Privacy policy

This policy explains what personal data Margin Solutions Ltd collects when you visit https://calidiary.com, create a CaliDiary account, start a free trial, buy a plan or a service, use CaliDiary Pro, or contact us. It explains why we collect it, who we share it with, how long we keep it and the rights you have. It applies wherever you are in the world.

The short version. Your bookings, and your customers' details, stay on your own website. They never reach us, so we cannot see them, share them or sell them. We hold only what we need to run your CaliDiary account, your licence, your purchases and your support requests. We do not sell personal data, and we use analytics or advertising cookies only if you allow them.

1. Who we are

CaliDiary is a product of Margin Solutions Ltd, a company registered in Scotland (company number SC744893). Registered office: Suite 3.10, 16 Robertson Street, Glasgow G2 8DS, United Kingdom.

For the personal data described in this policy, we are the controller: we decide why and how it is used. Contact us about anything in this policy at [email protected], or by post at our registered office.

2. Data we never receive: your bookings

CaliDiary is a WordPress plugin that runs on your website. Bookings, your customers' names and contact details, their answers to your booking forms, uploaded files and photos, appointment notes, invoices and payment records are stored in your own WordPress database and files. They are not sent to us, and we cannot see them.

• The free CaliDiary plugin contacts no outside service. It sends nothing to us or anyone else.
• CaliDiary Pro contacts our servers only to check your licence and to deliver updates, and only after you enter a licence key (see section 4). It never sends bookings or customer details.
• Payments your customers make to you go to your own Stripe, PayPal or Mollie account. We are not involved and receive nothing.
• Services you connect (such as payment providers, calendars, video meetings or text-message providers) are connected with your own accounts, under your own agreements with them.

For your customers' data, you (the business) are the controller, and you are responsible for telling your customers how you use it. CaliDiary adds suggested wording to WordPress's privacy policy guide (Settings, then Privacy) to help you. Our data processing page explains who is responsible for what, including the rare cases where we might see some of that data while helping you.

3. What we collect, and why

We use the email address of your account for the service emails above. We send marketing emails (set-up tips and product news) only if you ticked the box asking for them, which is never ticked for you. You can stop them at any time in your account's email preferences or by emailing us.

We do not sell your personal data, we share it for advertising only if you allow marketing cookies (see section 10), and we do not make decisions about you by automated means that have legal or similarly significant effects.

If you do not give us the details we ask for to create an account or buy a plan, we cannot provide that account or plan. The free plugin never needs an account.

4. What CaliDiary Pro sends to us

Once you enter a licence key, CaliDiary Pro contacts https://calidiary.com to activate, check and remove the licence (once a day, and when you press "Check now") and to look for and download updates (WordPress does this regularly). Each request contains only:

• the licence key;
• your website's address;
• the versions of CaliDiary Pro, WordPress and PHP.

As with any request on the internet, we also receive your web server's IP address, and WordPress includes your website's address in the request's header. We use this only to provide licences and updates, keep a record of activations, and stop misuse (such as one key shared across many websites). Each licence answer is valid for 7 days, so a short outage on our side never affects your website.

Links in the plugin to our website (such as "Start free trial", "Get help" or "See plans") are ordinary links: nothing is sent until you click one, and they carry only the name of the plugin screen you came from, so we know which links are useful. If you switch on the optional "Powered by CaliDiary" link (it is off unless you turn it on), it is an ordinary link to our website and carries nothing about your customers.

5. Payments for CaliDiary plans and services

Payments are processed by Stripe. For plans, we use Stripe Managed Payments: the seller of record for the payment is Stripe's company Onelink, LLC, which collects the payment and works out, charges and pays any VAT or sales tax. Your bank statement and receipts show the sale as made through Onelink (Link).

• You enter your card and billing details on Stripe's own secure pages. We never see or store your full card number.
• Stripe and Onelink use your payment details, billing address and tax details as independent controllers, under their own privacy policies: Stripe privacy policy and Link privacy policy.
• Stripe tells us what we need to switch on and manage what you bought (see "Purchases" in section 3).

6. Who we share data with

We do not sell personal data. We share it only with providers who help us run CaliDiary, under contracts that require them to protect it and use it only to provide their service to us:

We may also share personal data:

• with our professional advisers, such as accountants and lawyers, who are bound to keep it confidential;
• when the law requires it, or to protect our rights, our customers or others (for example, to prevent fraud);
• if we sell or reorganise our business, with the buyer or new owner, who must keep to this policy.

We will update the list above before we start using a new provider that handles your personal data.

7. International transfers

We are based in the United Kingdom and serve customers worldwide. Some of the providers above store or access personal data outside the UK and the European Economic Area (EEA), including in the United States and India. Where the law of the UK or the EEA does not already treat a country as giving adequate protection, we protect the transfer with one of the safeguards the law provides:

• the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework), for US providers certified under it;
• the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses;
• the European Commission's Standard Contractual Clauses, for data protected by EU law.

You can ask us for more information about the safeguard used for any provider at [email protected].

8. How long we keep it

9. Your rights

Under UK and EU data protection law you have the right to:

• access the personal data we hold about you and get a copy;
• have it corrected if it is wrong or incomplete (you can change your name and email in your account at any time);
• have it deleted, where we no longer need it or you withdraw your consent;
• restrict how we use it, or object to our using it on the basis of legitimate interests;
• object at any time to direct marketing, which we will then stop;
• receive the data you gave us in a portable, machine-readable format;
• withdraw your consent at any time, without affecting what we did before.

To use any of these rights, email [email protected] from the email address of your account, or tell us how we can confirm who you are. It is free. We reply within one month, and tell you if we need more time (up to two more months for complex requests). If you live in a US state or another country with its own privacy law, you have the rights that law gives you, and we handle every request in the same way, wherever you are.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the UK Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113), or to the data protection authority where you live or work.

10. Cookies

We always use the cookies our website needs to work and stay secure. Analytics and advertising (marketing) cookies are used only if you allow them, and you can change your choice at any time with "Cookie settings" at the bottom of every page. Our cookie policy lists each cookie and each analytics or advertising tool we use (if any), and explains how to choose.

11. Security

• Passwords are stored only as a one-way hash, and two-step sign-in with an authenticator app is available for every account (and required for our staff).
• Data is encrypted in transit (HTTPS). Licence keys and staff sign-in secrets are also encrypted in our database, and every licence answer and update is digitally signed, so your website can check it really came from us.
• Only staff who need it can see your data, each with the least access their role needs, and every staff change to an account or licence is recorded in a log that no one can edit or delete.
• Forms and sign-in are protected against automated abuse with rate limits and, on the sign-up, contact and live chat forms, Google reCAPTCHA.

If a personal data breach puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.

12. Children

CaliDiary is a service for businesses. You must be 18 or over to create an account, and we do not knowingly collect data about children. If you believe a child has given us personal data, please contact us and we will delete it.

13. Changes to this policy

We review this policy when our services change. The date at the top shows when it was last updated. We will email account holders about important changes before they take effect.