This agreement applies whenever Bookly processes personal data of your guests and contacts on your behalf. It forms part of the terms of service; no signature is needed. A signed copy is available on request.
Last updated September 23, 2026
The customer is the person or organisation that owns a workspace. The processor is Cloudeo Solutions, LLC, Cloudeo Solutions, LLC (“Bookly”). For the personal data of guests, contacts and meeting participants that the customer puts into Bookly or that arrives through bookings, the customer is the controller and Bookly the processor. For the customer's own account data Bookly is the controller, as described in the privacy policy.
Names, email addresses, phone numbers, company names, booking details, answers to booking questions, notes the customer writes, meeting transcripts and recaps where the customer has turned transcription on, payment status, and the metadata that goes with all of it. Data subjects are the customer's guests, contacts and anyone else on a transcribed call. Processing lasts as long as the workspace exists and up to 30 days afterwards for backups.
Bookly processes this data only to provide the service as documented, on the customer's instructions given through the product (creating event types, turning on integrations, sending emails, and so on), and as the law requires. Bookly will tell the customer if an instruction appears to break data-protection law.
Only named staff with a need can access customer data, under a duty of confidentiality, and every operator action on the hosted service is written to an audit log.
The measures on the security page apply: encryption in transit and at rest, encrypted integration tokens, scoped API keys, rate limiting, signed webhooks, daily backups kept for 30 days, and dependency audits in CI. The software is open source, so the customer can inspect exactly how data is handled.
The customer authorises the sub-processors below. Each is bound by a written agreement with obligations no weaker than this one. Bookly will publish changes to this list here at least 14 days before a new sub-processor handles customer data and email workspace owners; a customer who objects on reasonable grounds can end the service and export their data before the change.
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel | Application hosting and edge network | United States (global edge) |
| Neon | PostgreSQL database and backups | United States |
| Upstash | Job queue, rate limiting | United States |
| Resend | Transactional and host email delivery | United States |
| Daily.co | Bookly video calls and their transcription | United States |
| Recall.ai | Notetaker for Google Meet, Teams and Zoom calls | United States |
| Stripe | Subscriptions, paid bookings, payouts to hosts | United States |
| Anthropic | AI briefings, recaps and drafts (no training on your data) | United States |
| Sentry | Error reports (guest emails and phone numbers removed first) | United States |
Integrations the customer connects (Google, Microsoft, Zoom, HubSpot, Pipedrive) receive data under the customer's own agreements with those providers and are not sub-processors of Bookly.
Data is processed in the United States. For data subjects in the EU, UK or Switzerland, transfers rely on the EU Standard Contractual Clauses (module two, controller to processor) and the UK addendum, which are incorporated here by reference, or on an adequacy decision such as the EU-US Data Privacy Framework where a sub-processor is certified under it.
Bookly helps the customer answer data-subject requests: workspace export and deletion, per-contact editing and deletion, and transcript deletion are in the product, and guests can cancel bookings, unsubscribe from a host's emails and delete their transcript themselves. Requests that reach Bookly directly are forwarded to the customer without undue delay. Bookly will also help with data-protection impact assessments and consultations with a supervisory authority where the customer needs it.
Bookly will notify the customer without undue delay, and at most 72 hours after becoming aware of a breach affecting their data, by email to the workspace owners, with what is known about the nature of the breach, the data and people affected, the likely consequences and the measures taken.
The customer can export all workspace data at any time and delete the workspace from settings. On deletion Bookly removes the data and, within 30 days, the copies in backups, unless the law requires keeping some of it (billing records, for example).
Bookly will provide the information needed to show compliance with this agreement: this page, the security page, the public source code, and on request a summary of the sub-processors' own certifications. If that is not enough for a lawful audit request, the customer may audit once a year, on 30 days' notice, at reasonable times and cost.
If this agreement conflicts with the terms of service, this agreement wins for data-protection matters. Liability is governed by the terms. Questions: support@bookly-app.io.