Legal
Data processing agreement
Last updated 1 August 2026
When you use CalSync in a professional context, you are the data controller and we are the processor. This summarises the terms of that relationship; a signable version is available on request.
CalSync is open-source software. This document describes the managed service and is provided as a template for self-hosted deployments — it is not legal advice. Have a lawyer review it before publishing it as your own.
Subject matter and duration
We process personal data solely to provide calendar synchronisation and scheduling, for as long as your account is active.
Categories of data and data subjects
Data subjects are you, your team members and the people who book time through your links. Categories are limited to identifiers (name, email), scheduling metadata (times, timezone) and technical data (IP address, user agent) needed for security.
Our obligations as processor
We commit to:
- Process personal data only on your documented instructions.
- Ensure that everyone with access is bound by confidentiality.
- Apply appropriate technical and organisational security measures.
- Engage subprocessors only under equivalent obligations, and tell you before adding one.
- Assist you with data subject requests and with any required impact assessment.
- Notify you without undue delay if we become aware of a personal data breach.
- Delete or return personal data at the end of the agreement.
Audits
Because CalSync is open source, the most direct audit available to you is the source code itself. Beyond that, we will respond to reasonable written questions about our security measures and, where required by law, permit an audit on reasonable notice.
Self-hosting
If you run CalSync on your own infrastructure, no personal data reaches us and no processing agreement with us is necessary.