Calendly
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The policy describes staff access for safety and legal checks.
Scheduling plus meeting recordings and ads cookies; auto-renew, no refunds, and they can close you anytime.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account and billing info, device IDs, cookies, usage stats, and extra data from marketing partners.
Read the exact line
Privacy policy
“This log data may include information, such as the web address you came from or are going to, your device model, operating system, browser type, unique device identifier, IP address, mobile network carrier, and time zone or approximate location.”
Training
They run scheduling, improve the product, send emails, market to you, and use third-party ads and analytics.
Read the exact line
Privacy policy
“We will perform research and analysis about your use of, or interest in, our products, Services or content, or products, services or content offered by others.”
Sharing
Service providers, affiliates, ad/analytics partners, and (for work emails) your company can see data.
Read the exact line
Privacy policy
“We may disclose information to third party partners, including marketing, advertising and analytics providers, and also business and integration partners.”
Kept
They keep personal data as long as they say they need it for those purposes and legal claims.
Read the exact line
Privacy policy
“We retain the Personal Data we collect for so long as is reasonably necessary to fulfill the purposes for which the data was collected, to perform our contractual and legal obligations”
Controls
You can update account settings, reject optional cookies, and opt out of promo emails or sale/share.
Read the exact line
Privacy policy
“If you are a resident of one of these states, you may have the right to opt out of the use of such Cookies that result in a “sale” or “share” by navigating to the “Your Privacy Choices” or “Cookie Settings” link”
Fine print
Paid plans auto-renew with no refunds; they can close your account without notice.
Read the exact line
Terms of service
“You understand that all Fees are non-cancellable and non-refundable and must be paid without offset or deduction of any kind.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Reject optional cookies / opt out of sale or share
Cookie banner, footer “Cookie Settings” or “Your Privacy Choices”, or Account Settings → Cookie Settings
Opt out of promotional emails
Unsubscribe link in the email (up to 10 days to process)
Update or delete your account
Account settings page, or (terms say complete deletion is effective immediately unless they decide otherwise)
Cancel or downgrade before renewal
Billing page of your account or Calendly Support; invoice/Enterprise needs 30 days’ written notice
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can shut off your account whenever they decide, including without telling you first.
Read the exact line
Terms of service
“Calendly may suspend or terminate your access to and use of the Services, including suspending access to or terminating your account”
For example, you could lose access to upcoming bookings overnight if they decide your use is a risk.
Subscriptions keep charging and you do not get money back if you cancel mid-term.
Read the exact line
Terms of service
“You understand that all Fees are non-cancellable and non-refundable and must be paid without offset or deduction of any kind.”
For example, if you cancel an annual plan after a month, they keep the rest of the year.
If someone sues them because of your data, integrations, or how you used the product, you may have to pay their legal costs.
Read the exact line
Terms of service
“You shall defend Calendly against any Third-Party Claim: (i) alleging that the combination of a TPA or configuration provided by you”
For example, if a guest sues over a recorded meeting you set up, you might have to cover Calendly’s lawyers.
Ad and analytics cookies can count as selling or sharing your data, unless you opt out.
Read the exact line
Privacy policy
“We may also sell or share information to the extent our use of Cookies and tracking technologies for targeted advertising or analytics purposes constitutes a “sale” or “share” under the .”
For example, Facebook Pixel or Google Analytics on their site can track you for ads until you hit Reject All.
If you use AI recaps or similar tools, your meeting content can go to outside AI vendors.
Read the exact line
Terms of service
“by using AI Features, You acknowledge that your Input and Output, including Customer Data, will be shared and processed by these third-party providers.”
For example, a transcribed sales call could be sent to a third-party AI company to generate the summary.
They get a broad license to use your scheduling and meeting content to run and improve the service.
Read the exact line
Terms of service
“you grant to Calendly a worldwide, , non-exclusive, non-transferable (except in compliance with Section 17(c)), license to use, distribute, host, copy, transmit, and display Customer Data”
For example, they can copy your event details and usage patterns to fix bugs and build new features.
They say an independent ISO 27001 audit covers their security program.
Read the exact line
Privacy policy
“We have obtained industry recognized certifications and audits, such as the ISO/IEC 27001, which affirm our commitment to our security program.”
For example, a company buying Calendly can point to that certification when checking vendor security.
The product is for adults 18 and up; they say they will delete data if they learn a child signed up.
Read the exact line
Privacy policy
“Calendly is not directed to children under eighteen (18) years of age, and we do not knowingly collect Personal Data from children under 18.”
For example, a 16-year-old should not create an account, and they claim they would delete it if found.
Just booking a meeting with someone else should not put that email on Calendly’s marketing list.
Read the exact line
Privacy policy
“Please be assured that we do not use the email addresses that you enter to schedule a meeting with a Calendly customer to send any type of direct marketing.”
For example, if you book a dentist via their Calendly link, they say they will not spam that address.
Words to know
Legal words from the lines above, in plain English.
- device identifiers
- Codes that single out your phone or computer, used to recognise you across apps and sites. For example, the advertising ID on your phone lets two unrelated apps know they are seeing the same person.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- tracking pixels
- Tiny invisible images or bits of code in a page, app or email that report back when and where you opened it. For example, a pixel in a marketing email tells the sender the moment you read it.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- CCPA
- California's privacy law, which gives residents the right to see, delete and stop the sale of their data. For example, a Californian can ask the app to stop selling their data and it must comply.
- inputs and outputs
- Inputs are what you type, say or upload to an AI; outputs are what it gives back to you. For example, the question you ask a chatbot is an input and its answer is an output, and both may be stored.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
How we got here · grade C · score 45/100 · 15 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect account and billing details plus logs, device IDs, IP, cookies, usage stats, and marketing-partner lead data.
Does it record your voice, face or body, and what happens to that?
Meeting recording, transcription, and summary features store those files for the customer’s account; they are not described as session-only.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They reserve the right to investigate violations, fraud, and legal issues and to disclose related account data.
Are you profiled or tracked for advertising?
They use third-party cookies, Google Analytics, Facebook Pixel, and similar tools for ads and analytics, with cookie opt-outs.
Do they sell or share your data, and can you opt out?
Cookie tracking can be a CCPA sale or share; they also share with ad partners and AI vendors. Cookie Reject All and GPC are opt-outs.
What rights do they take over what you type and what the AI makes?
You keep ownership of Customer Data; they take a sublicensable license to host it and operate and improve the service.
How long do they keep your data after you delete it, and can you delete it in the app?
Account deletion can be requested and is usually immediate, but they keep personal data as long as they consider reasonably necessary.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe security steps and cite ISO/IEC 27001 certification and audits.
Is there a real age gate, and are teens protected?
The service is not for under-18s; you state you are 18 when you register. There is no extra age-check described.
Will they tell you when the rules change, and is the policy specific?
The privacy notice is dated, but they say they will post changes on the page and you should check back.
Can they close your account without warning, and can you get your data out first?
They may suspend or terminate an account at their sole discretion at any time with or without notice.
If something goes wrong, who pays?
Services are as-is with a low liability cap, and you must indemnify them for many third-party claims including AI use.
Do subscriptions renew on their own, and can you get a refund?
Paid plans auto-renew and fees are non-cancellable and non-refundable.
The privacy policy is 5,962 words at a college graduate level (Flesch reading ease 31.1); the terms are 8,873 words at a professional or legal expert level.
