Privacy Policy

Hosting

The website is hosted externally at Netlify, Inc., 2325 3rd Street, Suite 296, San Francisco, CA 94107 USA. The data processing takes place on the basis of Art. 6(1)(f) GDPR (legitimate interest in the secure provision of the online offering). The data transfer to the USA is based on EU Standard Contractual Clauses (SCCs).

Transport security: All connections to this website are made exclusively via TLS 1.2+ with AEAD ciphers (ChaCha20-Poly1305 / AES-GCM) and forward secrecy. HSTS preload is enabled (max-age 2 years). Technical and organisational measures of the Kalender-Sync app (encryption at rest, OAuth scopes, sub-processors) are documented under For IT admins.

Server log files

The provider automatically collects information in server log files (browser type, operating system, referrer URL, time, IP address). This data is processed on the basis of Art. 6(1)(f) GDPR for the technically error-free provision of the website and is not merged with other data sources.

Cookies & consent management (Klaro)

We use Klaro (self-hosted, open source) as our consent management tool. Klaro stores your cookie preferences in a cookie named klaro-v2. This cookie is technically necessary for storing your consent decision and falls under § 25(2) no. 2 TDDDG (strictly necessary). No data is transmitted to third parties. You can change your cookie settings at any time via the “Cookie settings” link in the footer.

Web analytics: Google Analytics 4

We use Google Analytics 4 (GA4) to analyse website usage. GA4 is activated only after your explicit consent (Basic Consent Mode — before your consent, no data whatsoever is sent to Google and no script is loaded).

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG.

Data collected: IP address (automatically anonymised by GA4), device and browser information, pages visited, time spent, referrer URL, interaction events, cookie identifiers (_ga, lifetime: up to 2 years).

Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. As sub-processor: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, USA.

Data transfer to the USA: On the basis of the adequacy decision of the EU Commission pursuant to Art. 45 GDPR (EU-US Data Privacy Framework). Google LLC is certified under the DPF.

Processing on behalf: Data processing terms with Google pursuant to Art. 28 GDPR are in place (accepted on 1 April 2026).

Retention period: Data retention in Google Analytics is set to 2 months. Google Signals is disabled. Personalised advertising is disabled.

Withdrawal: You can withdraw your consent at any time via the “Cookie settings” in the footer. The lawfulness of the processing carried out up to the withdrawal remains unaffected. In addition, you can use the Google Analytics Opt-Out Browser Add-On.

Marketing measurement: Microsoft Advertising (UET)

We use Universal Event Tracking (UET) from Microsoft Advertising to measure the effectiveness of our advertisements on Bing and in the Microsoft Audience Network. The UET tag is loaded only after your explicit consent (Consent Mode — before your consent, no data is transmitted to Microsoft and no script is loaded).

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG.

Data collected: IP address, device and browser information, pages visited, conversion events (e. g. signup, conclusion of contract), Microsoft click ID (msclkid) when an advertisement is clicked, cookie identifiers (_uetsid, _uetvid, MUID).

Recipients: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. EU representative: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Data transfer to the USA: On the basis of the adequacy decision of the EU Commission pursuant to Art. 45 GDPR (EU-US Data Privacy Framework). Microsoft Corporation is certified under the DPF.

Conversion measurement with enhanced accuracy (Enhanced Conversions): For conversion events (signup, start of the trial period, conclusion of contract) we transmit, in addition to the standard tracking data, a SHA-256 hashed form of your email address to Microsoft. The hash is computed entirely in your browser or on our server; your email address itself never leaves our server in plaintext form. Microsoft uses the hash in order to be able to attribute the advertising conversion to an ad delivery even when browser cookies do not permit this (e. g. Safari ITP, cross-device clicks). These transmissions take place exclusively if you have previously consented to marketing tracking.

Storage of the Microsoft click ID (msclkid): If you reach our site via a Microsoft advertisement (Bing), Microsoft appends the parameter msclkid to the URL. With your marketing consent, we store this identifier in your user account in order to be able to attribute later conversion events (in particular the conclusion of a contract) to the original advertisement. Storage follows the “first-touch” principle (only the first click counts) and only for the maximum conversion window duration of 90 days. Upon conclusion of a contract, we transmit the msclkid server-side to Microsoft. If you withdraw your consent or delete your account, the msclkid is deleted from our database; conversion data already transmitted to Microsoft cannot be recalled by us.

Cookie retention period: _uetsid 24 hours, _uetvid 16 months, MUID 13 months.

Withdrawal: You can withdraw your consent at any time via the “Cookie settings” in the footer. The lawfulness of the processing carried out up to the withdrawal remains unaffected. In addition, you can use the Microsoft advertising opt-out.

Marketing measurement: Google Ads

We use Google Ads conversion tracking to measure the effectiveness of our advertisements on Google properties (Google Search, Google Display Network, YouTube). The Google Ads tag is loaded only after your explicit consent (Consent Mode v2 — before your consent, no data is transmitted to Google and no script is loaded).

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG.

Data collected: IP address, device and browser information, pages visited, conversion events (e. g. signup, conclusion of contract), Google click identifiers (gclid for web ads, gbraid/wbraid for iOS app and web-to-iOS ads under Apple’s Restricted Data Processing), cookie identifiers (_gcl_au, _gcl_aw, _gcl_dc).

Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (controller for users in the EEA). Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (technical processing).

Data transfer to the USA: On the basis of the adequacy decision of the EU Commission pursuant to Art. 45 GDPR (EU-US Data Privacy Framework). Google LLC is certified under the DPF.

Conversion measurement with enhanced accuracy (Enhanced Conversions for Web): For conversion events (signup, start of the trial period) we transmit, in addition to the standard tracking data, a SHA-256 hashed form of your email address to Google. The hash is computed entirely in your browser; your email address itself never leaves our server in plaintext form. Google uses the hash in order to be able to attribute the advertising conversion to an ad delivery even when browser cookies do not permit this (e. g. Safari ITP, cross-device clicks). These transmissions take place exclusively if you have previously consented to marketing tracking.

Storage of the Google click identifiers (gclid/gbraid/wbraid): If you reach our site via a Google advertisement, Google appends one of the parameters gclid, gbraid or wbraid to the URL. With your marketing consent, we store this identifier in your user account in order to be able to attribute later conversion events (in particular the conclusion of a contract) to the original advertisement. Storage follows the “first-touch” principle (only the first click per identifier type counts) and only for the maximum conversion window duration of 90 days. If you withdraw your consent or delete your account, the stored identifiers are deleted from our database; conversion data already transmitted to Google cannot be recalled by us.

Cookie retention period: _gcl_au, _gcl_aw, _gcl_dc 90 days each.

Withdrawal: You can withdraw your consent at any time via the “Cookie settings” in the footer. The lawfulness of the processing carried out up to the withdrawal remains unaffected. In addition, you can adjust the Google ad settings.

Marketing measurement: Meta Pixel (Facebook/Instagram Ads)

We use the Meta Pixel to measure the effectiveness of our advertisements on the Meta platforms (Facebook, Instagram) as well as to build advertising audiences (e. g. addressing website visitors). The Meta Pixel is loaded only after your explicit consent — before your consent, no data is transmitted to Meta and no script is loaded.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG.

Data collected: IP address, device and browser information, pages visited, conversion events (e. g. signup, start of the trial period, conclusion of contract/purchase), Meta click ID (fbclid) when an advertisement is clicked, cookie identifiers (_fbp, _fbc).

Recipients: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (controller for users in the EEA). Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA (technical processing). For the collection and transmission of data via the Meta Pixel, a joint controllership agreement pursuant to Art. 26 GDPR (Controller Addendum) is in place with Meta.

Data transfer to the USA: On the basis of the adequacy decision of the EU Commission pursuant to Art. 45 GDPR (EU-US Data Privacy Framework). Meta Platforms, Inc. is certified under the DPF.

Conversion measurement with enhanced accuracy (Advanced Matching): For conversion events (signup, start of the trial period) we transmit, in addition to the standard tracking data, a SHA-256 hashed form of your email address to Meta. The hash is computed in your browser or on our server; your email address itself never leaves our server in plaintext form. Meta uses the hash in order to be able to attribute the advertising conversion to an ad delivery even when browser cookies do not permit this (e. g. Safari ITP, cross-device clicks). These transmissions take place exclusively if you have previously consented to marketing tracking.

Server-side conversion transmission (Conversions API): In addition to the browser-based Meta Pixel, we transmit certain conversion events — in particular the conclusion of a paid subscription (purchase) — directly from our server to Meta (Meta Conversions API). In doing so we transmit the event including the purchase value, a SHA-256 hashed form of your email address and the Meta click ID (fbclid/fbc) of your original ad click. This serves the more accurate attribution of advertising conversions when browser-side tracking (cookies) does not permit it. To avoid double counting, browser and server events are reconciled via a shared event ID (deduplication). This server-side transmission takes place exclusively if you have previously consented to marketing tracking; without consent the Meta click ID is not stored and no event is transmitted.

Cookie retention period: _fbp and _fbc 90 days each.

Withdrawal: You can withdraw your consent at any time via the “Cookie settings” in the footer. The lawfulness of the processing carried out up to the withdrawal remains unaffected. In addition, you can adjust your Meta ad settings.

Embedded videos: YouTube (enhanced privacy mode)

On our website we embed videos from the video portal YouTube. For this we use YouTube’s enhanced privacy mode (embedding via the domain youtube-nocookie.com). The embedding takes place only after you actively click the preview image and after your explicit consent. Before your consent, no YouTube script is loaded, no connection to YouTube servers is established and no cookies or local storage entries are set.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG.

Data collected (after consent and clicking play): IP address, device and browser information, date and time, where applicable the URL of the page accessed, information on video playback (position, duration). For logged-in YouTube users, YouTube may associate the information with the respective account. We ourselves do not receive any personal data from YouTube.

Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (controller for users in the EEA). Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (technical processing).

Data transfer to the USA: On the basis of the adequacy decision of the EU Commission pursuant to Art. 45 GDPR (EU-US Data Privacy Framework). Google LLC is certified under the DPF.

Retention period: Determined by YouTube/Google; we have no influence over this. For details, see Google’s privacy policy.

Withdrawal: You can withdraw your consent at any time via the “Cookie settings” in the footer. The lawfulness of the processing carried out up to the withdrawal remains unaffected. Further information can be found in the Google privacy policy.

Appointment booking: Cal.com (only after consent)

In the contact dialog on our website we offer the option to arrange a call directly via an embedded booking widget from Cal.com. The widget is loaded only after you actively click “Activate booking” and after your explicit consent. Before your consent, no Cal.com content is loaded, no connection to Cal.com servers is established and no cookies or local storage entries are set. Alternatively, you can reach us by email at any time without consent.

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG. For a concrete booking request, additionally Art. 6(1)(b) GDPR (pre-contractual measure).

Data collected (after consent): IP address, device and browser information as well as the data you provide in the booking form (name, email address, where applicable message and chosen time slot).

Recipients: Cal.com, Inc., 530 Divisadero St #225, San Francisco, CA 94117, USA.

Data transfer to the USA: The transfer takes place on the basis of EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR.

Withdrawal: You can withdraw your consent at any time via the “Cookie settings” in the footer. The lawfulness of the processing carried out up to the withdrawal remains unaffected. Further information can be found in the Cal.com privacy policy.

First-touch attribution (UTM parameters & referrer)

If you reach our site via a tagged marketing link (UTM parameters such as utm_source, utm_medium, utm_campaign, utm_term, utm_content) or via a referring website (document.referrer), we record this source information in order to be able to evaluate the effectiveness of our acquisition channels (search, newsletter, referrals).

Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG.

Data collected: Up to five UTM parameters from the landing page URL as well as the document.referrer value (address of the previously visited web page).

Processing on the landing page: At runtime, the parameters are held exclusively in the browser’s memory and inserted into internal page links (including pricing pages and language changes) and CTA links to the application (app.kalender-sync.de). No storage takes place in cookies, localStorage or sessionStorage on the landing page (TDDDG-compliant).

Processing in the application: After the redirect, the application stores the values temporarily for a maximum of 24 hours in sessionStorage, until you have registered and consented to marketing tracking. Only after your consent are the values stored server-side in your user account, following the “first-touch” principle and for a maximum of 90 days. Without consent, no permanent storage takes place.

Recipients: No transmission to third parties. The data remains in our database (PostgreSQL, hosted at Hetzner, Nuremberg, Germany) and serves exclusively our internal evaluation.

Retention period: 90 days from first contact; thereafter the values are overwritten or updated upon a new first contact. Upon withdrawal of marketing consent or deletion of the user account, the values are deleted immediately.

Withdrawal: You can withdraw your marketing consent at any time via the “Cookie settings” in the footer or via your settings in the application. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

Campaign source at registration

If you reach our website via one of our advertisements or via a link with a channel marker published by us (for example in the descriptions on our YouTube channel), we pass on, when you switch to the application, an indication of which platform or which channel you came from. If you subsequently create an account, this indication is stored in your user account. It serves us exclusively to recognise which of our advertising and marketing activities actually lead to registrations.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an economical use of our advertising budget). Unlike the click identifiers described above, no consent is required for this, because it is a coarse indication of the platform or channel and not an identifier by which individual clicks or persons could be recognised, and because no transmission to third parties takes place. § 25 TDDDG does not apply to the collection, because no information is stored on or read from your device in the process.

Data collected: Exactly one of twelve possible values — google_ads, ms_ads, meta_ads, youtube, mcp_registry, uwait, smithery, mcp_so, clawhub, product_hunt, claude_directory or chatgpt_directory. The spelling producthunt used by Product Hunt is converted to product_hunt before storage. Other deviating values are discarded and not stored.

Directory entries: The last two values mentioned do not arise via a link on this website, but when you connect our service directly from the directory of an AI assistant (Claude or ChatGPT). In this case you reach the application without passing through this website; the value is derived there server-side from the pending connection request. It names only the directory, not your person, your account with the respective provider or the specific installation.

Processing on the landing page: At runtime, the value is held exclusively in the browser’s memory and inserted into internal page links (including pricing pages and language changes) and CTA links to the application (app.kalender-sync.de). No storage takes place in cookies, localStorage or sessionStorage.

Processing in the application: The value is taken from the address accessed and held in memory until registration is complete — unlike with the UTM parameters, no intermediate storage in sessionStorage takes place. If you sign in via a sign-in service from Google or Microsoft, the value is carried along during the redirect to that service for a maximum of ten minutes in the encrypted, technically necessary sign-in cookie, since the redirect back cannot otherwise establish any reference to the starting point. After the sign-in is complete, this cookie is deleted.

Point in time of storage: The indication is set exclusively at the moment of account creation and is not changed thereafter (“first-touch”). If you later reach us again via an advertisement, the original value remains unchanged. Without account creation, no storage takes place.

Recipients: No transmission to third parties. The value remains in our database (PostgreSQL, hosted at Hetzner, Nuremberg, Germany) and serves exclusively our internal evaluation.

Retention period: For the duration of the existence of your user account. When your account is deleted, the indication is deleted along with it.

Right to object: As the processing is based on a legitimate interest, you can object to it at any time under Art. 21 GDPR (see section 5). An informal message to support@kalender-sync.de is sufficient; we will then remove the indication from your account.

Reach measurement on ad landing pages

On our landing page variants that are reachable only via advertisements, as well as on pages that are opened via an advertisement or via a link with a channel marker published by us (ref parameter in the address), we count server-side how many visits and how many distinct visitors per day arrive via the respective channel, and how often the buttons for connecting with Claude or ChatGPT are clicked there. For this, the page requests an invisible counting pixel of our application (app.kalender-sync.de). The count serves exclusively to assess the effectiveness of our advertising and marketing channels.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in an economical use of our advertising budget). § 25 TDDDG does not apply, because no information is stored on or read from your device in the process — in particular, no cookies are set.

Data processed: The channel value of the page visited (one of the values listed in the preceding section), for a click on one of these buttons additionally the destination (claude or chatgpt), as well as — exclusively transiently, to avoid double counting — your IP address and browser identifier. From both, a day-scoped check value is formed using a server-side secret key; the IP address and browser identifier themselves are not stored. Without this key, the check value allows no inference about your person and, due to its day scope, is also not linkable across several days.

Retention period: The check values are deleted automatically after 48 hours at the latest. Only aggregated daily totals (visits, clicks and unique visitors per advertising platform) without any personal reference are stored permanently.

Recipients: No transmission to third parties. The processing takes place on our servers (Hetzner, Nuremberg, Germany).

Right to object: As the processing is based on a legitimate interest, you can object to it at any time under Art. 21 GDPR (see section 5).

Previous newsletter signups

This website no longer accepts new newsletter signups. Existing consent and unsubscribe choices remain unaffected. Previous website signups used Brevo (Sendinblue SAS, France, EU) with double opt-in. You can withdraw existing consent at any time using the unsubscribe link in an email or by contacting support@kalender-sync.de.

Contacting us by email

If you contact us by email, your details are processed in order to handle the request (Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR). The data is deleted as soon as the purpose ceases to apply, provided that no statutory retention obligations exist.

3.1 Which data is processed?

• Email address — for signing in via a one-time login code and for account management
• OAuth tokens — stored encrypted (ChaCha20-Poly1305), in order to access your calendars at Google and Microsoft
• CalDAV credentials — stored encrypted (ChaCha20-Poly1305), for Apple iCloud, GMX, WEB.DE and KSuite calendars
• iCal feed URLs — for retrieving external calendar feeds (read only)
• Payment data — is processed exclusively by Stripe; we do not store any credit card or bank details. We store only the Stripe customer ID and subscription ID.
• Calendar metadata — name and colour of your calendars
• Event ID mappings — exclusively IDs for mapping synchronised appointments; content of events from your connected calendars is not stored
• Subscribe calendars (optional) — calendar details and events that you publish as an organiser through the Publisher API, stored encrypted (see section 3.12)
• Event colour settings (optional, per sync) — whether event colours are kept and which colours you renamed for the target calendar, and for each synchronised appointment the name and colour of the Outlook category that Kalender-Sync set. This lets us replace only our own category when a colour changes and leave your other categories untouched (see section 3.11).
• Browser identifier (user agent) per session — the user agent transmitted by your browser is assigned to the respective login session, in order to be able to manage sessions and distinguish device types (Art. 6(1)(f) GDPR); the storage is bound to the session (max. 30 days, deleted immediately upon account deletion)

3.2 What is NOT stored?

• No event content (title, description, location, attachments) from your connected calendars; the only exception are events you publish yourself as a subscribe calendar (section 3.12)
• No attendee emails (protection of third parties’ personal data)
• Analytics cookies (Google Analytics) only after explicit consent; no advertising cookies
• No IP addresses beyond the duration necessary to establish the connection

3.3 Purpose and legal basis

• Art. 6(1) sentence 1 (a) GDPR (consent) — Upon your first login you consent to the processing of your data as described here.
• Art. 6(1) sentence 1 (b) GDPR (performance of a contract) — The processing is necessary in order to provide the calendar synchronisation service.
• Art. 6(1) sentence 1 (f) GDPR (legitimate interests) — To ensure the security and stability of the service.

3.4 Cookies and local storage

The following table lists all cookies and localStorage entries that are used on our website and in our application. localStorage, just like cookies, falls under § 25 TDDDG.

The Google Analytics cookies (_ga, _gid) are set only after your explicit consent. Without consent, no analytics cookies whatsoever are set and no script is loaded. For details see section 2 “Web analytics: Google Analytics 4”.

Connecting AI assistants: flow diagnostics and variant comparison

Only with your consent to “Sign-in statistics (Kalender Sync)” under “Analytics” do we compare sign-in pages when connecting an AI assistant and collect additional flow diagnostics. Without this consent, you do not participate in the comparison; sign-in remains fully available. Existing technical connection logs remain separate. These include timestamps, requesting client family (such as Claude or ChatGPT), displayed authentication variant, first form interaction without field contents, authentication method, acceptance for sending or failure category of an email code, authentication outcome, approval, attempted return to the assistant and token exchange. We distinguish only narrow and wide layouts, without storing the exact screen size. After successful authentication, the flow may be linked internally to the user account and the granted access; we also evaluate subsequent successful tool calls. Passwords, email codes, token values, form entries and calendar contents are not stored in this log.

The data stays on our existing infrastructure and is not shared with advertising or analytics services. It is deleted after no more than 90 days; linked records are also deleted with the user account. Attribution uses the existing OAuth flow cookie (__Host-oauth_flow, httpOnly, Secure, SameSite=Lax), which lasts 24 hours. During this period, repeated connection attempts in the same browser retain the authentication variant. No additional experiment cookie is set. The legal basis for the optional comparison and additional measurement is your consent under Article 6(1)(a) GDPR and, for the corresponding cookie use, Section 25(1) TDDDG. You can withdraw consent at any time in “Cookie settings”, with effect for the future. Additional measurement then stops and identifiable withdrawn flows are excluded from the comparison report. Withdrawal does not affect the lawfulness of processing before withdrawal.

3.5 Email communication and marketing

From 13 October 2026, we use Customer.io (Peaberry Software Inc., USA) for customer service emails, usage-based onboarding and trial messages, review requests and newsletters. We use its EU data region. Login codes and other authentication emails, account deletion confirmations, invitations to people without an account and acknowledgements of enquiries continue to use Lettermint (Lettermint B.V., Netherlands, EU). Necessary account emails remain available through Lettermint for recipients who have not yet been migrated. Active delivery through Brevo (Sendinblue SAS, France, EU), new contact updates and the SMTP fallback have been disabled. Individually agreed advance-notice and objection periods are observed before migration.

Customer.io processes your email address, a technical profile identifier, language, email preferences and consent or withdrawal records, plus the account, plan, trial and usage information needed for the particular message. This can include setup status, successful use and a credit limit being reached. Message content, send times and delivery, error or complaint status are also processed. Calendar contents, attendee data, calendar credentials, OAuth tokens and free-text input to the AI assistant are not transferred for this purpose. Our application selects messages based on usage status.

Necessary account and service messages support performance of the contract (Art. 6(1)(b) GDPR); legally required notices rely on Art. 6(1)(c) GDPR. Where permitted, usage guidance relies on our legitimate interest in helping customers set up and use the service (Art. 6(1)(f) GDPR). Newsletters and advertising requiring consent are sent only with your consent (Art. 6(1)(a) GDPR). Existing consent, unsubscribe choices and delivery blocks are preserved. You can opt out of optional emails using the unsubscribe option in a message or by contacting support@kalender-sync.de; your statutory rights to object remain unaffected.

We do not use open-tracking pixels in these Customer.io emails. For identified action links in optional messages, our own redirect links may record the visit, time and associated message to evaluate communication. A click does not prove a purchase or a review, and automated visits can affect these metrics. Privacy, legal notice and unsubscribe links, and the notice about this provider change, are excluded from click measurement.

We have a data processing agreement with Customer.io under Art. 28 GDPR. The EU data region includes storage of profile data in the EU; it does not exclude access or further processing outside the EU by the US provider and its subprocessors. Required third-country transfers are covered by the EU Standard Contractual Clauses agreed in the contract under Art. 46 GDPR. Information about these safeguards is available from support@kalender-sync.de and in the Customer.io data processing agreement.

Communication profiles are retained only as long as required for the relevant customer relationship or newsletter subscription. When that purpose ends or a valid erasure request is received, the relevant data is deleted. Necessary consent, withdrawal and delivery records and minimal suppression markers may be retained separately where needed to fulfil legal obligations, defend claims or prevent further unwanted contact. These records can remain after deletion of the sending profile. Retention depends on the respective purpose and applicable obligations; you can request access or erasure from us.

To account for earlier opt-outs and existing identities when someone registers again, our application stores minimal pseudonymised comparison markers derived from the email address using a keyed hash (HMAC). When an address changes or an account is deleted, the affected address is temporarily queued until successful local conversion, then replaced by the comparison marker. Unresolved cases remain blocked and are flagged for review. These markers do not authorise sending; we review their continued necessity at least annually.

Personal delivery and click details in our own application are removed after 90 days through a daily cleanup. Consent and withdrawal evidence is retained while in use, then until 1 January after the third following calendar year. For example, evidence whose use ends on 12 October 2026 becomes due for deletion on 1 January 2030. Unresolved errors, erasure requests and necessary suppression markers are handled separately; new consent does not extend earlier evidence periods. Copies held by delivery providers follow their separate retention and erasure procedures. Our local deadlines do not mean identical automatic deletion by the provider.

Until Brevo retirement is complete, existing contacts, consent, suppression and delivery records remain there. Previous contact attributes include email address, registration time, setup status, connected calendar providers and number of active sharings. Existing data is reconciled before migration; changing providers does not reverse an unsubscribe choice. Website newsletter signups are described separately in section 2.

3.6 Payment processing (Stripe)

For the processing of payments we use Stripe. Our contracting party is Stripe Payments Europe Ltd. (Dublin, Ireland); data is also transferred to Stripe, Inc. (510 Townsend Street, San Francisco, CA 94103, USA). If you take out a paid subscription, you are redirected to a checkout page hosted by Stripe. Stripe processes your payment data (e.g. credit card number, IBAN) directly — we have no access to this data and do not store it.

We store only the customer ID and subscription ID assigned by Stripe, in order to be able to associate your subscription with your account.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Data transfer to the USA (to Stripe, Inc.): On the basis of EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR as well as the EU-US Data Privacy Framework pursuant to Art. 45 GDPR. Stripe is certified under the DPF.

Stripe privacy information: stripe.com/privacy

3.7 Retention period

• Account data and OAuth tokens: until the account is deleted by the user
• Event ID mappings: until the associated sharing is ended
• Subscribe calendars and their events: until the organiser deletes them or their account (details in section 3.12)
• Sessions: 30 days, then deleted automatically
• General server logs: a maximum of 30 days
• OAuth flow diagnostics and variant comparison: a maximum of 90 days

Storage beyond the stated period takes place only in the event of an (imminent) legal dispute or if statutory retention obligations exist (e.g. § 257 HGB, § 147 AO — the German Commercial Code and Fiscal Code).

3.8 Data security

• OAuth tokens and CalDAV credentials are stored encrypted with ChaCha20-Poly1305 (authenticated encryption)
• All connections are TLS-encrypted (HTTPS)
• Event content from connected calendars is processed exclusively in memory and is not persisted; events of subscribe calendars are stored encrypted (ChaCha20-Poly1305)
• Attendee emails are as a matter of principle not processed or passed on

3.9 Use of Google API data (Google API Services User Data Policy)

Kalender-Sync uses Google API services in order to access your Google calendars. The use of the data received from Google is subject to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing, transfer and disclosure:

• Google user data is not sold and not passed on to advertisers, data brokers or other third parties.
• Within the synchronisation function, the transfer of calendar data takes place exclusively between the calendar accounts you have connected yourself. Any transfer beyond that takes place only if you yourself connect an AI assistant and release it per calendar (see section 3.10); it then takes place on your explicit instruction to a tool chosen by you.
• Google user data is not used by us to train or improve generalised AI/ML models and is not passed on for that purpose.

Limited Use:

• Google user data is used exclusively to provide the calendar synchronisation as well as — insofar as you explicitly release it — to answer queries from the AI assistant you have connected (see section 3.10).
• Event content (title, description, location, attendees) is processed in memory only and is not stored permanently.
• Google user data is not used by us for advertising and not for training generalised AI/ML models. Provision to an AI assistant takes place solely upon your release and serves to answer your own queries, not model training.
• Only the Google API permissions required for the synchronisation are requested.

3.10 AI assistant connection (optional)

You can optionally connect an AI assistant (e. g. Claude by Anthropic or ChatGPT by OpenAI) with your calendars. The feature is disabled by default and comes into being exclusively through your explicit release.

In doing so, you connect your own account with the respective AI provider to Kalender-Sync and determine, per calendar, which information the assistant may read (only your busy times, title and time, or all details) and whether it may create events. If your assistant makes a query at your request, Kalender-Sync reads the calendars you have released and transmits the released availability to the provider of the assistant you have chosen. This transfer takes place on your instruction to a tool chosen by you yourself; for the further processing by the AI provider, that provider’s own terms and privacy policy apply, over which we have no influence once the data has arrived there.

Depending on the provider, this may mean a transfer to a third country (e. g. the USA). The basis and safeguards for this transfer lie in your relationship with the respective AI provider (their standard contractual clauses, certifications or similar). Some providers, in particular on free or private plans, process data in the USA and/or use inputs under their own terms to improve their models. Please review the terms of your assistant before you release sensitive calendars.

Not transmitted are the attendees, attachments and links of your events; at the “busy only” level, no titles either. We log each query exclusively as metadata (time, calendar concerned, type of query, result) — never the content of your events. The retention of this log is 0, 7 or 90 days depending on the plan. If you ask your assistant to send us feedback (e. g. about a missing feature), we store your message as well as — only if you explicitly agree to this — the permission to reply to you about it once (Art. 6(1)(b) and (f) GDPR); both are deleted with your account.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you grant through the release and can withdraw at any time — individually or for all connections at once — under “AI assistant” in Kalender-Sync. An unused connection additionally expires automatically after 90 days. Removing the connector at the provider only severs the connection there; what governs is the withdrawal in Kalender-Sync.

For an OpenClaw connection using an access key, we store your selection as a fixed client label. This attributes the connection and already logged tool calls to the selected assistant. The attribution contains no prompts or calendar contents and is not sent to OpenClaw or ClawHub.

Note for persons bound by professional secrecy: If your calendars contain information subject to a professional duty of confidentiality (e. g. § 203 StGB, the German Criminal Code), please assess on your own responsibility whether and to what extent a release to an AI provider is compatible with it.

3.11 Event colours (optional)

If you turn on “Keep event colors” for a sync, we transfer an appointment’s colour together with its name to the target calendar: as a colour (label) for Google, as a category for Microsoft Outlook, and as the event’s colour property for CalDAV calendars. To do so we read the colour or category list of the source and target calendar and create missing colours or categories in the target calendar with a matching colour. To show you in the app which colours your source calendars use, we evaluate only the colours and how often they occur; this is not stored. Alternatively you can give each source calendar a fixed colour, which then carries the calendar’s name. For sharings with other people, you as the sender decide whether colours and their names are transferred to the other person’s calendar; the other person is told so in the invitation.

If Microsoft requires an additional permission for this (MailboxSettings.ReadWrite), we request it only for this feature and only for the mailbox concerned. We do not read or change any other mailbox settings (e.g. automatic replies, time zone, language), even though the permission technically covers them. You can revoke the permission at any time in your Microsoft account; the sync then continues without colours.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). No new sub-processor is involved.

3.12 Subscribe calendars (Publisher API)

With subscribe calendars, organisers (e.g. clubs or course providers) publish events that other people subscribe to in their calendar app. The organiser writes the events through our interface (Publisher API); we provide a calendar feed (feeds.kalender-sync.de), a subscribe page and an embeddable button for it.

Organiser data. We store the calendar details (name, description, time zone, website, language, brand colour, organiser details including an optional contact email), logo and banner, and the events with their content (title, description, location, link, times, recurrence). We store the event content encrypted (ChaCha20-Poly1305). Unlike connected calendars, these events are meant to be published: they appear in the feed and, unless the organiser turns it off, on the subscribe page. Of API keys we store only a hash and the first characters for recognition. Idempotency receipts for API requests (a checksum of the request and the response) are valid for 24 hours; after that we remove them on the next request with the same key, at the latest when the key is deleted. The organiser is responsible for the event content; we process it on their behalf (section 8). The legal basis is Art. 6(1)(b) GDPR.

Visitors of the subscribe page and subscribers. The subscribe page and button set no cookies, use no analytics or advertising services and load content only from our own domain. When someone clicks “Subscribe”, we create a feed address of its own for that subscription and store only the chosen calendar app and the time of the first and last fetch. We do not store the IP address, the browser identifier or any other personal details for this. The organiser only sees aggregated numbers, such as the number of active subscribers per calendar app. Whether someone has already subscribed is remembered only by their own browser (local storage), not by our server. Section 3.7 applies to server log data when the pages are accessed. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the subscribed calendar and counting subscribers without personal reference).

Deletion. Organisers delete events themselves through the interface. If an organiser deletes a calendar, we remove its events immediately; the feed then returns an empty calendar for 30 days so subscribers see the events disappear. Deleting the account deletes all subscribe calendars, events, images and subscription entries.

Calendar providers you connect yourself

The following providers are not our processors. You connect your own account there to Kalender Sync and thereby grant us access to your calendars. The contractual relationship exists between you and the respective provider, whose privacy terms continue to apply. We access those calendars solely with the credentials you granted us, and only to the extent you released. You can disconnect at any time in your account.

Right to object (Art. 21 GDPR)

If the data processing takes place on the basis of Art. 6(1)(f) GDPR, you have the right at any time to object, on grounds relating to your particular situation, to the processing of your personal data. If your personal data is processed for the purposes of direct marketing, you have the right to object to the processing at any time.