New version LockMyCal 1.23.0 is officially out. See what's new
LockMyCal

Privacy Policy

Information about personal data processing and privacy protection at LockMyCal in compliance with GDPR

Last updated: September 27, 2026

Protecting your privacy and the security of your calendar data is the highest priority for LockMyCal. This Privacy Policy (the "Policy") describes how we collect, process, protect and handle the personal data of the users of our cloud application and the visitors of our website in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

1. Data Controller

The controller of personal data within the meaning of the GDPR is the operator of the LockMyCal platform (the "Controller" or "we").

2. What Personal Data We Process

We process only the personal data necessary for the proper operation of the Service, subscription management and security protection:

  1. Account owner (User) data:

    • First and last name
    • Email address
    • Billing details (company name, company ID, VAT ID, billing address)
    • Records of the selected subscription plan and payment history (tokenized Stripe transaction ID; we do not store payment card numbers)
    • Login credentials in securely hashed form
    • Phone and company (optional profile fields)
    • When signing in with a Google, Microsoft or GitHub account (where offered): name, email and the account identifier at that provider

  2. Calendar and synchronization data:

    • Access credentials for connected calendars and video services (OAuth tokens, app passwords, server addresses), stored encrypted – e.g. Google, Microsoft 365 / Exchange, Apple iCloud, CalDAV, Zoom
    • Availability information (free vs. busy time slots)
    • Titles and times of created meetings and events

  3. End-client data (booking participants):

    • First name, last name and email address entered when making a booking
    • Phone number and answers to additional booking form questions (if the User requires them)
    • If the User enables the Contacts feature: the client's name, email, phone and company, meeting history and the User's internal note

  4. Technical and operational data:

    • IP address, browser and operating system type
    • Security audit log: sign-ins and sign-in attempts (including the email address entered), password changes, administrator actions and payment events, with IP address and time
Purpose of processing Data categories Legal basis under the GDPR
Providing the Service and managing the account Name, email, password, settings Performance of a contract (Art. 6(1)(b))
Handling bookings and calendar synchronization Calendar slots, meeting data, client contacts Performance of a contract (Art. 6(1)(b))
Payment processing and subscription billing Billing details, payment history Performance of a contract and legal obligation (Art. 6(1)(b) and (c))
System security and abuse prevention IP addresses, security audit log Legitimate interest (Art. 6(1)(f))
Sending transactional notifications Email, meeting details Performance of a contract (Art. 6(1)(b))
Sending product news (Newsletter) Email address Consent (Art. 6(1)(a))

4. Protection of Calendar Data and Third-Party Integrations

When connecting external calendars, we apply strict privacy principles:

  • Data minimization: We access only the data necessary to determine free times and to write scheduled meetings.
  • Google API Services User Data Policy: Our use of information received from Google APIs fully complies with the Google API Services User Data Policy, including the Limited Use requirements.
  • No sale or misuse of data: We never sell or rent your calendar data or your clients' contacts to third parties, and we do not use them to train general AI models.

5. Recipients of Personal Data (Processors)

To run the cloud infrastructure, we rely on vetted partners that meet strict GDPR security standards:

  • Server infrastructure providers: Data centers within the European Union with ISO 27001 certification.
  • Payment gateway: Stripe Payments Europe, Ltd. (PCI-DSS Level 1 certified).
  • Security and bot protection: Cloudflare, Inc. (Cloudflare Turnstile protection).
  • Email delivery: Secure SMTP / transactional mail servers.
  • Web analytics: Umami – without cookies and without personal identifiers.
  • Integrations chosen by the User (e.g. Google, Microsoft, Zoom, Stripe Connect): data is passed to them only to the extent of the connection the User sets up themselves.

6. Data Retention

  1. Active accounts: We keep personal data for as long as your User account and subscription exist.
  2. Accounting records: Invoices and tax documents are archived for 10 years from the end of the tax period in accordance with VAT and accounting law.
  3. Security logs: Operational and access records are automatically deleted after 90 days.
  4. After account deletion: You can delete your account yourself at any time in Profile settings → Danger zone. Upcoming meetings are cancelled and their participants are notified; all personal and calendar data is then irreversibly removed from production systems in the background, within 30 days at the latest.

7. Technical and Organizational Security

  • Encryption: All communication runs over secure HTTPS with modern TLS 1.3 encryption. Sensitive data in databases is encrypted at rest (encryption at rest).
  • Access control: Employees and contractors access data solely on the principle of least privilege (least privilege).

8. Your Rights Under the GDPR

As a data subject, you have the following rights under applicable law:

  • Right of access: You can ask which of your data we process and obtain a copy.
  • Right to rectification: You can ask for inaccurate or incomplete data to be corrected.
  • Right to erasure ("right to be forgotten"): You can ask for your data to be deleted when the reason for processing it no longer applies, or delete your account yourself in Profile settings.
  • Right to restriction of processing: In cases set out by law, you can ask for the handling of your data to be temporarily restricted.
  • Right to data portability: You have the right to receive your calendar data in a structured, commonly used format (iCal).
  • Right to object: You can object to processing based on legitimate interest.
  • Right to lodge a complaint: If you believe that we handle your data in breach of the law, you have the right to lodge a complaint with the supervisory authority:
    • Office for Personal Data Protection (ÚOOÚ)
    • Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, Web: www.uoou.gov.cz

9. Cookies and Local Storage

The LockMyCal platform uses only strictly necessary technical and security cookies required for signing the user in, keeping the session and protecting against attacks. We do not use any invasive third-party advertising or tracking cookies. We measure traffic with Umami, which does not use cookies.

10. Final Provisions and Contact

If you have any questions, wish to exercise your rights or have any uncertainty about the processing of personal data, please contact us: