Privacy Policy

CalMov ("CalMov", "we", "us" or "our") provides scheduling, booking, payment and travel-aware availability tools for mobile service businesses. This policy explains how we process personal data when someone visits our website, creates or uses a CalMov workspace, makes or manages a booking, or connects a third-party service.

CalMov is responsible for personal data used to operate accounts, our website and the CalMov service. A business using CalMov is normally responsible for the customer data it collects through its booking page, while CalMov processes that data to provide the service on the business's behalf.

Depending on how CalMov is used, we may process:

• account and workspace details, such as names, email addresses and business settings;
• trial eligibility records, including a hash of the account email address, account and workspace identifiers, and trial dates. We retain these limited records after account deletion to prevent repeated free trial claims;
• booking details, such as customer contact information, service, date, time, address and notes;
• payment references and payment status supplied by our payment provider; CalMov does not store complete payment-card numbers;
• Google account and Calendar information described in the section below;
• text-message records, where a business sends texts: the customer's mobile number, each message sent and when, whether it was delivered, any reply to CalMov's number, and whether the number has asked not to be texted;
• technical and security information, such as IP address, browser or device information, timestamps, request logs and audit records; and
• communications sent to support and choices made about cookies or connected services.

We use personal data to create and secure accounts, operate booking pages, calculate and validate appointment availability, process payments, send service communications, prevent conflicting bookings, provide support, investigate misuse, maintain audit and reliability records, and comply with legal obligations.

Where applicable, we rely on performance of a contract, legitimate interests in operating and protecting the service, consent for optional analytics or connected services, and compliance with legal obligations. A CalMov business is responsible for establishing an appropriate basis for the customer data it asks CalMov to process.

Google sign-in may provide basic account information, including a Google account identifier, name, profile information and email address, so that we can authenticate the user and associate the sign-in with a CalMov account.

Sign in with Apple and Sign in with Microsoft work the same way. CalMov receives an account identifier from Apple or Microsoft and your email address, plus your name if you choose to share it (Apple shares it only the first time you sign in). Apple lets you hide your email address: we then receive a private relay address ending in @privaterelay.appleid.com, and Apple forwards our emails to you. Microsoft may also send basic account details, such as your username and whether your organisation has verified your email address. We use this information only to sign you in and connect the sign-in to your CalMov account. We never receive your Apple or Microsoft password.

Google Calendar connection is optional. When a workspace owner connects it, CalMov asks Google only for permission to view and edit events on calendars they own, and uses it only on their primary Google calendar. CalMov receives the connected Google account email address, the selected calendar identifier, OAuth access and refresh tokens, and the times and locations of existing events. For existing Google Calendar commitments, CalMov asks Google only for each event's start and end time, busy status, location and identifiers, and stores the busy start and end times and, where the event has one, its location (with the postcode or map position CalMov works out from it) so unavailable periods are not offered to customers and travel time to and from them is kept. CalMov does not import the titles, descriptions, attendees or other contents of those existing events through this process.

When CalMov creates a booking event, it sends the appointment time and relevant booking information—such as the service, customer name, contact details, service address, notes and CalMov booking identifier—to the connected business's Google Calendar. CalMov stores the Google event identifier and sync status so it can update the event when a booking is rescheduled and remove it when a booking is cancelled.

Outlook and iCloud Calendar connections are optional, and a business connects one calendar at a time. For Outlook (Microsoft 365 or Outlook.com), CalMov receives the connected Microsoft account email address, the selected calendar identifier and name, and OAuth access and refresh tokens. To find busy times, CalMov asks Microsoft only for each event's start and end time, busy status, location and identifiers, not titles, descriptions or attendees.

For iCloud Calendar, the business owner gives CalMov their Apple ID email address and an app-specific password created in their Apple Account. CalMov never asks for or receives their Apple ID password. Apple's calendar service returns whole events from the selected calendar; CalMov reads them only to work out busy start and end times and their locations, and does not store their titles, descriptions, attendees or other contents.

Calendar tokens and app-specific passwords are stored encrypted. As with Google Calendar, CalMov stores busy start and end times, and the location of a busy event where it has one, so unavailable periods are not offered to customers and travel time to and from them is kept, sends the appointment time and relevant booking information to the connected calendar, and stores the event identifier and sync status so it can update or remove the event later.

CalMov's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide or improve the visible sign-in, availability and Calendar-sync features requested by the user.

We do not sell Google user data. We do not use it for advertising, retargeting, creating advertising profiles, credit or lending decisions, data brokerage, or developing, improving or training artificial-intelligence or machine-learning models. Google user data is never sent to CalMov's assistant or to any other artificial-intelligence service. We do not allow people to read Google user data except where the user has authorised support for specific data, where access is necessary to investigate security or abuse, where required by law, or where data has been aggregated and anonymised for permitted internal operations.

Google user data is shared only with these types of parties, and only to provide the features described above:

• the infrastructure providers that run CalMov (Vercel for hosting, Supabase for the database and sign-in, and Resend for the account's own service emails), which store and process it on our behalf;
• our mapping providers (Google Maps Platform and Mapbox), which receive the location written on a busy calendar event, never its title or other details, so CalMov can place it and work out driving times to and from it; and
• the connected Google Calendar itself, where CalMov writes booking events as described above.

We otherwise disclose Google user data only where the user directs or consents to the disclosure, for security purposes, or where required by law. Providers may process data only for the services they supply to CalMov and must protect it appropriately.

We use providers for functions such as hosting and databases, authentication, payments, mapping and routing, email and text-message delivery, abuse prevention, analytics, Calendar integration and an optional in-app assistant. Depending on configuration, these include Supabase, Stripe, Google, Mapbox, Cloudflare, Vercel, Resend, Twilio and OpenAI. They receive only the data reasonably required to perform their function and process it under their own security and privacy obligations.

When a business chooses to send its customers text messages, such as appointment reminders, the customer's mobile number and the message are sent to Twilio, which delivers it and tells us whether it arrived. Texts go only to UK mobile numbers. Replies to CalMov's number are received by Twilio and passed to CalMov, which records them for the business and emails them to its owner. A customer can stop texts from a business with the link in a text or on their booking's page, or stop texts from every business using CalMov by replying STOP to CalMov's number; messages about their bookings then come by email.

A business may also choose to send customers who have booked with it before an occasional message asking them to book again. Each one says how to stop them (Stop these messages in an email, or replying STOP to a text), and once a customer has stopped them that business sends no more.

When a business uses the optional assistant, the messages typed to it and the business information it needs to answer, such as services, opening hours and totals from the business's reports, are sent to OpenAI to write the reply. Customer names and contact details from those reports are shown only on the owner's screen, and Google user data is never sent.

Some providers may process data outside the United Kingdom. Where required, we rely on recognised safeguards for international transfers, such as adequacy regulations or approved contractual protections.

CalMov is based in the United Kingdom and supports customers in the United Kingdom and United States. The privacy rules and individual rights that apply can depend on where an individual lives and how the service is used.

With permission, Google Analytics uses first-party cookies on CalMov's marketing, account-setup and CalMov demo pages to help us understand visits, traffic sources and whether people complete key setup steps. Analytics is not loaded until it is accepted. We may retain a limited campaign source, landing-page path and Analytics client identifier to connect a consented visit with privacy-safe milestones such as workspace creation, publishing a booking page, receiving a first booking and starting or completing a CalMov subscription.

Consent can be withdrawn at any time using Cookie settings in the website footer. Google Analytics is excluded from dashboards, other businesses' booking pages, customer-management links, payment callbacks and password-reset pages. Customer names, contact details, addresses, booking notes, profile answers and Google Calendar data are not sent to Google Analytics.

For free planning calculators, analytics may record the calculator name, its broad category, whether it was started or completed, and whether a related CalMov page or signup link was selected. Calculator inputs—including prices, costs, income targets, addresses and postal codes—are not sent to Google Analytics.

We keep account, booking, support, security and transaction records only for as long as reasonably needed to provide the service, meet the business's instructions, resolve disputes, prevent abuse and satisfy legal, tax or accounting obligations. Retention can therefore vary by record type and applicable requirement. Data is deleted or anonymised when it is no longer required, unless the law permits or requires longer retention.

Records of the messages sent to a business's customers, and their replies, are kept while the business uses CalMov so it can see what each customer has been sent, and are deleted with that customer's record. A request not to be texted is kept so that it continues to be respected.

Calendar tokens, app-specific passwords, locally synchronised busy periods and event mappings are kept while a calendar is connected. Choosing Disconnect in CalMov stops future access and removes those stored connection and synchronisation records. Events already created in the connected calendar may remain there and can be managed by the user. Users can separately revoke CalMov's access from their Google Account's third-party connections page, their Microsoft account's app permissions page, or by deleting the app-specific password in their Apple Account.

To request deletion of a CalMov account or other personal data, email support@calmov.com. We may need to verify identity and may retain limited records where required by law or necessary to establish, exercise or defend legal claims.

CalMov uses measures designed to protect personal and Google user data, including encrypted transport, access controls, tenant boundaries, authenticated API routes, restricted service credentials, audit logging and anti-abuse controls. OAuth tokens and app-specific passwords for connected calendars are encrypted with AES-256-GCM before they are stored. Access is limited to people and providers that need it for an authorised purpose.

No online service can guarantee absolute security. Users should protect their account credentials, use available multi-factor authentication and notify us promptly about suspected unauthorised access.

Depending on applicable law, individuals may have rights to access, correct, delete, restrict or object to processing of their personal data, receive a portable copy, and withdraw consent. Withdrawing consent does not affect processing already carried out lawfully.

Customers of a business using CalMov should normally contact that business first about booking data. We will support the business in responding where CalMov processes the data on its behalf. Individuals may also complain to the UK Information Commissioner's Office or another competent data-protection authority.

We may update this policy when our service, providers or legal obligations change. We will update the date shown on this page and provide additional notice where a change materially affects how personal data is used.

For privacy requests, questions about Google user data or security concerns, email support@calmov.com. Please include enough information for us to identify the relevant account or workspace, but do not send passwords, OAuth tokens or full payment-card information.