Privacy Policy

This Policy applies to My Clendar digital services. My Clendar acts as a controller for data required to create accounts, secure the service, bill platform subscriptions, and operate the technology. For data entered by a business about its clients, professionals, schedule, services, and communications, the business generally determines the purposes and acts as controller, while My Clendar processes the data under its instructions to provide the service.

Each business must provide any required privacy notices, select appropriate lawful bases, and manage its clients’ authorizations and communication preferences. This Policy does not replace a business’s own policy or the policies of third-party integrations.

We process data relevant to the features used and the purposes described in this Policy. Categories may include:

• registration and identity data, such as name, email address, phone number, photo, language, country, role, and business relationship;
• operational data, such as services, professionals, locations, availability, blocks, appointments, notes, and service history;
• client data provided by the client or business, including contact details, preferences, consent records, and communication history;
• commercial and financial data, including plan, subscription status, prices, charges, commissions, expenses, and transaction identifiers; full card details are handled by the payment provider;
• content submitted through support, forms, settings, files, images, messages, and artificial intelligence features;
• usage and security data, such as IP address, device, browser, date and time, accessed pages, events, errors, sign-in attempts, and audit logs;
• authorised integration data, such as identifiers, granted scopes, connected accounts, calendars, and delivery metadata.

We receive data directly from people who create accounts, book services, complete forms, send messages, or configure the platform. We may also receive data from the business responsible for the client relationship, authorised staff, and enabled authentication, payment, calendar, email, and messaging integrations.

Technical data is generated automatically to maintain sessions, prevent abuse, diagnose errors, measure performance, and secure accounts. Anyone providing third-party data must have authority and a lawful basis to do so.

Depending on context and applicable law, we process data to perform contracts and requested steps, comply with legal obligations, pursue legitimate interests that do not override individual rights, protect rights and security, or rely on consent where required. Purposes include:

• creating, authenticating, and administering accounts, permissions, and businesses;
• providing scheduling, bookings, payments, subscriptions, reports, notifications, support, and integrations;
• confirming operations and sending requested transactional communications or reminders;
• preventing fraud, abuse, unauthorised access, duplication, outages, and security incidents;
• meeting tax, accounting, regulatory, court, and consumer-protection duties;
• improving stability, accessibility, performance, and experience using aggregated or de-identified data where appropriate.

My Clendar does not require sensitive personal data for ordinary scheduling. Health, beauty, and other regulated businesses should avoid entering diagnoses, medical records, or sensitive details in free-text fields unless strictly necessary, lawfully authorised, and appropriately safeguarded.

The platform is intended to be contracted and administered by persons with legal capacity. If a business serves a child or teenager, it must obtain required parental authorisation, act in the child’s best interests, and limit collection to what is necessary.

Platform and client payments may be processed by specialised providers such as Stripe. My Clendar may receive transaction identifiers, amount, currency, status, dates, summarised payment method, failures, and reconciliation data, but does not store the full card number or security code.

A payment provider may act as an independent controller for fraud prevention, identity verification, regulatory compliance, and financial processing. Its own terms and privacy policy also apply.

Email, WhatsApp, push notifications, calendars, and other channels are used according to business settings, message type, and applicable permissions. Recipients may opt out of non-essential communications through available methods without preventing strictly transactional or security messages.

When an integration is enabled, necessary data is transmitted to perform the requested action. Content submitted to AI features may be processed to generate responses and assist tasks. Do not submit secrets or unnecessary sensitive data, and have a person review outputs before consequential use.

We do not sell personal data. We may disclose the minimum necessary information to contracted vendors, user-selected integrations, professional advisers, competent authorities, and participants in a protected corporate transaction. Categories include:

• infrastructure, hosting, database, authentication, storage, security, monitoring, and support providers;
• payment and fraud-prevention providers, including Stripe;
• email and message delivery providers, including Resend and Meta/WhatsApp;
• calendar, authentication, and authorised API providers, including Google;
• professional advisers, auditors, and authorities under confidentiality or legal duties;
• participants in an investment, reorganization, merger, or acquisition with appropriate safeguards and notice where required.

Some providers or systems may process data outside the data subject’s country. Where required, we use appropriate contractual mechanisms and technical safeguards, assess the applicable level of protection, and limit processing to contracted purposes.

Actual locations vary by provider, selected region, and enabled integration. Each business should also assess transfers resulting from the integrations it chooses.

We retain data for as long as necessary to provide the service, maintain accounts, secure and audit operations, resolve disputes, and meet legal or contractual obligations. Periods vary by category, business relationship, billing history, fraud risk, and tax or regulatory requirements.

After termination, data may remain temporarily in access-restricted backups until securely overwritten. Data may be de-identified for statistics and improvement. Deletion requests do not cover records that must lawfully be retained or are reasonably needed to establish or defend legal claims.

We use risk-appropriate safeguards such as role-based access, tenant isolation, audit logs, encryption in transit, credential protection, monitoring, and secure development practices. No system is completely invulnerable, and users must also secure passwords, devices, verification codes, and sessions.

If a relevant incident is confirmed, we will investigate, contain, and remediate it and make legally required notifications to affected parties and competent authorities based on its nature, scope, and risk.

Depending on applicable law, individuals may request confirmation, access, correction, regulated portability, disclosure information, review of automated decisions, restriction, objection, de-identification, blocking or deletion, and withdrawal of consent.

To exercise a right concerning My Clendar directly, email support@myclendar.com. We may request reasonable information to verify identity and prevent fraud. If a business controls the data, we will route or direct the request to that business. Individuals may also complain to the ANPD or their competent data protection authority.

We use cookies and equivalent technologies necessary for authentication, security, sessions, language, preferences, and application operation. Optional analytics or third-party features, if enabled, must follow legally required choice mechanisms.

Blocking essential technologies may prevent sign-in or proper operation. Preferences may be changed through the browser, device, or available platform settings.

We may update this Policy for legal, technical, or operational changes. Material updates will be highlighted or communicated before taking effect where required. Privacy questions, rights requests, and security reports must be submitted in English to support@myclendar.com.

If our response does not resolve the issue, the individual may contact the ANPD, consumer-protection agencies, or the competent authority in their jurisdiction without prejudice to other legal rights.