Calendox

Privacy Policy for Calendox

Privacy Policy

Last updated: October 1, 2026
This Privacy Policy explains what personal data Calendox collects when You use the Service, why We collect it, who We share it with, how long We keep it, and the rights You have over it.
Calendox is designed to know as little about You as possible. In particular, We never store the content of Your calendar events — only the minimum metadata needed to keep Your calendars in sync. See “Calendar Data” below.
Please read this Privacy Policy together with our Data Security policy (how We protect data) and our Cookie Policy (cookies and browser storage).

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

  • Account means a unique account created for You to access our Service or parts of our Service. Accounts are Personal, Business, or Enterprise accounts.
  • Account Holder means the person or organization that owns an Account, including the administrators of a Business or Enterprise Account.
  • Booker means a person who books time with an Account Holder through a public booking page.
  • Company (referred to as either “the Company”, “We”, “Us” or “Our” in this Agreement) refers to Danilix, the publisher of Calendox, established in Ajman, United Arab Emirates.
  • Country refers to: United Arab Emirates
  • Personal Data is any information that relates to an identified or identifiable individual.
  • Provider means a third-party calendar or meeting service You connect to the Service: Google, Microsoft, or Zoom.
  • Service refers to Calendox, the calendar synchronization platform that keeps Your connected calendars up to date and helps You manage Your schedule in one place, including its website, dashboard, and public booking pages.
  • Sub-processor means a third-party company that processes Personal Data on Our behalf to help Us run the Service.
  • Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the pages You request and when).
  • You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Who Is Responsible for Your Data

Danilix, established in Ajman, United Arab Emirates, is the controller of the Personal Data of Account Holders and visitors to our website — the data described in this Privacy Policy that We collect to provide and run the Service. You can reach Us at support@calendox.com.

In some situations We process Personal Data on behalf of an Account Holder, who is then the controller and decides why and how that data is used:

  • Booking pages: the Account Holder who publishes a booking page is responsible for the Personal Data Bookers submit through it, including any custom questions they choose to ask.
  • Business teams: the organization that owns a Business Account is responsible for the member data it administers (invitations, roles, and licence assignments).
  • Enterprise tenants: the organization that owns an Enterprise Account decides which calendars are mapped and synced, and is responsible for the directory and calendar data We process for those syncs, including the data of users in every tenant it connects. Each organization whose Microsoft 365 administrator grants tenant-wide consent allows Us to access its directory and calendar data for those syncs.
If You are a Booker, please direct privacy requests to the Account Holder whose booking page You used; if You are a member of a Business Account, direct requests about Your invitation, role or licence to the organization that owns that Business Account; if Your calendar is synced through an Enterprise Account, direct them to the organization that owns that Enterprise Account. We will assist them in responding. You can also contact Us directly at any time.

Personal Data We Collect

Data You provide to Us

  • Account and profile data: Your email address and name, a profile picture if You sign in with Google or Microsoft, and optional profile details such as company name, job title, industry, timezone, and phone number. If You choose to answer during setup, We also keep how You heard about Calendox.
  • Billing details: a billing address (country, region, city, postal code, and street) before You start a card subscription. Payment card details are entered on our payment processor’s hosted checkout page and are never received or stored by Calendox.
  • Team information (Business Accounts): the email addresses of people You invite, their roles, and their licence assignments.
  • Communications: messages You send Us through the contact form, support email, or the in-app feedback option.

Data from the Providers You connect

When You authorize Calendox to access a Google, Microsoft, or Zoom account, We receive only what the permissions You grant allow. The complete list of permissions, and why each one is needed, is published in our documentation under OAuth Permissions.

  • Provider account identity: the email address and display name of the connected account.
  • Calendar list: the identifiers and names of the calendars in the connected account, and which of them You choose to import.
  • Event metadata: for events in the calendars You sync, the event identifier, start and end times, recurrence rule, status, a link to any meeting created through Calendox, and a one-way content fingerprint used only to detect changes. We do not store event titles, descriptions, locations, attendees, or meeting passwords — these are read live from Your Provider and shown in Your browser.
  • Access tokens: the OAuth tokens issued by the Provider, stored server-side in encrypted form and used only to perform the operations You authorized.

Enterprise tenant data

Once a Microsoft 365 administrator has granted tenant-wide consent for an Enterprise Account, We read the organization’s display name and verified domains and, from its directory, the display name, email addresses and user principal name of its users, keeping only users with a mailbox, together with the names of those users’ calendars, so that the Account’s administrators can choose which calendars to map. We store these details only for the calendars the administrators add to the Enterprise Account, together with any department, job title or manager an administrator enters for them. No Calendox login is created for these users; their data exists only to operate the syncs configured in the Enterprise Account.

Booking data

When someone books time through a public booking page, We store what they submit and what is needed to manage the booking: name, email address, timezone, the topic of the meeting, any additional guest email addresses, answers to the questions the Account Holder configured, the time at which consent to the page’s terms was given, the meeting time and meeting link, and the booking’s status and reschedule or cancellation history. Bookers only ever see computed free/busy availability — never the contents of the Account Holder’s calendars.

Usage Data and technical data

  • Request and session data: Your IP address, browser type and version, operating system, the pages You request, and timestamps, recorded in server logs and in Your sign-in session.
  • Sign-in device records: a fingerprint of the browser and device You sign in from, with IP address and last seen time, so We can alert You by email when Your Account is used from a new device.
  • Error and diagnostic reports: when something goes wrong, our error-monitoring service receives a report describing the error and the request, linked to Your Account identifier and email address so We can follow up. For a small sample of sessions, and when an error occurs, it may also record a masked replay of how the interface was used — page structure and interactions, with all on-screen text hidden and media blocked — so We can reproduce the problem.
  • In-app notifications: the notifications shown in Your dashboard (for example sync alerts and billing notices).
  • Website analytics: on our public website pages (not the dashboard or public booking pages) We use Microsoft Clarity to see which pages are viewed and how visitors scroll, click, and move through them, including masked recordings of page use. Clarity receives the page address, Your browser and device type, Your IP address (from which Microsoft derives an approximate location), and Your interactions on the page. Anything typed into a form field is masked in Your browser before it is sent. We run Clarity without cookies, so it cannot recognise You between visits or link one page view to the next.
We do not run advertising trackers or cross-site tracking on the Service.

Calendar Data

Calendar data is the most sensitive information You entrust to Us, so We limit how We use it:

  • We read from and write to Your connected calendars only to perform the syncs You configure, to display Your events in the Unified Calendar, to create the meeting links You request, and to compute free/busy availability for Your booking pages.
  • We do not store the content of Your events, and We do not analyze, mine, profile, or derive insights from it.
  • We do not use calendar data for advertising, do not sell it, and do not use it to train machine-learning or artificial-intelligence models.
  • No person at Calendox looks at Your calendar data except with Your consent to resolve a support request, where necessary for security or abuse investigation, or where required by law.

Google API Services

Calendox’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft and Zoom

Access to Microsoft 365 calendars and directory data is granted through Microsoft Entra — per user, or tenant-wide by an administrator for Enterprise Accounts — and access to Zoom is granted through Zoom’s OAuth consent. In each case We use only the permissions listed in our OAuth Permissions documentation and You can revoke them from Your Provider account at any time.

How We Use Personal Data and Why We May

We use Personal Data for the following purposes, each resting on a legal basis under the General Data Protection Regulation (GDPR):

  • To provide the Service — creating and authenticating Your Account, running Your syncs, displaying Your calendars, operating Your booking pages, and creating meeting links. Basis: performance of our contract with You.
  • To manage subscriptions and billing — processing payments through our payment processor or the Microsoft commercial marketplace, applying plan limits and licences, and sending subscription notices. Basis: performance of our contract; legal obligations to keep accounting records.
  • To send transactional messages — sign-in links, new-device alerts, sync failure alerts, booking confirmations and reminders, team and licence changes, and Account deletion confirmations. Basis: performance of our contract and our legitimate interest in keeping Your Account secure.
  • To send product news — only if You opted in. You can opt out at any time in Settings or through the unsubscribe link in every such email. Basis: Your consent.
  • To keep the Service secure and prevent abuse — verifying every request, alerting You to new sign-ins, limiting automated traffic, protecting public forms against bots, preventing re-use of the free trial, and investigating fraud or chargebacks. Basis: our legitimate interest in protecting the Service and its users.
  • To diagnose problems and improve reliability — server logs, error reports, and sampled masked session replays. Basis: our legitimate interest in running a reliable Service. This analysis is based on technical data and Account activity, never on the content of Your calendar events.
  • To understand how our public website is used — page statistics, click and scroll heatmaps, and masked recordings of page use on our public website pages, collected without cookies. Basis: our legitimate interest in improving the website. This never involves Your calendar data or Your dashboard.
  • To understand how people find Calendox — Your optional answer to “How did you hear about Calendox?” during setup, counted per channel so We know where to tell people about the Service. Basis: our legitimate interest in understanding how people find the Service.
  • To respond to You — handling support, privacy, and security requests. Basis: performance of our contract and our legitimate interest in providing support.
  • To comply with the law — responding to lawful requests and protecting Our rights. Basis: legal obligation and legitimate interest.
  • For business transfers — evaluating or carrying out a merger, acquisition, or sale of assets in which Personal Data is among the assets transferred. Basis: legitimate interest.

Who We Share Personal Data With

We do not sell Personal Data and do not share it with advertising networks or data brokers. We share it only as described here.

  • Your Providers. When You connect Google, Microsoft, or Zoom, We send data to and receive data from those services on Your instructions — for example writing an event to a calendar You chose as a sync target, or creating a meeting You requested. Their own privacy policies apply to the data they hold.
  • Sub-processors. We rely on a small number of service providers, bound by data-processing terms, to run the Service: cloud hosting on Microsoft Azure; a payment processor for card subscriptions (which receives Your email address, billing address, and subscription details, and handles Your card details itself); the Microsoft commercial marketplace for subscriptions purchased there (where Microsoft is the seller and shares purchase and tenant details with Us); transactional email delivery; background job processing; error monitoring and diagnostics; cookieless website analytics on our public pages (Microsoft Clarity); and bot protection (Cloudflare Turnstile) on our public forms. A current list of Sub-processors is available on request.
  • Within Your team or organization. If You are a member of a Business Account, its administrators can see Your name, email address, role, and licence, but not Your calendars, events, or syncs. If Your calendar is synced through an Enterprise Account, that Account’s administrators can see the directory information about You described under “Enterprise tenant data” and the sync status of Your calendar.
  • Between Account Holders and Bookers. Details a Booker submits are shared with the Account Holder whose page they used (and with any additional invitees that Account Holder configured); the Account Holder’s name and the meeting details are shared with the Booker.
  • Legal and safety. We may disclose Personal Data where required by law or a valid request from a public authority, or where reasonably necessary to protect the rights, property, or safety of Calendox, our users, or the public.
  • Business transfers. If Calendox is involved in a merger, acquisition, or asset sale, Personal Data may be transferred. We will provide notice before Your Personal Data becomes subject to a different privacy policy.

International Transfers

The Service is operated from the United Arab Emirates and hosted on Microsoft Azure. Your Personal Data may be stored and processed in countries other than Your own, including outside the European Economic Area, where data protection laws may differ from those in Your jurisdiction.
Where Personal Data is transferred outside the European Economic Area, We rely on safeguards recognised under the GDPR — such as the European Commission’s Standard Contractual Clauses included in our Sub-processors’ data-processing terms, or an adequacy decision where the recipient is covered by one — and We require that Your data continues to be protected as described in this Privacy Policy.

How Long We Keep Personal Data

We keep Personal Data only for as long as needed for the purposes described above:

  • Account, profile, calendar, and sync data: for as long as Your Account exists. It is deleted when You delete Your Account.
  • Provider access tokens: deleted immediately when You disconnect a Provider or delete Your Account. For Google and Zoom We also ask the Provider to revoke the authorization itself; Microsoft offers no equivalent, so You end that access from Your own Microsoft account. You can revoke access from any Provider at any time — see our OAuth Permissions documentation.
  • Event metadata and synced copies: deleted when You remove the sync or disconnect the calendar they belong to.
  • Booking records: kept for as long as the booking page they belong to exists, so the Account Holder can see their booking history. The Account Holder can delete individual bookings at any time; deleting a booking page or the Account deletes its bookings.
  • In-app notifications: removed 30 days after You have read them.
  • Sign-in sessions and team invitations: removed 30 days after they expire.
  • Sign-in device records: removed after 180 days without a sign-in from that device.
  • Free-trial record: after Account deletion We keep a minimal record of the email address (and the Provider accounts You connected) linked to free-trial usage, for up to 5 years, so the free trial cannot be re-used by deleting and re-creating an Account.
  • Account deletion record: the email address and date of an Account deletion, for up to 5 years, so We can demonstrate that a deletion request was honoured.
  • Billing records: subscription and payment records are kept for as long as tax and accounting law requires.
  • Server logs and error reports: kept for a limited period needed for security and troubleshooting, then deleted or anonymised.
We may retain specific data for longer where We have a legal obligation to do so, or where it is needed to resolve a dispute or enforce our agreements.

Deleting Your Account

You can delete Your Account yourself from Settings in the dashboard. For Your protection We first send a confirmation link to Your email address. Deletion is immediate and permanent: Your connected calendars are disconnected and the events Calendox created in Your Provider calendars are removed, Your booking pages and their bookings are deleted, and Your Account record is deleted — including, for Business and Enterprise Accounts, the team or tenant data that belongs to the Account when the team itself is deleted. Deleting a Personal or Enterprise Account also sets any active subscription on it to end. Deletion cannot be undone.
A Business Account belongs to its team and is never converted into a Personal Account. When a member leaves the team, or is removed from it by a team administrator, their Account is deleted as described above: the calendars and syncs they connected are disconnected, the events Calendox created in their Provider calendars are removed, and their Account record is deleted; the team’s subscriptions are not affected, and the member’s seat stays with the team. All team administrators have the same rights: any administrator may invite, remove or change the role of any other member, manage the team’s subscriptions and delete the team. A team must always keep at least one administrator, so the last administrator cannot leave, be removed or delete their own Account; they appoint another administrator first, or delete the team. Deleting the team ends the team’s subscriptions and deletes the team’s data together with the Account of the administrator who deletes it. Personal and Enterprise Accounts can be deleted by the Account Holder directly.
The only data that survives deletion is described under “How Long We Keep Personal Data”: the free-trial record, the deletion record, and billing records We are legally required to keep.

Your Rights

Under the GDPR and, depending on where You live, other applicable laws, You have the right to:

  • Access the Personal Data We hold about You.
  • Rectify inaccurate or incomplete data — most profile data can be edited directly in Settings.
  • Erase Your data — most easily by deleting Your Account, as described above.
  • Restrict or object to processing that rests on our legitimate interests.
  • Receive a copy of the data You provided in a structured, machine-readable format (data portability).
  • Withdraw consent at any time where processing rests on consent (for example product news), without affecting the lawfulness of processing before withdrawal.
  • Complain to a supervisory authority. If You live or work in the European Economic Area, You may complain to the data protection authority of that country; elsewhere, to the authority competent where You live.
To exercise any of these rights, email support@calendox.com from the email address associated with Your Account. We will respond within one month; where a request is complex We may extend this by a further two months and will tell You if so. We may ask You to verify Your identity before acting on a request.
If You are a Booker, the Account Holder whose booking page You used is the controller of that data; if You are a member of a Business Account, the organization that owns it is the controller of Your invitation, role and licence data; if Your calendar is synced through an Enterprise Account, the organization that owns that Enterprise Account is. Contact them first, and We will assist them in responding to You.

Security of Your Personal Data

We protect Personal Data with technical and organizational measures described in our Data Security policy, including encryption in transit and at rest, encrypted storage of Provider access tokens, per-account isolation enforced at the database layer, and passwordless sign-in. No method of transmission over the Internet or of electronic storage is completely secure, so while We work to protect Your Personal Data using commercially accepted standards, We cannot guarantee its absolute security.

Cookies

The Service uses only strictly necessary and preference cookies, and no advertising or analytics cookies. Our Cookie Policy lists every cookie and item of browser storage the Service uses and how long each lasts.

Children's Privacy

Our Service is not directed to anyone under the age of 16, and We do not knowingly collect Personal Data from anyone under 16. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data, please contact Us. If We become aware that We have collected Personal Data from a child under 16 without verified parental consent, We will delete it.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us, including the consent and account pages of Your Providers and the Microsoft commercial marketplace. If You click on a third-party link, You will be directed to that third party’s site, and its privacy policy applies. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when the Service or the Sub-processors We use change. We will post the updated policy on this page and update the “Last updated” date at the top.
If a change materially affects how We use Your Personal Data, We will notify You by email or through a prominent notice in the Service before the change takes effect. We encourage You to review this Privacy Policy periodically.

Contact Us

If You have any questions about this Privacy Policy or want to exercise Your rights, You can contact Us: