Privacy Notice
Last updated: 22 August 2026
1. Who we are
IntoCal is operated by Digiproduct OÜ, a company registered in Estonia. Digiproduct OÜ is the data controller for the personal data described in this Notice. You can reach us at privacy@intocal.com.
2. Scope
This Notice explains how we collect and use personal data of visitors to intocal.com, people who register for and use the IntoCal service ("hosts"), and people who book meetings through a host's booking page ("invitees" or "guests").
3. Data we collect and why
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, email, password hash, username, plan, profile fields (headline, bio, avatar, timezone) | Create and manage your account, provide the Service, authenticate you | Contract performance |
| Booking data | Invitee name, email, chosen event and time, form answers, meeting notes | Schedule the meeting, send confirmations and reminders, populate the host's calendar | Contract performance; legitimate interests (running the booking service on the host's behalf) |
| Integration data | OAuth tokens and event metadata from Google, Microsoft, Zoom, Stripe when you connect them | Two-way sync, video link creation, payment collection where enabled | Contract performance; consent (when you initiate the connection) |
| Support data | Messages you send us, attachments | Respond to and resolve support requests | Legitimate interests |
| Usage and device data | IP address, browser and device identifiers, log data, feature usage | Security, fraud and abuse prevention, product analytics and improvement | Legitimate interests; legal obligation (security) |
| Marketing data | Email address and preferences where you opt in | Product news and updates | Consent |
Payment card data is collected by our Merchant of Record, Paddle, and is not stored by us — we only receive limited information (last four digits, country, subscription status).
4. Cookies
We use a small number of essential cookies to keep you signed in and to protect the Service. Where we use analytics cookies to understand usage in aggregate, or marketing cookies where enabled, we ask for your consent first and you can change your preferences at any time from within the app or your browser settings.
5. How we share data
- Service providers / subprocessors we use to run IntoCal: cloud hosting and database provider, transactional and marketing email provider, error monitoring and analytics providers, and customer-support tooling.
- Paddle — our Merchant of Record, which processes payments, manages subscriptions, handles tax compliance, invoicing, and refunds. See Paddle's privacy policy.
- Third-party integrations you connect (Google, Microsoft, Zoom, Stripe, AI assistants via MCP). Data flows to these providers only under your instruction and their own terms/privacy apply.
- Professional advisers such as our legal and accounting advisers, under confidentiality.
- Authorities where we are required to do so by law or to protect our rights.
- A successor entity in the event of a merger, acquisition or sale of assets.
We do not sell personal data.
6. Google user data
When you connect a Google account, IntoCal requests the following permissions:
- See and edit events on your calendars (
calendar.events) — to read your existing events so that we only offer times when you are genuinely free, and to create, update and cancel the meetings booked through IntoCal, including generating Google Meet links where you enable them. - See the calendars and events you have access to (
calendar.readonly) — so you can choose which calendars we check for conflicts and which calendar bookings are written to, and so that busy times from those calendars are taken into account. - Your basic profile and email address (
openid,email,profile) — to identify the connected account and display it in your integration settings.
We use this access only to operate the scheduling features you have turned on. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI or machine-learning models, and we do not allow humans to read it, except with your explicit permission, to resolve a support issue you have raised with us, for security investigations, or where we are required to do so by law.
We store your OAuth tokens, the identifiers of the calendars you select, and the identifiers of the events we create on your behalf, so that we can keep bookings and your calendar in sync.
To calculate your availability quickly we also keep a synchronised copy of the busy periods from the calendars you select — the start and end time of each event, its Google event identifier, and its title. We do not copy event descriptions, attendees, attachments, locations or other event content. This synchronised copy is updated as your calendar changes and is deleted when you disconnect Google.
Limited Use. IntoCal's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting and deleting. You can disconnect Google at any time from Dashboard → Integrations, or revoke IntoCal's access directly at myaccount.google.com/permissions. When you disconnect, we delete the stored OAuth tokens and the synchronised busy-time copy, and all synchronisation stops. Deleting your IntoCal account deletes them as well. Meetings already written to your calendar stay on your calendar and remain yours to keep or remove.
7. International transfers
Some of our providers process data outside the UK/EEA (for example in the United States). Where that happens we rely on adequacy decisions where available, and otherwise on Standard Contractual Clauses together with supplementary safeguards.
8. Data retention
We keep account and booking data for as long as your account is active. When your account is closed we delete or anonymise personal data within a reasonable period, except where we need to keep certain records (for example invoices) to comply with legal or accounting obligations. Support tickets and security logs are retained for a limited period appropriate to their purpose.
9. Your rights
Depending on where you live you have the following rights over your personal data:
- access a copy of your data;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict or object to certain processing;
- data portability;
- withdraw consent at any time where processing is based on consent;
- complain to your local data protection authority (in the EU, the Estonian Data Protection Inspectorate is our lead supervisory authority).
To exercise any of these rights, email privacy@intocal.com. We respond within one month.
10. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, encrypted storage, role-based access controls, row-level security in our database, and regular review of our access and integration permissions. No system is perfectly secure, and we cannot guarantee absolute security.
11. Children
IntoCal is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Hosts as controllers of their invitees' data
When you use IntoCal as a host, you decide what data you request from your invitees and how you use it after the booking. In relation to that data you are a data controller and IntoCal acts as a processor on your behalf. You are responsible for having your own privacy notice covering your guests where required.
13. Changes to this Notice
We may update this Notice from time to time. When we make material changes we will notify you via the Service or by email.
14. Contact
Digiproduct OÜ — privacy@intocal.com.