version 2.0 — Effective date: 1 November 2026

The short version

Nobody reads privacy policies. So here’s the whole thing in ten lines, and the full version below it.

• You own your data. For bookings made through your Cal.com account, you are the controller and we are the processor, under the Data Processing Agreement at cal.com/dpa, which is part of our Terms of Service for every account, free or paid. We handle it on your behalf and we don’t sell it, to anyone, ever.

• We collect the minimum. Names, emails, phone numbers, and whatever your booking questions ask for. Plus the boring technical stuff every website gets: IP address, browser, pages viewed.

• The database is where personal data lives. Not in our logs, not in our analytics, not in a spreadsheet. Our own engineering rules ban personal data from logs, error reports, and analytics events. We send IDs, not people.

• We use subprocessors, and we name all of them. Hosting, email, SMS, video, payments, AI, analytics, monitoring, support and our own back-office tools that may see your data. The full table and their purpose is in our Trust Center; before a new one starts, we give account owners prior written notice by email, in-product notification or another documented electronic method, early enough for you to review the change and object.

• AI features are opt-in and narrow. AI meeting notes send the transcript text (no titles, no attendee list, no links). AI phone agents send the phone number and the guest details needed to place the call. Nothing is used to train anyone’s models.

• Lead enrichment is opt-in for hosts and skippable for bookers. If your host turns it on, we send your email address to People Data Labs to look up professional details (job title, company, LinkedIn) for the message they send you. We don’t keep the result. There is no general opt-out; you can skip it for that booking by ticking the box on the booking page.

• Your apps are your choice. When you connect Google Calendar, Zoom, Salesforce, or a webhook, data flows there because you told it to. Those are your integrations, under your instructions.

• No third-party cookies in the product. Our marketing site does run analytics and ad measurement. See the cookies section.

• You can get your data out, or delete it. Any time, self-serve or by email. Deleting means deleted, including at our subprocessors.

• Questions: privacy@cal.com. Real humans, not a form.

Who’s who: controller vs. processor

This trips people up, so it goes first.

Cal.com’s own service providers. To run our own business we use service providers that see our customers’ contact details, for example Documenso and Fusial for e-signing contracts and DPAs (United States). They act on our instructions and are not subprocessors of your data.

What it means: if you’re an attendee who booked a meeting and you want your data deleted, the fastest route is the person you booked with. We’ll help either way, and we’ll pass the request on.

What we collect

Data you and your bookers give us

• Account data: name, email, username, password hash or SSO identity, time zone, profile photo, and your availability. At signup we may look up a profile photo for your email address through AvatarAPI; you can replace or remove it.

• Booking data: attendee names and emails, phone numbers where SMS reminders or phone calls are used, meeting titles and locations, answers to your booking questions, notes, guest lists, cancellation and reschedule reasons.

• Lead-enrichment data (only where your host has enabled it): job title, seniority, LinkedIn URL and location for you, and name, size, industry and location for your company, returned by People Data Labs from your email address and its domain. Held in memory only while the workflow message is generated; not stored.

• Billing data: company name, billing address, and payment card details. The card goes straight to Stripe, and we never see or store it.

• Support data: whatever you write to us, plus the account context attached to the conversation.

Data we collect automatically

• IP address, browser and device, referring URL, pages viewed, and timestamps.

• Product usage events (which features you used, how often) tied to an opaque ID, not to your email.

• Error and performance diagnostics when something breaks.

What we deliberately don’t do

• We don’t collect special-category data on purpose. Your booking questions might, though. If you ask about health, that’s health data in your Cal.com account, and it’s on you to ask for it lawfully. See “Health information”.

• We don’t knowingly collect data from anyone under 18.

• We don’t build advertising profiles out of booking data, and we don’t sell or rent personal data.

What it means: we hold what’s needed to put a meeting on two calendars, bill you, and support you. The interesting personal data, your bookers’ answers, we hold for you, not for us.

Why we’re allowed to (legal bases, GDPR Art. 6)

Subprocessors: who else touches personal data

We use other companies to run Cal.com. Every subprocessor has a data-processing agreement with us, only gets what it needs, and only processes data on our instructions. What they do and where they process data are listed in our Trust Center.

How you hear about changes. Before a new or replacement subprocessor starts processing Customer Personal Data, we give you prior written notice by email to your account administrator or privacy/legal contact, by in-product notification, or by another documented electronic method. We use commercially reasonable efforts to give it early enough for you to review the change and object (DPA §6.3-6.4). Updating the subprocessor list alone is not our only way of giving notice.

If you object on reasonable and substantiated data-protection grounds, you can do so as described in the DPA. If you have questions about a subprocessor, write to privacy@cal.com.

Advertising and lead identification (marketing site and marketing tools, not the product)

These are managed by our marketing team rather than wired into the product code, and they only ever see marketing-site and marketing-list data, never booking data, attendee answers, or anything from your Cal.com account.

Vendors in this category (Google Analytics and Tag Manager, X Ads, Dub’s website attribution, LinkedIn and Meta ad tags) run only on the marketing website with your consent and are listed in the cookie banner; they are not subprocessors of booking data.

What it means: if you’re in the EEA or UK, the audience-matching and visitor-identification vendors don’t run on you. Anywhere else, you can turn them off by declining marketing cookies, or by using Global Privacy Control.

Apps and integrations you connect

When you connect an app, you’re telling us to send data to it. We do exactly that and nothing more.

• Calendars: Google Calendar, Microsoft Outlook, Apple/CalDAV, Zoho: event titles, descriptions, times, locations, organizer and attendee names and emails, and free/busy data.

• Video: Zoom, Google Meet, Microsoft Teams and others: meeting details needed to create the link.

• CRM and automation: Salesforce, HubSpot, Pipedrive and similar: attendee name and email, meeting details, and your booking-question answers.

• Automation and links: Zapier, Dub, Close and similar app-store integrations you connect run under your own account with that provider.

• Webhooks and your own SMTP server: you supply the endpoint or mail server; it receives whatever the events you subscribed to contain.

What it means: these are your processors, not ours. Their privacy policies apply, and disconnecting the app stops the flow. We can’t delete what’s already in your CRM.

Lead enrichment (People Data Labs) is different: it is our subprocessor under our DPA, switched on by your organization admin, and covered by the subprocessor section above.

Health information (PHI)

Cal.com isn’t a health product, but bookings can carry health information: an intake question, a meeting title, notes. If you use Cal.com for anything HIPAA-regulated, that data is only as protected as the agreement behind it: ask us for a Business Associate Agreement (available on Teams plans and up; email privacy@cal.com or ask support or sales) and have it signed before you collect it, unless your Order Form or other signed agreement with us expressly permits it, and keep it out of booking fields that get copied into third-party apps.

How long we keep it

Where your data goes

We’re a US company and data is processed in the United States; some subprocessors process it elsewhere (see the table). For transfers from the EEA and the UK, Cal.com, Inc. participates in and has certified its compliance with the EU-U.S. Data Privacy Framework and its UK Extension. Where the Data Privacy Framework does not cover a transfer, and for Switzerland, we rely on the 2021 EU Standard Contractual Clauses, the UK Addendum and the Swiss amendments, all completed in our SCC Schedule at cal.com/dpa/scc, which forms part of the DPA, as described in the Data Privacy Framework section below. You can verify our certification on the DPF List at https://www.dataprivacyframework.gov/list. The Swiss-U.S. Data Privacy Framework does not currently apply. If you need EU data residency, contact us at privacy@cal.com.

EU-U.S. Data Privacy Framework and UK Extension

Cal.com, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. Cal.com, Inc. has certified to the Department that it adheres to the EU-U.S. DPF Principles for non-HR personal data received from the European Union and European Economic Area in reliance on the EU-U.S. DPF, and from the United Kingdom and Gibraltar in reliance on the UK Extension. This commitment does not cover employee HR data transferred for use in an employment relationship. If this policy conflicts with the DPF Principles, the Principles govern. Learn about the program and view Cal.com’s listing on the Data Privacy Framework List at https://www.dataprivacyframework.gov/list.

The covered data may include names, email addresses, phone numbers, account and profile details, availability, booking and meeting details, answers to booking questions, billing and support information, and website, device, usage, and security information. Customers may configure booking questions that collect sensitive data. We use covered data to provide scheduling and related services, manage accounts, bookings and payments, communicate with users and attendees, provide support, secure and improve the service, and conduct marketing where permitted. Other sections of this policy describe these data and purposes in more detail.

We disclose relevant covered data to service providers and subprocessors for hosting, storage, email and SMS, video, payments, support, analytics, security and optional features, and to integrations selected by customers. Our Trust Center lists subprocessors and their purposes. We may also disclose personal data when required by law. Under the DPF Accountability for Onward Transfer Principle, Cal.com remains liable if an agent processes covered data inconsistently with the Principles, unless Cal.com proves it was not responsible for the event giving rise to the damage.

Individuals may request access to covered data and ask us to correct, amend or delete data that is inaccurate or processed in violation of the Principles. Where the DPF Choice Principle requires it, individuals may opt out before covered data is disclosed to a third party or used for a materially different purpose. Where that Principle requires affirmative consent for sensitive information, we will obtain it before the relevant use or disclosure. Send requests to privacy@cal.com. For booking data we process on a customer’s instructions, we will coordinate with that customer to address the request.

EU and UK individuals should first send DPF inquiries or complaints to Cal.com, Inc., Privacy & Compliance, 2261 Market Street #4382, San Francisco, CA 94114, United States; privacy@cal.com; +1 415 212 6667. Felix Kolodziej, Compliance Lead, can also be reached at felix@cal.com. We will respond to DPF complaints within 45 days. For unresolved complaints about covered data, we commit to cooperate with and comply with the advice of the panel established by the EU data protection authorities for EU data, and the UK Information Commissioner’s Office and Gibraltar Regulatory Authority for UK and Gibraltar data. These independent recourse mechanisms are available to individuals free of charge.

Cal.com, Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission for its compliance with the EU-U.S. DPF and UK Extension. Under certain conditions, individuals may invoke binding arbitration for residual claims about DPF compliance. We may be required to disclose covered data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Cookies

• In the app: cookies for logging you in, remembering preferences, and security. No third-party advertising cookies.

• On the marketing site: the analytics and ad-measurement cookies listed above. You can decline them.

• We honour Global Privacy Control and Do Not Track signals.

Your rights

Wherever you live, you can ask us to: access your data, correct it, delete it, export it, restrict or object to processing, or withdraw consent. If you’re in California, add: know what we collect, delete it, correct it, and opt out of sale or sharing. We don’t sell or share it, so there’s nothing to opt out of. If you’re in the EEA or UK, you can also complain to your data protection authority.

There is no general opt-out from lead enrichment. If you book with a host who uses it, you can skip it for that booking by ticking the box on the booking page; the lookup happens only when you complete the booking without ticking it.

Most of this is self-serve in your settings. Otherwise email privacy@cal.com and we’ll respond within the time limits required by applicable law. We’ll ask you to verify who you are first, and we won’t treat you worse for asking.

Security

Encryption in transit and at rest, least-privilege access, SSO and 2FA, audited infrastructure, and a bug bounty. Details and our current reports: cal.com/security. No system is perfectly secure; if something goes wrong we’ll tell affected customers without undue delay after becoming aware of a personal-data breach, as our DPA requires.

Changes to this policy

We’ll post the new version here and update the effective date. For anything material, such as a new subprocessor category or a new use of data, we’ll notify you before it takes effect by email, in-product notification or another documented electronic method.

Contact

Privacy contact: privacy@cal.com

EU representative (GDPR Art. 27): Felix Kolodziej, CAYA Postbox 1040588, 96035 Bamberg, Germany, privacy@cal.com

Formal notices: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, United States, copy to legal@cal.com

Everything else: privacy@cal.com

Privacy policy archive