Privacy policy

1. Controller

The controller is Vomit Studios Michał Siwek, os. Jagiellońskie 25/54, 31-834 Kraków, Poland, NIP 6783161589, REGON 364894662. For personal data matters write to privacy@calendra.pl.

2. Who this policy covers

• Visitors to calendra.pl – we process only the technical data needed to show the site and keep it secure.
• Businesses using Calendra and their Users – account, billing and sign-in data; here we are the controller.
• People booking visits (clients, patients) – the controller of your data is the business you book with. We process it only on its behalf under a data processing agreement (Annex 1 to the terms). You exercise your rights with that business; on its instruction we help carry them out.

3. What we process and why

• Account and sign-in: name, e-mail address, phone number, one-time codes, passkeys, sign-in time and IP address – to conclude and perform the contract (Art. 6(1)(b) GDPR) and protect the account (Art. 6(1)(f)).
• Business and billing data: name, address, tax id, payment history and invoices – to perform the contract and meet tax obligations (Art. 6(1)(b) and (c) GDPR). Card data is processed by Stripe only.
• Content in the Panel: locations, services, schedules, visits, notes, End clients' data – to provide the Service; for End clients' data we act as a processor.
• E-mail and SMS messages: recipients, sending time and delivery status – to send confirmations and reminders and to account for Plan limits (Art. 6(1)(b) and (f) GDPR).
• Security: IP address, browser identifier and event logs kept for up to 30 days – to detect abuse and failures (Art. 6(1)(f) GDPR).
• Correspondence: messages you send us – to reply and document the matter (Art. 6(1)(f) GDPR).

We do no marketing without consent, no profiling and we do not sell data.

4. Who receives the data

Data is used only by suppliers who help us provide the Service and are bound by data processing agreements:

• Hetzner Online GmbH (Germany) – servers and backups;
• DigitalOcean, LLC (USA) – file storage and domains;
• Resend, Inc. (USA) – e-mail delivery;
• Twilio Ireland Ltd. (Ireland) – SMS delivery;
• Stripe Payments Europe, Ltd. (Ireland) – payments;
• Rollbar, Inc. (USA) – error monitoring;
• an accounting services provider – for invoices.

Transfers outside the European Economic Area take place only to entities covered by an adequacy decision (including the EU-U.S. Data Privacy Framework) or under standard contractual clauses.

5. How long we keep data

• account data and Panel content – for the term of the contract and 30 days after the account is deleted;
• billing data and invoices – for 5 years from the end of the tax year in which the invoice was issued;
• security logs – up to 30 days; backups – overwritten in a cycle of up to 30 days;
• End clients' data – as long as the business you booked with keeps it; it is deleted with that business's account or on its instruction.

6. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. Write to privacy@calendra.pl. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

If you book visits as a client or patient, you exercise your rights with the business that runs your visits. If you contact us, we pass the matter to that business and help carry it out.

7. Cookies

We use only cookies necessary for the Service: the sign-in session, remembering your device (if you ask for it), protection against forged requests (CSRF) and the chosen language. We use no analytics, advertising or tracking cookies and do not ask for consent, as none is required for necessary cookies.

8. Security

Transport is encrypted (TLS), keys and credentials are encrypted in the database, sign-in is passwordless (one-time code, link or passkey), each business's data is kept separate and servers are located in the European Union. Backups are made daily.

9. Minors

Calendra is a tool for businesses. Visits of minors are booked on their behalf by a guardian; the rules for working with minors are set by the business running the visits.

10. Changes to this policy

We inform businesses using Calendra about significant changes to this policy by e-mail. The current version is always available at calendra.pl/privacy.