Data Processing Addendum

← Back to homeData Processing and SubprocessorsLast updated: October 19, 2026 This page describes how Calynq handles personal data on behalf of customers (organizations and individuals who use Calynq to schedule meetings) and which service providers ("subprocessors") help us do it. It supplements our Privacy Policy and Terms of Service. If your organization needs a signed Data Processing Addendum, contact us through the contact page. Roles For the personal data you or your invitees put into Calynq (for example meeting participants, booking-page clients and their contact details), you are the controller and Calynq acts as your processor. For account, billing and security data about the people who use Calynq, we act as controller. What we process and why

Data: names, email addresses, phone numbers (when you or an invitee provide one), calendar availability and event details from connected calendars, booking and meeting records, and messages sent through Calynq.

Purpose: only to provide the scheduling service you ask for: finding times, creating and updating calendar events and video meetings, sending confirmations and reminders, taking payments you enable, and keeping your account secure.

Instructions: we process personal data on your documented instructions, which are your use of the product and these terms. We do not sell it.

Security

Data is encrypted in transit (TLS) and stored with our database provider with encryption at rest.

Access to customer data inside Calynq is limited by organization, role and row-level access rules; staff access is limited to what support and operations require.

Calendar and messaging connections use the providers' OAuth flows; you can disconnect them at any time.

Audit logs record important administrative actions in an organization.

Retention and deletion We keep personal data for as long as your account or organization is active, then delete it unless the law requires us to keep it (for example billing records). Some operational records are removed automatically on a schedule, such as message logs after 90 days, routing-form responses after 90 days and audit logs after 24 months. You can delete bookings and connections yourself, and you can download a copy of your data yourself under Settings, Account, Privacy & data. To have your data deleted, use the contact page. Incidents If we become aware of a breach of security affecting your personal data, we will notify the affected account owner without undue delay and provide the information we have to help you meet your own obligations. SubprocessorsWe use the following providers to deliver the service. Providers marked optional are used only when you turn on the related feature.

Supabase: database, authentication, file storage and server functions (core service).

Lovable: application hosting and the AI gateway used to explain suggested meeting times (core service).

Stripe: subscription billing and, if you enable paid bookings, payments through Stripe Connect (optional for payments).

Resend: transactional email such as confirmations, reminders and invitations.

Twilio: SMS and WhatsApp messages to hosts and clients (optional).

Google: Google Calendar and Google Meet when you connect a Google account (optional).

Microsoft: Outlook calendar and Microsoft Teams when you connect a Microsoft account (optional).

Zoom: Zoom meetings when you connect Zoom (optional).

Slack: Slack notifications and commands when you install the Slack app (optional).

Apple (iCloud Calendar): calendar access when you connect an iCloud calendar (optional).

Cloudflare: DNS lookups used to verify domains you claim for your organization.

We choose subprocessors with care and require them to protect personal data. We will update this page when we add or replace a subprocessor, and organizations with a signed addendum can ask to be notified of changes. Questions Contact us through the contact page for a signed addendum, a security questionnaire or any privacy request. Privacy Policy