Enweb Calendar Privacy Notice

Information and purposes

For hosts, we handle account and profile information, sign-in records, time zone, availability, appointment settings, and bookings to operate their scheduling account.

For people booking an appointment, we handle the name, email address, time zone, appointment time and location, booking answers, and reschedule or cancellation information provided through the service. These details allow the host to manage the appointment and allow us to send related service messages. Please avoid entering unnecessary sensitive information.

Session cookies support sign-in and authorization. Network information, request identifiers, and operational records support rate limiting, delivery checks, troubleshooting, and service security.

Connected Google and Microsoft calendars

Connecting a calendar is optional and separate from signing into Enweb Calendar. The provider displays the requested permissions before you authorize them.

Google access includes profile information, calendar read access, and permission to create, change, or delete calendar events. We read calendar lists and busy times to calculate availability. Connecting Google can also update your Enweb Calendar profile photo.

Microsoft access includes the account's basic profile, calendar read and write access, and continued access using refresh tokens. We read calendar lists and availability information to calculate available appointment times.

We use the selected calendars to check conflicts and the configured destination calendar to create, update, or cancel appointment events. The permissions granted by a provider can cover more information than the busy times used to calculate availability.

We store connection tokens, connected-account information, selected calendar identifiers, appointment records, and references to events created through the service in our database. Refresh tokens can allow access without asking you to sign in to the provider again until the grant expires or is revoked.

Sharing and access

Public booking pages display the host's chosen public profile, appointment offerings, and available times. Appointment details are shared with the host and relevant attendees through booking pages, booking-management links, transactional emails, and calendar events. Calendar-sharing settings at Google or Microsoft can affect who sees an event.

We use Vercel to host the application, Neon for its database, Resend for account and appointment emails, and Unkey for rate limiting. Google and Microsoft process information exchanged with their calendar services. These providers receive the information needed for their part of the service. Contact us for information about the applicable processing arrangements, including processing locations.

We limit staff access to the scheduling purposes described here, authorized support, necessary security work, and legal obligations. We do not sell personal information or use connected-calendar information for advertising.

Our use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements. Google data is used for the scheduling features described here. Transfers are limited to providing those features with consent, necessary security purposes, legal obligations, or a business transfer with prior explicit consent. Human access is limited to affirmative permission to view specific data, necessary security or legal purposes, or permitted aggregated internal operations. We do not use Google data for advertising, credit, or lending decisions.

Retention and deletion

We keep account information while it is needed to provide the account. We review inactive accounts and information that is no longer needed through a manual process. Ordinary completed or cancelled booking records are reviewed for deletion 12 months after their last appointment date, or sooner following a valid deletion request where no continuing legal obligation requires retention. Records needed for an unresolved request, a legal obligation, or a documented security investigation may be retained for that purpose and reviewed when it ends.

The native removal process deletes the stored connection credential and attempts to remove linked calendar selections. Please contact us if removal does not complete. Removal does not itself revoke the provider's grant or erase appointment records, events already created in a provider calendar, or emails already delivered. You can request review and deletion of information we still hold.

Service-provider records and copies may remain under their own retention and deletion controls after an application record is removed. We will explain known limits when responding to your request. We do not promise that removing an application record instantly erases every copy held by every provider or recipient.

Your choices and requests

You can remove a connection in Enweb Calendar and separately revoke the provider's access permission. Google's third-party connection controls explain how to remove access. Microsoft personal accounts can use application permissions; work or school accounts can use My Apps, and may need their administrator's help. Removing provider access can stop calendar synchronization and require reconnection.

Email contact@enweb.ca to request access, correction, account closure, deletion, withdrawal of consent, or to raise a privacy concern. Give enough information to identify your account or appointment, but do not send passwords, verification codes, or calendar tokens. We may verify your identity and clarify the request before disclosing information or making changes. We will explain the action taken, any information retained and why, and available next steps within applicable response deadlines. A request about the host's separate business records may also need to be directed to that host.

Changes to this notice

We will keep this notice and its effective date current. Before a material change to the purposes for which we use connected-calendar information, we will provide an updated disclosure and obtain additional consent where required.