Privacy Policy

Information you provide.

• Account data: name, email address, password (hashed), profile photo, username, time zone, role (Pro or Client), and similar registration information.
• Pro profile data: business name, bio, service descriptions, pricing, scheduling rules, refund policy, branding.
• Booking and content data: appointments, messages, intake responses, notes, files, and any other content you submit.
• Payment data: to use payment features, you provide payment information directly to Stripe. Calavai does not collect, store, or have access to full payment card numbers or bank credentials. We receive limited tokens and metadata from Stripe (for example, last four digits, brand, customer ID, payout status, dispute status).
• Communications: when you email us or contact support, we keep a record of the correspondence.

Information collected automatically.

• Usage and device data: IP address, browser and device type, operating system, language, referring and exit pages, pages viewed, links clicked, timestamps, session identifiers, and approximate location derived from IP.
• Cookies and similar technologies: see Section 8.

Information from third parties.

• Google Calendar / OAuth providers: if you connect a third-party account, we receive the tokens and account metadata you authorize.
• Stripe: transaction, payout, dispute, and identity-verification metadata for your connected account.
• Fraud and security signals from our service providers.

We do not knowingly collect biometric data, precise geolocation, government-issued IDs (Stripe collects these directly for KYC, not Calavai), or sensitive health information. Pros should not share their clients' sensitive personal information through the Platform unless they have a lawful basis to do so.

We use personal information to:

• create and operate your account and provide the Platform;
• enable and process bookings, scheduling, calendar sync, notifications, reminders, and emails;
• facilitate payments through Stripe;
• communicate with you about transactions, security, support, and changes to our services;
• detect, prevent, investigate, and respond to fraud, abuse, security incidents, chargebacks, and violations of our Terms;
• analyze usage and improve, debug, and develop the Platform;
• send marketing communications about Calavai (you can unsubscribe at any time);
• comply with legal obligations, respond to lawful requests, and protect our rights and the rights and safety of others;
• enforce our Terms.

We do not use your personal data to train, fine-tune, or evaluate any third-party artificial intelligence model. We may use de-identified or aggregated data for any business purpose.

If you are in the EEA, UK, or Switzerland, we process personal data on the following legal bases under the GDPR / UK GDPR:

• Performance of a contract: to provide the Platform you have requested.
• Legitimate interests: to operate, secure, analyze, and improve the Platform; to prevent fraud; to communicate about service-related matters; and to enforce our Terms. We balance these interests against your rights.
• Consent: for optional cookies, marketing emails where required, and other processing where the law requires consent. You may withdraw consent at any time.
• Legal obligation: to comply with applicable laws.

If you require a Data Processing Addendum reflecting the EU Commission's Standard Contractual Clauses (SCCs), Pros may request one at [email protected].

Calavai does not sellpersonal information in exchange for money. However, under California's CPRA and similar state laws, the term "sharing"(sometimes called "sale") includes disclosing personal information to third parties for cross-context behavioral advertising, regardless of whether money changes hands. As described in Section 8 below, Calavai uses Google Analytics 4, Google Ads conversion tracking, and the Meta Pixel — and that activity qualifies as "sharing" under those laws. You can opt out at any time via the Do Not Sell or Share My Personal Information page or the cookie-preferences link in our footer.

Beyond the advertising disclosures above, we share personal information only as described below:

• With your Pro or your Clients: booking and communication information necessary to deliver the service you booked or to manage the client you are serving.
• Service providers acting on our behalf under written contracts, including providers of payment processing, email delivery, hosting, database, content delivery, rate limiting, calendar synchronization, analytics, customer support, and fraud prevention. These providers are permitted to use personal data only to provide services to us.
• Advertising and analytics partners: Google (Google Analytics 4, Google Ads) and Meta Platforms (Meta Pixel). These receive limited event data — page views, sign-up events, booking events — tied to a device or cookie identifier. They use this data to measure ad performance and, where permitted, to retarget you on their properties. See Section 8 for the categories of data shared and how to opt out.
• Stripe for payment processing, payouts, and identity verification (Stripe acts as an independent controller for its own purposes under its privacy policy).
• Legal and safety: to comply with applicable law, a lawful request from a government or regulatory authority, court order, subpoena, or legal process; to enforce our Terms; to investigate fraud or abuse; or to protect the rights, property, or safety of Calavai, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, in which case personal data may be transferred as part of the transaction.
• With your consent or at your direction.

Calavai is operated from the United States. Personal data we collect may be stored and processed in the United States or in any other country where Calavai or our service providers operate. Where required, we rely on appropriate safeguards, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, for transfers from the EEA, UK, or Switzerland.

We retain personal information for as long as your account is active and for a reasonable period thereafter, as needed to: comply with legal, accounting, tax, and audit obligations; resolve disputes; enforce our agreements; prevent fraud and abuse; and maintain backups. Booking and payment records are generally retained for at least seven (7) years to comply with financial and tax recordkeeping laws. We may retain de-identified or aggregated information indefinitely.

United States — CCPA / CPRA and other state laws. If you are a resident of California or another U.S. state with a comprehensive privacy law, you have, subject to verification and legal exceptions, the right to:

• know what personal information we collect, use, disclose, and share;
• access or receive a copy of your personal information;
• correct inaccurate personal information;
• delete personal information we hold about you;
• opt out of the "sale" or "sharing" of personal information — Calavai does not sell PI for money but does share device-level event data with Google and Meta for cross-context behavioral advertising; use the Do Not Sell or Share My Personal Information page to opt out. We also honor recognized Global Privacy Control (GPC) signals as an opt-out request;
• limit the use of sensitive personal information (we do not use it for purposes that trigger this right);
• be free from discrimination for exercising these rights.

Authorized agents may submit requests on your behalf with proof of authorization.

EEA / UK / Switzerland — GDPR.You have the right to: access; rectification; erasure ("right to be forgotten"); restriction; objection (including to direct marketing, which we will honor); data portability; and to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.

How to exercise your rights. Email [email protected] with your request and the account email. We will respond within the timeframes required by applicable law. We may request information to verify your identity.

If you are a client of a Pro, please contact the Pro directly for requests about data they control.

We use cookies, pixels, and similar technologies in three categories:

• Strictly necessary — authentication session cookies (__Host-session), CSRF protection, rate-limit anti-abuse signals. These cannot be disabled because the site cannot function without them. No consent is required under GDPR Art. 5(3) and ePrivacy.
• Analytics — Google Analytics 4 measures page views, sessions, and conversion events to help us improve the product. GA4 sets cookies prefixed _ga on your device. We do not enable Google Signals or Ads personalization within GA4 itself, but we do link GA4 to Google Ads (see below), which causes GA4 audience data to qualify as "sharing" under CPRA.
• Advertising — Google Ads conversion tracking and the Meta (Facebook) Pixel measure ad performance and let us retarget visitors with relevant ads on Google and Meta properties. These tools share device identifiers and event data (page view, sign-up, booking) with Google and Meta. Under California, Colorado, Connecticut, and similar state privacy laws, this is "sharing" / "targeted advertising".

Your controls. For visitors from the EEA, UK, or Switzerland, analytics and advertising technologies are blocked until you acceptin the cookie banner we present on first visit (ePrivacy Art. 5(3); GDPR Art. 7). Anywhere in the world, you can:

• Use the Do Not Sell or Share My Personal Information page to opt out of advertising sharing globally on Calavai.
• Enable the Global Privacy Control (GPC) in your browser — Calavai treats GPC as a valid opt-out.
• Change your cookie preferences via the "Cookie settings" link in our footer.
• Opt out at the partner: Google Analytics opt-out; Google Ads settings; Meta ad preferences.

We do not respond to legacy "Do Not Track" (DNT) headers because the standard was never finalized; GPC is the recognized successor and we honor it.

The Platform is not directed to, and we do not knowingly collect personal information from, anyone under 18. If we learn that we have collected information from a person under 18, we will delete it. Parents or guardians who believe a minor has provided information may contact [email protected].

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, hashing of credentials, infrastructure provided by reputable cloud vendors, and logging. No system is perfectly secure. We do not warrant or guarantee that personal information will be free from unauthorized access. In the event of a security incident affecting personal information, we will notify affected users and regulators as and to the extent required by applicable law.

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date and, where appropriate, by email or in-app notice. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

For privacy questions or to exercise your rights, contact [email protected]. For general questions, contact [email protected].

Calavai acts as its own privacy contact. We have not appointed a Data Protection Officer because we are not required to do so under Article 37 of the GDPR. If you are in the EEA or UK and require a representative under Article 27 GDPR or UK GDPR for specific processing, please contact us to discuss the arrangement.

Calavai is operated by DGD OPCO LLC, a Texas limited liability company, registered at 5900 Balcones Drive #29311, Austin, TX 78731.