Privacy policy

Last updated 14 October 2026 · Effective 14 October 2026

1. Who we are

Calybee (“Calybee”, “we”, “us”) is website and booking software for businesses that sell their time. It is not a payment service: money a business’s clients pay goes straight to that business’s own Stripe or PayPal account and never passes through Calybee. It is operated by Mrutyunjaya Mishra, an individual based in India, who is the controller of the data described in this policy for account holders. Postal address: D/186, IFFCO, India 754142.

For anything in this policy, write to support@calybee.com.

2. Our two roles

Data protection law treats us differently depending on whose data it is.

We are the controller for

• people who sign up for and use a Calybee account (“account holders”), and team members they invite;
• visitors to calybee.com (this website); and
• anyone who writes to us.

We are a processor for

data that businesses collect about their own clients and visitors through Calybee: bookings, client records, answers to booking questions, signed consent, form messages, reviews and gift card purchases. The business is the controller of that data and decides why it is collected. We process it only on the business’s instructions and under our data processing agreement. If you booked with a business that uses Calybee, please contact that business first about your data; we will help them answer you.

3. What we collect

From account holders

• Account details: email address and password. Passwords are stored as salted hashes by our authentication provider; we cannot read them. If you sign in with Google instead, we receive your name, email address and profile picture from Google (see section 5) and no password is stored.
• Business details: business name, address, city, time zone, language, currency, and the answers you give during setup (for example what you offer, your story and how you want the site to feel).
• Content: your pages, text, images, logo, services, prices, schedules, policies, menus and theme.
• Team: names, email addresses and working hours of the people you add, and messages you exchange with them through Calybee.
• Connections: if you connect Google Calendar, the access and refresh tokens Google issues, the Google email address of that calendar, and the busy times described in section 5; if you subscribe to a calendar link, the link itself (stored so that only our servers can read it); if you connect Stripe or PayPal, your restricted API key, which is stored in an encrypted secrets vault and never shown back to the browser.
• Usage and technical data: IP address, browser and device type, and error logs, kept by our hosting providers to run and secure the service.
• Billing, for paid plans: Paddle, our Merchant of Record, collects your name, email address, billing address, tax number if you give one, and payment details at checkout. We receive from Paddle your plan, its status and renewal date, your country and the amounts paid, never your card details.
• Support: what you tell us when you write to us.

From clients and visitors of Calybee businesses (as processor)

• name, email address and phone number given when booking;
• the booking itself: service, time, the team member, notes, and any add-ons or series;
• answers to the questions the business asks, which may include information the business chooses to ask for;
• signed consent: the typed name, the wording agreed to and the time;
• payment status and amounts (never card numbers; those stay with Stripe or PayPal);
• gift card codes and balances, discount codes used, and membership details;
• notes and tags the business adds to a client record;
• messages sent through a contact or enquiry form, and reviews the client chooses to submit.

Visits to Calybee sites

We count page views as daily totals per page and per referring website. We do not use cookies for this and we do not build a profile of any visitor. A business may add its own analytics tool (for example Google Analytics or Plausible) to its Calybee site; that business is responsible for it and for asking any consent it needs.

4. How we use it, and why we are allowed to

We do not sell personal data, share it for cross-context behavioural advertising, or use it to train artificial intelligence models.

5. Google user data

Calybee uses Google in two optional ways. Each asks only for what it needs, and Google shows you exactly what is asked before you agree.

Signing in with Google

If you choose “Continue with Google”, Google tells us your name, email address and profile picture (openid, email, profile). We use them only to create and sign in to your Calybee account and to show who is signed in. Signing in with Google gives Calybee no access to your calendar, email, contacts or files.

Connecting Google Calendar

If you connect Google Calendar, Calybee asks Google for these permissions, and nothing more:

• Which Google account it is (openid, userinfo.email). Your Google email address, so Calybee can show which calendar is connected.
• See when you are busy (calendar.events.freebusy). We read only the start and end of busy periods so that those times are not offered to your clients. Google does not give us event titles, descriptions, guests or locations, and we store only the busy windows.
• Create and manage events for your bookings (calendar.events.owned). When someone books, and you have chosen to add bookings to your calendar or the booking uses Google Meet, we add one event for that booking to a calendar you own (with a Meet link if you chose Meet for that service). The event holds the service, the client’s name, email address and phone number (if they gave one), and the time. Clients are not added as guests, so Google sends them nothing. We move it when the booking moves and remove it when the booking is cancelled. We never use this permission to read, change or delete any event Calybee did not create.

Google’s screen lets you untick either Calendar permission. Calybee then does only what you allowed, and tells you in the app what will not work without the other.

What we do and do not do with Google user data

Calybee’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide the features described above, which you can see and control in Calybee.
• We do not transfer it to anyone else, except our infrastructure providers in section 7 who store it for us, when you ask us to, for security, or when the law requires it.
• We do not use it for advertising, we do not sell it, and we do not use it to judge creditworthiness or for lending.
• We do not use it to develop, improve or train artificial intelligence or machine learning models, ours or anyone else’s. It is not sent to the Bee or to Anthropic. The Bee and a Claude account you connect can see which booking times are free, which Calybee works out using your busy windows, but never your Google events or the windows themselves.
• No person at Calybee reads it, unless you ask us to for support and agree, it is needed for security, or the law requires it.

Google tokens are stored in our database where the browser cannot read them, and travel only over encrypted connections between our servers and Google.

You can disconnect Google Calendar at any time in Calybee, or remove Calybee from your Google account’s third-party access page. When you disconnect, we delete the tokens and the stored busy times, and ask Google to revoke Calybee’s access (unless another calendar you have connected in Calybee uses the same Google account). Events already added to your calendar stay there as yours. When you delete your Calybee account, we also ask Google to revoke Calybee’s access.

6. The Bee, Claude and other apps you connect

The Bee (built in)

The Bee is the assistant inside Calybee that sets up, writes and changes your site. It is powered by Claude, an AI model made by Anthropic, which we use as our service provider. When you use the Bee, we send Anthropic what is needed to answer you: your message, the page or account details it is working on, and anything you give it during setup, such as your existing website’s text, a price list or CV, or photos. The Bee only runs when you ask it to. Anthropic processes this for us under its commercial terms, which do not allow it to use the content to train its models, and we do not send your payment keys or your clients’ card details.

Claude, connected by you (optional)

Separately, you can connect your own Claude account to Calybee, so that Claude can build and edit your site and read or change your bookings for you. You do not need to: the Bee works without it. Nothing goes to your Claude account unless you connect it. Once connected, Claude receives the account information its tools return while you use it, and Anthropic handles that information under your own agreement with Anthropic. The connection cannot take, refund or mark payments, and cannot read your payment keys. You can disconnect it at any time under Connectors in Calybee.

Stripe and PayPal work the same way: you connect your own account, your clients pay on the provider’s own page, and the provider handles card details under its own terms as an independent controller.

The option to translate your site’s own words uses your browser’s built-in translator, which runs on your device.

7. Who we share it with

We use a small number of service providers to run Calybee. Each may process personal data only to provide its service to us.

Paddle.com is the Merchant of Record for all our orders. It handles the billing data it collects at checkout as an independent controller, under its own privacy notice, which it shows at checkout.

The typefaces on this website, in the Calybee app and on Calybee sites come from Google Fonts, but through our own servers: your browser never contacts Google for them, so Google does not see your IP address. The photos on this website are served the same way. Some content is still loaded directly by the visitor’s browser from other services, which means those services see the visitor’s IP address:

• Unsplash supplies sample photos in Calybee site templates until the business replaces them with its own.
• Embedded content a business adds, such as a map, video or music player, comes from its own provider.

We may also disclose data if the law requires it, to protect people or the service from harm, or as part of a sale or transfer of Calybee, in which case this policy continues to apply.

8. International transfers

Our providers store and process data outside the European Economic Area and the United Kingdom, including in Australia and the United States. Where the destination does not have an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) included in our providers’ data processing terms.

9. How long we keep it

• Account data and content: for as long as your account is open.
• Client data held for a business: for as long as the business keeps it in Calybee, or until its account is closed.
• After you ask us to delete your account: we delete it within 30 days. Copies in our providers’ backups roll off within a further 30 days.
• Google Calendar tokens and busy times: until you disconnect the calendar or delete your account. Busy times are refreshed regularly, and windows that have passed are deleted within two days.
• Page view totals: kept as aggregate counts, which contain no personal data.
• Server logs: kept by our providers for a short period for security and debugging.
• Billing records: your plan and payment history, for as long as tax and accounting law requires, even after your account is closed. Paddle keeps its own records under its own policy.
• Emails to us: kept for as long as needed to help you, then deleted.

10. Security

All traffic to Calybee is encrypted in transit. Access rules in the database mean each account can reach only its own data. Payment keys and calendar credentials are kept where the browser cannot read them. We never receive card numbers. No system is perfectly secure, so if we learn of a breach affecting your data we will tell you without undue delay, and tell the authorities where the law requires.

Calybee is not designed to store protected health information. US healthcare providers covered by HIPAA should not use Calybee for patient records, and any business should avoid asking for health details it does not need.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct it if it is wrong;
• delete it;
• restrict or object to how we use it;
• receive it in a portable format;
• withdraw consent you have given; and
• complain to your data protection authority.

Residents of California and other US states with privacy laws have similar rights to know, delete and correct, and the right not to be discriminated against for using them. We do not sell or share personal information as those laws define it.

To use any of these rights, email support@calybee.com. We will answer within one month and may need to confirm who you are first. If you are a client of a business that uses Calybee, we will pass your request to that business, because it decides what happens to your data.

12. Cookies and local storage

• calybee.com (this website) sets no tracking or advertising cookies. While Calybee is in early access, opening a password-protected page sets one strictly necessary cookie that remembers you entered the password, for up to 30 days.
• The Calybee app keeps you signed in and remembers preferences such as light or dark mode using your browser’s local storage. These are strictly necessary for the app to work.
• Calybee sites set no cookies of ours. If a business adds its own analytics tool, that tool may; the business is responsible for it.

Because we do not track people across websites, there is nothing for a browser’s Do Not Track or Global Privacy Control signal to switch off on our side; we treat both as a request not to sell or share your data, which we never do anyway.

13. Children

Calybee accounts are for adults running a business. We do not knowingly collect data from children under 16 for our own purposes. Businesses that take bookings for children, such as tutors, are responsible for getting consent from a parent or guardian.

14. Links to other websites

Calybee sites and this website may link to websites we do not run, such as a business’s social profiles or review pages. Their own privacy policies apply there, and we are not responsible for what they do.

15. Changes

We will update this policy as Calybee changes. If a change is significant, we will tell account holders by email before it takes effect. The date at the top always shows the latest version.

16. Contact

Email support@calybee.com. Calybee is operated by Mrutyunjaya Mishra, D/186, IFFCO, India 754142.