Privacy Policy

Effective date: 3 June 2026 · Last updated: 12 June 2026

This Privacy Policy explains how Overload Tech Ltd( "Calendaria", "we","us", "our"), a company registered in England and Wales under company number 15229063with its registered office at 20 Wenlock Road, London, England, N1 7GU, collects, uses and protects personal data when you use the Calendaria service at calendaria.co, the Calendaria Telegram bot and other channels we operate (the"Service").

We are the "controller" of personal data about your Calendaria account and your use of the Service. For personal data inside the calendar events you let us read or write, we act as a "processor" on your behalf. Section 4 explains this distinction.

This Policy forms part of our Terms and Conditions. If anything in this Policy conflicts with your statutory rights under the UK GDPR or the Data Protection Act 2018, those rights override the conflicting clause.

1. The personal data we collect

We collect the personal data you give us and the data we observe when you use the Service.

1.1 Account and identity data

• The email address you use to sign in.
• The display name and any profile information you choose to set.
• Magic-link tokens we issue to verify it is you (we store only a hash).
• Identifiers for the channels you link to your account (for example, your Telegram chat ID and Telegram user ID).
• The Google account email and OAuth tokens you provide when you connect Google Calendar (tokens are encrypted at rest using libsodium secret-box).
• Your preferences (for example, time zone, work hours, default event duration).

1.2 Service usage and content

• The messages you send to Calendaria through any supported channel, and the responses we send back.
• Pending actions you create, the actions you confirm, and the metadata we record so that we do not act twice on the same instruction (idempotency keys, audit log rows).
• Logs of the AI model calls we make on your behalf, including the model name, token counts and timing.

1.3 Calendar Data (you control this)

• The events, attendees, descriptions, locations and times in the calendars you connect to the Service. We read and, when you confirm, write to these calendars on your behalf. We act as a processor for this data — see Section 4.

1.4 Payment data

• Subscription status, plan and billing dates. We do not store your card number or full payment details — those are held by our payment processor, Stripe.

1.5 Technical data

• IP address, user-agent string, request paths and timestamps from your interactions with our servers.
• Diagnostic logs and error reports that may include the data above, retained for the period in Section 7.

1.6 Communications

• The content of support emails or messages you send us.

We do not knowingly collect special-category personal data (such as health, religion, sexual orientation). Please avoid putting that kind of detail into event titles or messages; if you do, we treat it under Article 9 UK GDPR as having been manifestly made public by you for the purpose of the Service.

2. How we use your data and the lawful basis

We use personal data only for the purposes below, and we rely on the lawful bases set out in Article 6 of the UK GDPR.

We do not sell your personal data, and we do not show advertising in the Service.

We do not use the content of your calendars or messages to train general-purpose AI models. Our AI providers process your data only to generate the response you asked for, in line with their published policies for our enterprise-grade API access.

3. AI providers and automated decision-making

3.1 To interpret your natural-language instructions, the Service sends your messages and relevant context (such as recent events from your linked calendar) to AI providers we choose from time to time. As of the effective date, our primary AI provider is Anthropic, PBC (Claude family of models). We may add or change AI providers; we will keep the list in Section 5 current.

3.2 Calendar writes (creating, moving, cancelling or inviting attendees to events) are not solely automated. Each write action is proposed to you for explicit confirmation before it takes effect, and you choose whether to confirm it. You therefore retain a meaningful human review under Article 22 UK GDPR.

3.3 If you are concerned about a specific AI-generated proposal, do not confirm it and contact us at support@calendaria.co.

3.4 Google user data — Limited Use disclosure

Calendaria's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: (a) we only use Google user data to provide and improve the user-facing features of the Service described in this Policy; (b) we do not transfer Google user data to third parties except as necessary to provide those features (see Section 5), to comply with applicable law, or as part of a merger or acquisition with prior notice to you; (c) we do not use Google user data for advertising; and (d) we do not allow humans to read your Google Calendar data except with your explicit consent, where necessary for security or abuse investigation, to comply with applicable law, or where the data has been aggregated and anonymised.

No generalized AI/ML training: we do not retain or use data obtained through Google APIs to develop, improve, or train generalized artificial intelligence or machine-learning models. Calendar context sent to our AI providers (Section 3.1) is used solely to serve your individual request at the time you make it, and our AI providers do not train their models on this data.

4. Controller vs processor: your Calendar Data

4.1 For data about your Calendaria account itself (email, preferences, billing, channel IDs, logs of how you use the Service), we are the controller.

4.2 For personal data inside the calendars you connect (event titles, attendee email addresses, descriptions and so on) we are a processor acting on your instructions, under Article 28 UK GDPR. You decide what goes into your calendar; we only read or write it to carry out the operations you ask for.

4.3 If you need a separate Data Processing Addendum for business use, contact privacy@calendaria.co.

5. Who we share your data with

We share personal data only with the categories of recipient below, and only as much as needed for each purpose.

5.1 Sub-processors and service providers

We update this list when we add, replace or remove a sub-processor. Significant changes are communicated as described in Section 12.

5.2 Other recipients

• Our advisers (accountants, lawyers, auditors) on a confidential, need-to-know basis.
• Authorities where we are legally obliged to disclose (for example, a valid court order from a competent UK authority).
• A successor in the event of a merger, sale or reorganisation of our business; we will tell you in advance and your data will continue to be protected under terms no less protective than this Policy.

We do not share personal data with anyone else without your consent.

6. International transfers

6.1 Several of our sub-processors operate outside the United Kingdom. Where we transfer personal data to a country that the UK Government has not recognised as providing an adequate level of protection, we rely on appropriate safeguards as required by Article 46 UK GDPR, including:

• (a) Standard Contractual Clauses with the UK International Data Transfer Addendum issued by the Information Commissioner's Office, or the UK International Data Transfer Agreement (UK IDTA); and
• (b) the sub-processor's published data-protection commitments (for example, Google's, Anthropic's, Stripe's and AWS's data processing addenda).

6.2 You can ask us for a copy of the safeguards that apply to a specific transfer by writing to privacy@calendaria.co.

7. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it.

• Account data: while your account is active, and for up to twelve (12) months after closure so that you can reactivate. After that, we delete or anonymise it.
• Authentication tokens: magic-link hashes expire after a short window (typically minutes); handoff tokens expire after seconds. OAuth tokens are kept while your account is active and revoked on disconnection.
• Calendar Data: held only transiently while we perform the operation you asked for, plus relevant entries in our audit log. We do not keep a long-term copy of your calendar.
• Conversation history: the messages you exchange with Calendaria (across web, Telegram and WhatsApp) are kept for up to thirty (30) days, then automatically deleted. You can clear them yourself at any time from the chat, which deletes them immediately.
• Logs and diagnostics: typically retained for up to ninety (90) days, then deleted or aggregated.
• Billing records: retained for at least six (6) years after the financial year they relate to, to meet UK accounting and tax obligations.
• Support correspondence: retained for up to two (2) years after the conversation closes.

If you ask us to delete your data sooner, see Section 8.

8. Your rights

Under the UK GDPR you have the following rights, which you can exercise free of charge:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion of your data where one of the legal grounds applies.
• Restriction — temporary limit on how we use your data.
• Portability — receive your data in a structured, machine-readable format and ask us to send it to another provider where technically feasible.
• Object — to processing we carry out on the basis of legitimate interests, including any profiling.
• Withdraw consent — where we relied on your consent for a specific purpose.

To exercise any of these rights, write to privacy@calendaria.co. We will respond within one month, or tell you why we need longer (up to a further two months for complex requests).

How to delete your data

You can delete your data at any time, in two ways:

• From the app: sign in at /settings and disconnect your calendar accounts and channels (Google Calendar, Telegram, WhatsApp). Disconnecting deletes the associated access tokens immediately. To remove your account entirely — including your profile, conversation history, and usage records — email privacy@calendaria.co from the address on your account with the subject "Delete my account".
• Clear your chat history: from the chat at /chat, use Clear history to delete your entire conversation history across all channels immediately.
• By email: write to privacy@calendaria.co requesting deletion. We confirm completion within one month.

Payment records processed through Stripe are retained only as required for tax and accounting obligations (see Section 7); everything else is deleted or anonymised.

If you are unhappy with how we have handled your personal data, you can complain to the UK Information Commissioner's Office (ICO):

• Website: https://ico.org.uk/make-a-complaint/
• Helpline: 0303 123 1113

We would appreciate the chance to address your concerns first.

9. Cookies and similar technologies

9.1 We use a small number of strictly necessary cookies and similar storage on calendaria.co — most notably the cia_session HTTP-only cookie that keeps you signed in. These cookies are essential to provide the Service and are not used for advertising or cross-site tracking.

9.2 We may use privacy-preserving analytics (no third-party advertising trackers) on calendaria.co and calendaria.co. Where the law requires consent, we will ask for it before setting any non-essential cookie.

9.3 Most browsers let you block or clear cookies in their settings. Blocking essential cookies will stop the Service working.

10. Children

The Service is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data, write to privacy@calendaria.co and we will delete it.

11. Security

11.1 We take reasonable technical and organisational measures to protect personal data, including:

• encryption of OAuth tokens at rest using libsodium secret-box;
• HTTPS for all network traffic between you and our infrastructure;
• signed, HTTP-only session cookies and short-lived single-use handoff tokens;
• HMAC-signed channel-link tokens with bounded lifetimes;
• least-privilege access to production systems and audit logging of administrative actions;
• encrypted backups of operational databases.

11.2 No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights or freedoms, we will notify the ICO within 72 hours and, where required, tell you without undue delay.

12. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will tell you in advance — for example, by email or by a notice on calendaria.co — and update the "Last updated" date at the top of this Policy. Continuing to use the Service after the change date means you accept the updated Policy.

13. Contact and complaints

You can reach us at:

• Email (data protection enquiries): privacy@calendaria.co
• Email (general support): support@calendaria.co
• Registered office: Overload Tech Ltd, 20 Wenlock Road, London, England, N1 7GU, United Kingdom
• Company number: 15229063 (England and Wales)

You can also contact the UK Information Commissioner's Office (Section 8) if we have not resolved your concerns.

Thank you for trusting Calendaria with your time.