Calemander

Security and data handling

Last reviewed 9 September 2026.

The short version: we never see a card number, each workspace's data sits in its own database rather than a shared table, and you can take your bookings and contacts out on any plan. What follows is the longer version, including what we do not claim.

We never store card numbers

Payments run through Stripe's and Square's own hosted pages. Card numbers are entered there and never reach Calemander; we store the payment status and the provider's reference identifiers. That is true of a card held on file too — what is saved is a token at the provider, not a number here.

Money your clients pay you goes to your own Stripe or Square account. We do not hold it.

Each workspace has its own database

A workspace's scheduling data — event types, availability, bookings, contacts, the answers your clients give — lives in a per-workspace database, not in shared tables separated by a customer column. One tenant's queries cannot reach another's rows, because they are not in the same place.

Everything runs on Cloudflare infrastructure and is encrypted at rest by the platform, with TLS in transit. Selected third-party credentials — CalDAV passwords among them — get a second layer of application-level encryption with a key held only as a worker secret, so they are not readable from a database dump alone.

What is stored

• Account data — your name, email, workspace name and the settings you configure.
• Scheduling data — event types, availability rules, bookings, and each invitee's name, email, optional phone number and answers to your booking questions.
• Calendar data — busy times and events for calendars you connect, used to avoid double-booking. We do not read or analyse the contents of your other events beyond their busy ranges, and never use calendar data for advertising.
• Integration credentials — OAuth tokens for Google, Microsoft, Zoom and Calendly, and conferencing account identifiers.
• Billing data — subscription status, seat count, Stripe identifiers.
• Operational data — email delivery events, the webhook ledger, error logs.

Calemander does not store card numbers, meeting recordings, meeting content, participant lists, or chat and contacts from a conferencing provider.

Who is responsible for what

For data about you, the host, Calemander is the controller. For data about the people who book you, your workspace is the controller and Calemander is the processor acting on your instructions. That matters in practice: if one of your clients asks us to delete their details, we route the request to you.

Subprocessors

Calendar and conferencing providers — Google, Microsoft, Zoom, Apple and Fastmail over CalDAV, Calendly — are connected by your own authorization and act on your behalf rather than as our subprocessors.

Retention, export and deletion

• Export is on every plan. Bookings and contacts export to CSV from the dashboard, Free included. Nothing about leaving is behind a paywall.
• Bookings and scheduling data are kept for the life of the workspace, because hosts rely on their booking history.
• Integration credentials are deleted the moment you disconnect the integration, revoke access at the provider, or delete the account. Removing our app from a provider's marketplace triggers that provider's deauthorization notice and we delete the stored credentials automatically.
• Email delivery events and the webhook ledger are kept for a rolling operational window.
• Billing records are kept as long as tax and accounting require. Account data is deleted on account deletion.
• Requests for access, correction, export or deletion go to support@calemander.com and are actioned within 30 days.

Access and incidents

Access to production data is limited to the operator of the service, through credentialed tooling, and is used only for support and incident response. Production secrets are not readable from the codebase or from a development machine's source tree, and the automated tooling used in development is explicitly prohibited from reading credential files.

A suspected incident is triaged immediately: scope established, affected credentials rotated, the vulnerability fixed and deployed, and affected customers notified where their data may have been exposed. Report anything to support@calemander.com.

What we do not claim

Plenty of pages like this one imply more than the company has done, so here is the rest of it plainly. Calemander does not hold a SOC 2 report and has not been through a compliance audit. We do not claim GDPR compliance. We do not offer a Data Processing Agreement or a published subprocessor change-notification process yet — both are in preparation, and will be published before general availability. We do not offer a choice of data residency; the service runs on Cloudflare's network.

If any of those is a requirement for you, say so at support@calemander.com and we will tell you honestly where it stands rather than where we would like it to be.

See also the privacy policy.