Plain language first, the formal parts after. If anything here is unclear, ask us.
Last updated October 2, 2026
The hosted Bookly service (“Bookly”, “we”) is operated by Cloudeo Solutions, LLC, 2810 N Church St STE 90417, Wilmington, DE 19802, USA. You can reach us at support@bookly-app.io. This policy covers the hosted service only. If you self-host Bookly, you are the operator and this policy does not apply to your installation.
Hosts create a workspace and use Bookly to take bookings. Guests book time with a host. For guest data, the host is the controller and Bookly processes it on the host's behalf; for host account data, Bookly is the controller.
We do not sell personal data, show advertising, or use your content to train AI models. AI features send the relevant text (a contact's timeline, a transcript) to Anthropic to generate a briefing or recap; Anthropic processes it under their commercial terms and does not train on it.
Sub-processors that host or deliver the service: the hosting and database providers, the email, SMS and WhatsApp delivery providers, Daily.co for Bookly video and transcription (with Deepgram as its speech-to-text engine when a call is transcribed), Recall.ai for the notetaker that transcribes Google Meet, Teams and Zoom calls, Stripe for payments, Anthropic for AI features, and Sentry for error reports (with guest emails and phone numbers removed before anything is sent). Each is bound by a data-processing agreement; the full list with locations and purposes is in our data processing agreement. Data you choose to sync to Google, Microsoft, Zoom, HubSpot or Pipedrive is governed by their policies. We do not sell personal data and do not share it for advertising.
Calendar and conferencing accounts you connect. When a host connects Google, Microsoft or Zoom, Bookly asks only for the access it needs: to read free/busy time on the calendars the host ticks, to add, update and remove the calendar events and meeting links for bookings, and the account's email address to label the connection. Bookly stores the access tokens encrypted, keeps a cached view of busy times for one minute, and never reads the contents of other events, contacts or mail. The host can disconnect an account at any time from Admin → Calendars or Conferencing, which deletes the tokens; revoking access at the provider has the same effect. Bookly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
This section spells out, for the Google account a host connects, what Bookly receives, how it is used, with whom it is shared and how it is protected.
What we receive. The email address of the Google account, the list of the host's calendars, the free/busy times of the calendars the host ticks, and the details of the calendar events Bookly itself creates for bookings (title, time, attendees, Meet link). Bookly does not read the contents of other events, and never accesses Gmail, Contacts or Drive.
Signing in with Google. “Continue with Google” on the sign-in and sign-up pages is a separate, narrower use: Bookly receives only the name, email address and profile picture of the Google account, to create or recognise your Bookly account. It asks for no calendar access; connecting a calendar is a distinct step under Admin → Calendars with its own consent screen. The same applies to signing in with Microsoft or GitHub.
How we use it. Only to show a booking page with the host's real availability, to add, update and remove the calendar events and Meet links for bookings, and to label the connection in the admin. Google user data is not used for advertising, is not sold, and is not used to develop, improve or train generalised AI or machine-learning models. The optional AI briefings work from Bookly's own booking records, not from Google calendar data.
With whom we share, transfer or disclose it. Google user data is not shared with, transferred to or disclosed to any third party for that party's own use. It is processed only by the sub-processors that run Bookly on our behalf and under a data processing agreement: Vercel (application hosting), Neon (the database, where the encrypted tokens are stored) and Upstash (the job queue that schedules calendar updates). Event details that Bookly creates are visible to the host's workspace members, to the guest who booked, and to the other attendees of a group session, because they are the participants of that meeting. We disclose data to authorities only when the law requires it, and we tell the host unless we are legally barred from doing so. A change of ownership of the service would be announced in advance and the same policy would continue to apply.
How we protect it. Google access and refresh tokens are encrypted at rest with AES-256-GCM using a key that lives only in the server environment, never in the database or in logs. All traffic between your browser, Bookly, its sub-processors and Google uses TLS; the database and its backups are encrypted at rest by the provider. Access to production systems is limited to the people who operate the service, protected by multi-factor authentication, and every request Bookly makes to Google is scoped to the minimum permissions listed above. Error reports have personal data removed before they leave the server. The cached view of busy times is held for one minute and is never written to a log.
Retention and deletion. Tokens are deleted the moment a host disconnects the account in Admin → Calendars or Conferencing or deletes their workspace. If a host revokes Bookly's access in their Google account instead, the stored tokens stop working, the connection is marked as broken and the host is told, and the tokens are removed when the host disconnects or the workspace is deleted. The cached view of busy times expires after one minute. Calendar events Bookly created remain in the host's Google calendar, where the host controls them. Bookings and their event details follow the retention periods below.
You can access, correct, export or delete your data. Hosts do this from workspace settings. Guests can manage or cancel a booking from the link in their confirmation email, delete their transcript from the meeting page, and can email us for anything else. Where GDPR or similar laws apply, you also have the right to object, restrict processing, and complain to your supervisory authority. Guests should contact the host first, as the host controls their booking data; we will help either way.
Video calls. Audio and video on Bookly video are encrypted in transit. On a regular call Daily.co's media server relays them, decrypting to forward and, when transcription is on, to transcribe; nothing is recorded or stored by default and Bookly never receives the media. An event type marked end-to-end encrypted runs peer-to-peer: audio and video travel directly between the two browsers and are never transcribed. Rooms are private; people other than the host and the person who booked must be let in by the host. See the security page for details.
Recording and transcription. When a host turns on transcription for a call, you are told on the booking page (or asked to agree there), in the confirmation email and in the call itself. The audio is transcribed by Deepgram through Daily.co while the call runs; the transcript records the languages spoken. Transcripts are kept for the period the host sets, and you can delete yours from your booking page at any time. Meeting notes and recaps are generated with AI from the transcript and are marked as such wherever they are shown.
Emails from hosts. Proposals, payment requests and follow-ups from a host carry an unsubscribe link; using it stops those emails from that host. Booking confirmations and reminders are part of the booking you made and continue.
California and other US state laws. You have the right to know what we hold about you, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those laws define it, so there is nothing to opt out of. Requests go to support@bookly-app.io; we answer within 45 days.
We use a session cookie to keep you signed in and a preference cookie for your theme. No advertising or cross-site tracking cookies. Embedded booking widgets set no cookies on the embedding site.
Data is stored in the region shown on the security page. Where data leaves that region for a sub-processor, we rely on standard contractual clauses or an adequacy decision.
Accounts are for adults (18 or older). Booking pages are not directed at children and we do not knowingly collect data from anyone under 13, or under 16 where local law sets that age; tell us if you believe we have and we will delete it.
We will post changes here and, for material changes, email hosts at least 14 days before they take effect. The date at the top shows the current version.