Effective date: February 28, 2026 · Last updated: March 16, 2026
Multical ("we", "our", or "us") operates the Multical calendar synchronization service, available at usemultical.com. If you have questions about this policy, see Section 12.
When you create an account we collect:
If you sign in with Google or Microsoft, we receive your name and email from that provider instead of collecting a password. We record which provider you used.
When you connect a calendar (Google Calendar, Microsoft 365, or Apple Calendar via CalDAV), we store:
To know when to block time across your calendars, we store a minimal record for each event:
| Field | What it is | Stored? |
|---|---|---|
| Start / end time | When the event occurs | Yes |
| All-day flag | Whether the event spans a full day | Yes |
| Busy / free status | Whether the slot should be considered occupied | Yes |
| Event status | Confirmed, tentative, or cancelled | Yes |
| Provider event ID | Reference used to update or remove the event | Yes |
| Title / description | The event's subject and body | No (see Section 4) |
| Location / video link | Meeting location or conference URL | No (see Section 4) |
| Attendees | Other participants | No (see Section 4)* |
* Applies to synced calendar events only. Attendee data collected through Multical booking pages is stored separately — see Booking page attendee data below.
If you book a meeting through a Multical booking page, we collect and store the following information about you as the attendee:
This data is retained for as long as the booking record exists. Cancellation of a booking does not automatically delete the record; it updates the booking status. If you wish to have your booking data deleted, contact us at privacy@usemultical.com.
Your email address is also sent to the meeting host's calendar or video conferencing provider (Google Calendar or Microsoft 365, or Zoom, depending on which they use) as part of the calendar invitation. This is what allows the invite to appear in your calendar. See Section 5 for links to Google's, Microsoft's, and Zoom's privacy policies.
Payments are handled entirely by Stripe. We store only the identifiers Stripe gives us: your Stripe customer ID, subscription ID, plan tier, subscription status, and expiry date. We never see or store your full card number, CVC, or bank details.
We record the timestamp at which you accepted our Terms of Service and this Privacy Policy, whether you opted in to marketing emails, and when that choice was made.
For security and fraud prevention we maintain an audit log that records:
This log is used to investigate abuse and is not sold or shared with advertisers.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Provide the sync service | Account info, calendar tokens, event metadata | Contract performance |
| Allow direct event management via Portfolio View (create, update, delete events across your calendars) | Calendar tokens, event data you enter | Contract performance |
| Send transactional emails (welcome, password reset, payment notifications, booking notifications) | Email address, name | Contract performance |
| Process payments and manage subscriptions | Email, Stripe IDs, subscription status | Contract performance |
| Detect and prevent abuse or fraud | IP address, user-agent, audit log | Legitimate interests |
| Comply with legal obligations | Audit log, consent records | Legal obligation |
| Send marketing emails (only if you opted in) | Email address, name | Consent |
| Understand how visitors use our marketing site (aggregate analytics via Umami) | Anonymised page-view data. No personal data collected | Legitimate interests |
| Measure ad conversions and acquire new customers via Google Search Ads | Conversion events (anonymised); no existing-user data shared | Legitimate interests |
| Operate the Multical affiliate program | Referral code stored in our own database when you sign up via a referral link; no data is shared with third parties | Legitimate interests |
We do not sell your personal data. Analytics data collected via Umami contains no personal data and is never used to profile individuals. Google Ads is used solely to reach prospective new users — we do not share existing Multical user data with Google for advertising purposes.
We do not store your calendar event titles, descriptions, locations, video conference links, or attendee lists.
When a sync runs, we fetch event content from your calendar provider's API in memory, use it only to determine timing and busy/free status, and then immediately discard it. Nothing about what your meetings are called or who is in them is ever written to our database.
When you create a "title only" or "busy block" sync rule, the blocking event we create on your other calendar uses a generic title you define, never the original event title.
Portfolio View: When you create, update, or delete events directly via the Portfolio View, the event data you enter (title, time, etc.) is sent to your calendar provider's API to perform the action. This data is not stored separately in our database beyond the same minimal event metadata described above.
We integrate with the following services. Each has its own privacy policy.
calendar.events and userinfo.email scopes to read and write
calendar events on your behalf.
When a booking is confirmed through a Multical booking page, the attendee's name and
email address are also sent to Google as a calendar event attendee so that the
invitation appears in their calendar.
Google Privacy Policy.
Calendars.ReadWrite, User.Read, and offline_access
scopes.
When a booking is confirmed through a Multical booking page, the attendee's name and
email address are also sent to Microsoft as a calendar event attendee so that the
invitation appears in their calendar.
Microsoft Privacy Statement.
Access tokens for Google and Microsoft are encrypted (AES-256-GCM) before being stored. You can revoke Multical's access at any time through your Google or Microsoft account settings, or by disconnecting the calendar inside Multical.
When a booking is confirmed through a Multical booking page and the Zoom integration is used to create a video conferencing link, attendee name and meeting time are shared with Zoom Inc. to create the meeting. Zoom Privacy Policy.
All payment processing is handled by Stripe. When you subscribe, you interact with Stripe's secure checkout directly. We receive subscription status webhooks from Stripe but never receive your full card details. Stripe Privacy Policy.
Transactional emails (welcome, password reset, billing alerts, booking notifications) are delivered via Mailtrap. Your email address and the content of those emails pass through Mailtrap's infrastructure. Mailtrap Privacy Policy.
We use Umami to understand how visitors use our marketing pages. Umami is a privacy-first, open-source analytics platform. It does not use cookies, does not collect any personally identifiable information, and does not track you across websites. We see only aggregate data such as page views, referrer sources, browser type, and country — nothing that identifies you as an individual. Umami Privacy Policy.
Multical operates a self-hosted affiliate program. When you arrive via an affiliate
referral link (e.g. ?ref=code), a first-party cookie named
ref_code is stored in your browser for up to 60 days. If you create
a Multical account during that period, the referral code is saved to your account
record in our own database. No referral data is sent to any third party.
We run Google Search Ads to reach prospective new users. When you click one of our ads and visit our site, Google's conversion tracking measures whether you completed a signup. This may involve Google setting a cookie on your browser for attribution purposes. We do not use Google Ads to retarget existing Multical users, and we do not share any Multical account data with Google for advertising.
You can opt out of Google's ad personalization at adssettings.google.com. Google Privacy Policy.
We retain your data for as long as your account is active. Specifically:
When you delete your account, we cascade-delete your calendar credentials, event records, sync rules, notification preferences, and audit logs from our database. We also cancel any active Stripe subscription and deregister all calendar webhooks with Google and Microsoft so they stop sending us notifications.
We apply the following technical safeguards:
No system is perfectly secure. If you discover a vulnerability, please contact us at the address in Section 12.
Depending on where you live, you may have some or all of the following rights. EU/EEA/UK residents have these rights under the GDPR or UK GDPR. California residents have similar rights under the CCPA.
Request a copy of the personal data we hold about you.
Export your data in a machine-readable format from your account settings.
Correct inaccurate data via your account settings or by contacting us.
Delete your account and all associated data from your account settings.
Ask us to restrict processing of your data in certain circumstances.
Object to processing based on legitimate interests, including marketing.
You can export your data or permanently delete your account directly from your account settings page. No need to contact us first. For other requests, or if you have trouble with the self-service tools, email us at privacy@usemultical.com.
We will respond to verifiable requests within 30 days. We may ask you to confirm your identity before acting on a request.
If you are an EU/EEA resident and believe we are not handling your data lawfully, you have the right to lodge a complaint with your local data protection authority.
If you opted in to marketing emails, you can withdraw consent at any time by using the unsubscribe link in any marketing email, or by updating your notification preferences in your account settings.
Multical is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us so we can delete it.
When we make material changes to this policy we will notify you by email at least 14 days before the changes take effect, and we will update the "Last updated" date at the top of this page. Continued use of Multical after the effective date constitutes acceptance of the revised policy.
For privacy-related questions or to exercise your rights: