Privacy Policy

CalMov ("CalMov", "we", "us" or "our") provides scheduling, booking, payment and travel-aware availability tools for mobile service businesses. This policy explains how we process personal data when someone visits our website, creates or uses a CalMov workspace, makes or manages a booking, or connects a third-party service.

CalMov is responsible for personal data used to operate accounts, our website and the CalMov service. A business using CalMov is normally responsible for the customer data it collects through its booking page, while CalMov processes that data to provide the service on the business's behalf.

Depending on how CalMov is used, we may process:

• account and workspace details, such as names, email addresses and business settings;
• booking details, such as customer contact information, service, date, time, address and notes;
• payment references and payment status supplied by our payment provider; CalMov does not store complete payment-card numbers;
• Google account and Calendar information described in the section below;
• technical and security information, such as IP address, browser or device information, timestamps, request logs and audit records; and
• communications sent to support and choices made about cookies or connected services.

We use personal data to create and secure accounts, operate booking pages, calculate and validate appointment availability, process payments, send service communications, prevent conflicting bookings, provide support, investigate misuse, maintain audit and reliability records, and comply with legal obligations.

Where applicable, we rely on performance of a contract, legitimate interests in operating and protecting the service, consent for optional analytics or connected services, and compliance with legal obligations. A CalMov business is responsible for establishing an appropriate basis for the customer data it asks CalMov to process.

Google sign-in may provide basic account information, including a Google account identifier, name, profile information and email address, so that we can authenticate the user and associate the sign-in with a CalMov account.

Google Calendar connection is optional. When a workspace owner connects it, CalMov receives the connected Google account email address, the selected calendar identifier, OAuth access and refresh tokens, and Calendar free/busy results. For existing Google Calendar commitments, CalMov uses the FreeBusy API and stores busy start and end times so unavailable periods are not offered to customers. CalMov does not import the titles, descriptions, attendees or contents of those existing events through this process.

When CalMov creates a booking event, it sends the appointment time and relevant booking information—such as the service, customer name, contact details, service address, notes and CalMov booking identifier—to the connected business's Google Calendar. CalMov stores the Google event identifier and sync status so it can update the event when a booking is rescheduled and remove it when a booking is cancelled.

CalMov's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide or improve the visible sign-in, availability and Calendar-sync features requested by the user.

We do not sell Google user data. We do not use it for advertising, retargeting, creating advertising profiles, credit or lending decisions, data brokerage, or training general artificial-intelligence models. We do not allow people to read Google user data except where the user has authorised support for specific data, where access is necessary to investigate security or abuse, where required by law, or where data has been aggregated and anonymised for permitted internal operations.

We disclose Google user data only to service providers that help us operate the requested feature, where the user directs or consents to the disclosure, for security purposes, or where required by law. Those providers may process data only for the services they supply to CalMov and must protect it appropriately.

We use providers for functions such as hosting and databases, authentication, payments, mapping and routing, email delivery, abuse prevention, analytics and Calendar integration. Depending on configuration, these include Supabase, Stripe, Google, Mapbox, Cloudflare, Vercel and Resend. They receive only the data reasonably required to perform their function and process it under their own security and privacy obligations.

Some providers may process data outside the United Kingdom. Where required, we rely on recognised safeguards for international transfers, such as adequacy regulations or approved contractual protections.

With permission, Google Analytics uses first-party cookies on CalMov's public marketing pages to help us understand visits, traffic sources, devices and page engagement. Analytics is not loaded until it is accepted. We exclude dashboards, booking flows, customer-management links, payment callbacks and password-reset pages from analytics.

Consent can be withdrawn at any time using Cookie settings in the website footer. Google Calendar data and customer booking details are not sent to Google Analytics.

We keep account, booking, support, security and transaction records only for as long as reasonably needed to provide the service, meet the business's instructions, resolve disputes, prevent abuse and satisfy legal, tax or accounting obligations. Retention can therefore vary by record type and applicable requirement. Data is deleted or anonymised when it is no longer required, unless the law permits or requires longer retention.

Google OAuth tokens, locally synchronised busy periods and Google event mappings are kept while the Calendar integration is connected. Choosing Disconnect Google Calendar in CalMov stops future access and removes those stored connection and synchronisation records. Events already created in Google Calendar may remain in that Calendar and can be managed there by the user. Users can separately revoke CalMov's authorisation from their Google Account's third-party connections page.

To request deletion of a CalMov account or other personal data, email support@calmov.com. We may need to verify identity and may retain limited records where required by law or necessary to establish, exercise or defend legal claims.

CalMov uses measures designed to protect personal and Google user data, including encrypted transport, access controls, tenant boundaries, authenticated API routes, restricted service credentials, audit logging and anti-abuse controls. Access is limited to people and providers that need it for an authorised purpose.

No online service can guarantee absolute security. Users should protect their account credentials, use available multi-factor authentication and notify us promptly about suspected unauthorised access.

Depending on applicable law, individuals may have rights to access, correct, delete, restrict or object to processing of their personal data, receive a portable copy, and withdraw consent. Withdrawing consent does not affect processing already carried out lawfully.

Customers of a business using CalMov should normally contact that business first about booking data. We will support the business in responding where CalMov processes the data on its behalf. Individuals may also complain to the UK Information Commissioner's Office or another competent data-protection authority.

We may update this policy when our service, providers or legal obligations change. We will update the date shown on this page and provide additional notice where a change materially affects how personal data is used.

For privacy requests, questions about Google user data or security concerns, email support@calmov.com. Please include enough information for us to identify the relevant account or workspace, but do not send passwords, OAuth tokens or full payment-card information.