Privacy Policy

When you create a CalendTree account, we collect:

• Name, email address, and phone number
• Profile photo (optional)
• Business name, branding assets, and timezone
• Your sign-in method — email/password, Sign in with Apple, or Sign in with Google

If you sign in with Apple or Google, we receive the identity token needed to authenticate you and, where the verified email matches an existing account, to link that sign-in method to your account so you keep access to your data across providers. We do not receive or store your Apple or Google password.

CalendTree stores the business data you enter, including:

• Client and organization records (names, contact details, notes, custom fields)
• Bookings and appointments
• Invoices, quotes, proposals, and contracts (including e-signatures)
• Payment records and transaction history (amounts, timestamps, and tokenized references — never raw card numbers, see 1(e))
• Expenses and receipt images, including data extracted via receipt scanning
• To-do items, projects, and time-tracking sessions
• Questionnaire configurations and the responses your clients submit
• Records about Workers/contractors you invite to your account, including information needed for 1099 preparation
• Business settings, preferences, and uploaded booking-page images

This data is stored in a secure, encrypted database and is associated with your account.

If you enable automatic mileage tracking, CalendTree collects your device's GPS location — including in the background, while the app is not open — to detect and log business drives. We use on-device motion data alongside location to distinguish driving from walking or biking. Trip records are synced to our servers as part of your business data. You can deny or revoke location access at any time in your device Settings; mileage tracking will not function without it, but the rest of the app will.

If you enable Face ID or Touch ID sign-in, authentication happens entirely on your device using Apple's LocalAuthentication framework. CalendTree never receives, transmits, or stores your biometric data — it only unlocks a session already stored securely in your device's Keychain.

CalendTree integrates with Square for both your own subscription billing (direct/web) and payments you collect from your clients (invoices, payment links, and Apple Tap to Pay). When you connect Square, we store your Square OAuth tokens to facilitate those payments on your behalf, into your own Square merchant account.

We do not store, process, or transmit raw credit card numbers. Card data collected through Apple Tap to Pay is encrypted at the point of tap using Apple's Secure Element and Square's certified infrastructure — CalendTree only ever sees the transaction amount, timestamp, and a tokenized reference. All card processing is handled directly by Square under their PCI DSS Level 1 certified infrastructure.

If you subscribe via Apple In-App Purchase instead, Apple handles that billing directly and shares only purchase/entitlement receipts with us.

If you choose to use the optional Health Insurance or Tax Help referral forms in the app's "Life" section, we forward the name, contact details, and limited demographic/eligibility information you submit to an independent, licensed third-party insurance broker or tax professional so they can contact you. We do not collect medical history, diagnoses, conditions, or medications through these forms. This data is handled separately from your core business data and shared only with the specific partner you're routed to. The in-app consent screen for these features governs if anything here is inconsistent with it.

If you connect Apple Health, we read your logged sleep hours to power an optional wellness feature. This data stays on your device and is never uploaded to our servers.

If you connect your Google account, we access — with your explicit permission — your Google Calendar events to populate booking and scheduling features.

CalendTree's use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not transfer it to third parties except as necessary to provide the service, and do not allow humans to read your Google data unless you explicitly request support, it is necessary for security, or required by law.

If you connect Zoom, we store your Zoom OAuth credentials to allow you to attach Zoom meeting links to bookings. We do not record, access, or store Zoom meeting content.

CalendTree may request the following device permissions. Each is optional (except where core functionality depends on it) and can be denied or revoked at any time in your device Settings:

• Location (When in Use / Always) — mileage tracking; approximate location for weather
• Motion & Fitness — driving vs. walking/biking detection for mileage accuracy
• Calendar — sync bookings with Apple Calendar
• Contacts — import contacts as clients (optional)
• Camera — profile photos, branding images, receipt scans
• Photo Library — select branding or receipt images
• Microphone — voice commands for the in-app AI assistant
• Face ID — biometric app unlock (on-device only, see 1(d))
• Apple Health — sleep hours for an optional wellness feature (on-device only, see 1(g))
• Notifications — booking, invoice/payment, and business alerts

We automatically collect limited technical information to operate the service:

• Device type, operating system, and app version
• Pages visited within the app and feature usage patterns (processed locally for personalization, synced only to our own servers — see Section 8)
• Approximate geography of visitors to your booking pages (IP addresses are processed transiently to derive approximate location and may appear briefly in standard infrastructure logs)
• Push notification device tokens
• Error logs and crash reports (used for debugging only)

If you contact our support team, we retain your email address and message content to respond to and resolve your inquiry.

If you apply to or participate in the CalendTree partner program, we collect your name, business name, and contact information, along with referral attribution details. When an account is created through a partner referral, we track which partner the account is attributed to so we can administer the program.

We work with trusted third-party providers to operate CalendTree. These providers are contractually obligated to protect your data and may only use it to perform services on our behalf:

• Cloud infrastructure provider (AWS) — secure hosting, database, authentication, and file storage
• Google — calendar and authentication integrations (per your authorization)
• Square — your subscription billing and payments you collect from clients (per your authorization)
• Apple — Sign in with Apple, In-App Purchase billing, push notifications, WeatherKit, MapKit, Tap to Pay (per your authorization/device settings)
• Zoom — video meeting links (per your authorization)
• Email delivery providers — for sending invoices, contracts, and booking emails to your clients
• Independent insurance brokers / tax professionals — only if you submit a Health Insurance or Tax Help referral form, and only the information on that form

When you send an invoice, contract, quote, proposal, or booking confirmation through CalendTree, your client's name, email, and the relevant document are transmitted to them. You control what you send and to whom.

We may disclose information if required by law, subpoena, or government request, or if we believe disclosure is necessary to protect the rights, property, or safety of CalendTree, our users, or the public.

If CalendTree is acquired, merged, or undergoes a change in ownership, your data may be transferred as part of that transaction. We will notify you via email or prominent notice on our platform before your data becomes subject to a different privacy policy.

You may download a structured copy of your records at any time from Settings → Privacy & Data → Download My Data; uploaded files (such as receipts and contracts) are listed in the export and can be retrieved in the app.

You may update or correct your account information at any time from your profile settings.

You may permanently delete your account and all associated data from Settings → Privacy & Data → Delete Account. Deletion is irreversible. We will purge your data within 30 days.

You may disconnect Google, Square, or Zoom at any time from Settings → Integrations. Disconnecting revokes our access to those services going forward.

California residents have the right to know what personal information we collect, the right to correct inaccurate personal information, the right to delete personal information, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising any of these rights. We do not sell or share personal information as defined by the CCPA. The only sensitive personal information we use is precise location, and it is used only to provide the mileage tracking you enable.

To exercise your rights, contact us at Legal@CalendTree.com. We verify requests using the email address associated with your account, and an authorized agent may submit a request on your behalf with your written permission. Because we do not sell or share personal information, opt-out preference signals such as Global Privacy Control do not change how we process your data.

If you are located in the European Economic Area, you have the right to access, rectify, port, and erase your data, as well as the right to restrict or object to certain processing. Our legal bases for processing are: performance of our contract with you (to provide the core service); your consent (for optional integrations, location, and health-related referrals); our legitimate interests (security, fraud prevention, and improving the service); and compliance with legal obligations. You may withdraw consent at any time, and you may lodge a complaint with your local supervisory authority. Contact us at Legal@CalendTree.com to exercise these rights.

For End Client data stored in a CalendTree user's account, that business decides how the data is used — CalendTree processes it on the business's behalf as a service provider. End Clients should direct privacy requests to the business they worked with; we assist businesses in honoring those requests.