Cal.com: A clearer privacy policy
Hey there,
We've rewritten the Cal.com privacy policy. It takes effect on 20 August 2026, and you can read it now at cal.com/privacy.
Two things worth saying up front: we haven't changed what we do with your data, and we still don't sell it. What changed is that the old policy was written in 2023 and had drifted. It left out vendors that handle your data today, and was vague about the ones it did name. We went through the codebase and fixed both.
What's new
- Every subprocessor is now named, with the actual data it receives. The list lives in our new trust center at trust.cal.com, so it stays current instead of going stale inside a legal document, and the policy points you there. No more categories-only hand-waving. The full list is below in this email too.
- AI features are described precisely. AI meeting notes send the transcript text to OpenAI and nothing else: no meeting titles, no attendee lists, no links. Cal.ai phone agents send the phone number and the guest details needed to place the call, via Retell AI. Our in-product AI assistants use Anthropic. All of it is off unless you turn it on, and none of it trains anyone's models.
- Advertising and lead-identification tools are now separated out. Google Ads, Meta, LinkedIn, retention.com and RB2B run on our marketing site and marketing lists, not on your account. They never see booking data or attendee answers, and they don't run on EEA or UK visitors.
- Your integrations are clearly separated from our subprocessors. When you connect Google Calendar, a CRM, or a webhook, that's your instruction and your data flow, and we've stopped mixing that up with vendors we chose.
- We added the controller/processor split, our legal bases, and concrete retention periods. Useful if you're doing a vendor review or a DPIA.
The full subprocessor list
This is the list as it stands today, and trust.cal.com is where it is maintained from here on. Each company has a data-processing agreement with us, only receives what it needs, and only processes data on our instructions. None of them is new: they are all processing data for us today, and the change is that we now name them all.
And on our marketing site only, never on your account data: Google Analytics and Tag Manager, Vercel Analytics, Dub, X (Twitter) Ads, Google Ads, Meta, LinkedIn, retention.com and RB2B.
Apps you connect yourself, such as Google Calendar, Outlook, Zoom, a CRM or a webhook, are not subprocessors of ours. Data reaches them because you asked it to, and you can disconnect them at any time.
Do you need to do anything?
No. No action is required, and nothing about your account or your data changes on 20 August 2026.
If your organization keeps a subprocessor list for compliance, this is a good moment to refresh it against trust.cal.com, which is now the authoritative list. The trust center also holds our ISO 27001 and SOC 2 reports and our penetration test, if your reviewers want them. Our DPA is unchanged and available at go.cal.com/dpa.
Questions or objections
Reply to this email, or write to privacy@cal.com. If your organization has a DPA with us, you have 30 days from the date of this email to object to any of the new subprocessors on reasonable data protection grounds. We'll look for an alternative with you; if there isn't one and you can't reasonably use the affected part of the service without that vendor, you can terminate that part and we'll refund any prepaid unused fees for it. Your rights under your DPA are unaffected.
Thanks for trusting us with your scheduling.
The Cal.com team
You're receiving this because you have a Cal.com account. This is a legal notice about your account data and privacy rights.
Unsubscribe From This List | Manage Email Preferences