Privacy Policy

Last updated: July 6, 2026

Introduction

Calendoula ("Calendoula," "we," "us," or "our") provides an all-in-one scheduling, point-of-sale, and business management platform for small businesses such as spas, salons, and wellness providers (our "Service"). This Privacy Policy describes how we collect, use, share, and protect personal information when you use our website, mobile applications, or otherwise interact with us.

Who this policy applies to

Calendoula has two kinds of users:

• Business Users — owners, managers, and staff of businesses that subscribe to Calendoula to run their operations.
• Clients — end customers of those businesses whose information is entered into the Service (e.g., to book an appointment or receive a reminder).

For Clients, the Business User is the "controller" of their data and Calendoula acts as a "processor" on the Business User's behalf. If you are a Client and want to exercise rights over your data, please contact the business that serves you first; we will support their response.

Information we collect

Information you provide

• Account & business info: name, email address, phone number, business name, address, tax information, and login credentials.
• Billing info: payment card details (processed and stored by our payment processors — we do not store full card numbers on our servers).
• Client records entered by Business Users: client names, contact details, appointment history, notes, intake-form responses, and uploaded documents or photos.
• Messages: SMS and email content sent or received through the Service, support chat, and team chat.

Information collected automatically

• Device & usage data: IP address, browser type, operating system, device identifiers, pages viewed, actions taken, and timestamps.
• Cookies and similar technologies used for authentication, session management, and basic analytics.

Information from mobile app permissions

The Calendoula mobile app may request the following permissions. Each is used only for the purposes described and only when you actively use the related feature:

• Camera: to take photos of client intake documents, treatment results, or profile pictures when you tap a camera button inside the app. Photos are uploaded to your business's account and are not used for any other purpose.
• Photos / Storage: to let you choose existing images from your device to attach to the same features above.
• Notifications: to deliver booking alerts, team messages, and operational notifications you have opted into.
• Internet: to communicate with our servers.

You can revoke any of these permissions at any time in your device settings; some features will stop working if you do.

How we use information

• Provide, maintain, and improve the Service.
• Process bookings, payments, and other transactions.
• Send operational messages such as appointment confirmations, receipts, and service updates.
• Respond to support requests.
• Detect, investigate, and prevent fraud or abuse.
• Comply with legal obligations.
• With your permission, send marketing communications — you can opt out at any time.

How we share information

We do not sell personal information. We share it only as follows:

• With the Business User whose account contains the Client's record (Clients' information is visible to that business's authorized staff).
• With service providers that help us run the Service, bound by confidentiality and data-processing agreements. These include:
  • Payment processing: Stripe, Square.
  • SMS delivery: Twilio, Plivo, Telnyx.
  • Email delivery: Resend.
  • Cloud hosting and storage: Amazon Web Services.
  • Error monitoring and analytics providers.
• For legal reasons — to comply with a subpoena, court order, or applicable law, or to protect rights, safety, or property.
• In a business transfer — e.g., a merger, acquisition, or sale of assets; we will notify you before your information becomes subject to a different privacy policy.

SMS / text messaging

If you opt in to receive text messages from Calendoula or from a business that uses Calendoula (for example, appointment reminders, booking confirmations, or login verification codes), we use your mobile number solely to deliver the messages you have requested. Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP, or reply HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with SMS delivery providers acting on our behalf solely to deliver the messages you requested.

Data retention

We retain Business User and Client information for as long as the Business User's account is active, and for a reasonable period afterward to meet legal, tax, and operational requirements. Business Users may request deletion of their data at any time by contacting us; Clients should contact the business that serves them.

Security

We use industry-standard safeguards — encryption in transit, role-based access controls, and monitored infrastructure — to protect personal information. No system is perfectly secure, so we cannot guarantee absolute security.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal information, and to object to certain processing. To exercise these rights, Business Users can contact us at the address below. Clients should contact the business that serves them first.

California residents: You have specific rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and to request deletion. We do not sell personal information.

EU/UK residents: Where we process your information, our legal bases are contract performance, legitimate interests, legal obligation, or consent, depending on the processing.

Children's privacy

The Service is not directed to children under 13 (or the equivalent age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with information, please contact us and we will delete it.

International transfers

Calendoula is operated in the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. We rely on appropriate safeguards where required by law.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above, and, for material changes, we will provide additional notice (such as an in-app banner or email).

Contact

Questions or requests? Email us at privacy@getcalendoula.com.