How Heldrey uses your data.

Heldrey is built around a simple principle: calendar data is personal, and it should be used only for clear purposes that benefit the user.

This Privacy Policy explains what information Heldrey (“Heldrey,” “we,” “us,” or “our”) collects and processes, why we use it, when it may be shared, the choices available to you, and how you can contact us about your information.

This Policy applies to the Heldrey website, the Heldrey application, and related services and integrations.

If you have questions or privacy requests, contact us at [email protected].

1. Information We Process

The information we process depends on how you use Heldrey and which features and integrations you choose to enable.

Account and identity information

When you create or use a Heldrey account, we may receive or process information such as:

• your email address;
• your name or profile name;
• identifiers associated with your account or sign-in provider;
• your organization or Google Workspace domain, where applicable;
• account status, plan and preferences;
• Team membership and role information; and
• settings associated with your Heldrey account.

Heldrey currently uses Google for account authentication.

Google Calendar information

If you connect Google Calendar, Heldrey needs access to certain calendar information in order to provide calendar automation features.

Depending on the features you use, this may include:

• calendar identifiers, names and configuration;
• calendar timezone and related settings;
• event titles;
• event descriptions;
• event dates, times and duration;
• event locations;
• organizer information;
• attendee email addresses and RSVP status;
• whether an event is Busy or Free;
• event visibility, color and reminders;
• conference or meeting information;
• recurring-event information;
• Google Calendar event identifiers and synchronization metadata; and
• other calendar information necessary to evaluate and apply the rules or features you configure.

Heldrey may maintain limited copies or representations of calendar information where needed to synchronize calendars, evaluate rules, provide previews, explain actions, support undo functionality, troubleshoot problems and operate the service.

Heldrey does not currently request access to your Gmail mailbox or Google Contacts as part of the Heldrey Calendar product.

Rules, settings and information you provide

We process information you enter into Heldrey, such as:

• automation rules;
• work, home and other locations you configure;
• weekly schedules;
• calendar configuration;
• travel preferences;
• notification preferences;
• Team settings;
• imported rule configurations;
• billing-profile information you choose to provide;
• referral information;
• feedback and feature requests; and
• other settings or content you submit to the service.

Support and communications

If you contact us, we may process:

• your name and email address;
• the content of your message;
• information you provide about a problem;
• relevant account or diagnostic information; and
• our communications with you.

Technical and usage information

When you use Heldrey, we may process technical and operational information such as:

• IP address;
• browser and device information;
• session and authentication identifiers;
• timestamps;
• application and security logs;
• errors and diagnostic information;
• feature usage and product events;
• referral or attribution information; and
• information about interactions with our website or application.

We seek to avoid placing Calendar content such as event titles, descriptions or attendee information into general marketing and advertising analytics systems.

2. How We Use Information

We use information as reasonably necessary to operate Heldrey and provide the features you choose to use.

This includes using information to:

• create, authenticate and manage your account;
• connect to and synchronize with your calendars;
• evaluate and execute the rules you configure;
• create, update or remove calendar items when required by a feature or rule;
• provide previews, explanations, history and undo functionality;
• calculate travel time and process locations;
• provide notifications and service communications;
• operate Team functionality;
• provide customer support;
• identify and troubleshoot errors;
• protect Heldrey and our users from abuse, fraud and security threats;
• enforce service limits, eligibility rules and trial restrictions;
• maintain and improve the reliability, usability and performance of Heldrey;
• develop and improve Heldrey’s user-facing functionality;
• understand how the service is used;
• administer subscriptions and billing;
• comply with applicable legal obligations; and
• establish, exercise or defend legal claims.

Where permitted, we may also use aggregated or de-identified information for internal analytics, product planning, security and service improvement.

Heldrey’s core calendar automation system is designed to operate deterministically according to configured rules. We do not use Google Workspace data to train general-purpose artificial intelligence or machine-learning models.

3. Google Workspace and Google Calendar Data

Google Workspace data receives additional protections.

Heldrey’s use of information received from Google Workspace APIs will adhere to the applicable Google API Services User Data Policy and Google Workspace User Data and Developer Policy, including the Limited Use requirements. See the Google API Limited Use disclosure.

In particular:

• Google Workspace data is used to provide, operate or improve Heldrey’s appropriate user-facing functionality;
• Google Workspace data is not sold to data brokers or information resellers;
• Google Workspace data is not used for advertising, retargeting, personalized advertising or advertising profiles;
• Google Workspace data is not used to determine creditworthiness;
• Google Workspace data is not used to train or improve general-purpose AI or machine-learning models; and
• access to Google Workspace data is limited to what is reasonably necessary to provide and support Heldrey.

Human access to Google Workspace data

Heldrey personnel are not intended to routinely browse users’ calendar content.

If you request support and resolving your issue requires a person to view specific identifiable Google Workspace or calendar information, we may ask for your explicit permission before doing so.

Human access may also occur where permitted and reasonably necessary for security purposes, such as investigating abuse or a security incident, or where required by applicable law.

We seek to limit any such access to the information reasonably necessary for the purpose.

4. Improving Heldrey

We may use information processed through the service to maintain, troubleshoot and improve Heldrey and its user-facing features.

For example, we may use operational information to understand whether a rule executed correctly, identify failures, improve synchronization reliability or improve how a feature behaves.

Where Google Workspace information is involved, such use remains subject to Google’s Limited Use requirements described above.

We may also use aggregated or de-identified information to understand overall product performance and usage without needing to inspect individual users’ calendar content.

5. Travel and Location Features

If you use Heldrey features involving locations or travel time, relevant location information may be processed using mapping and routing services, including services provided by Google Maps Platform.

Depending on the operation, this may include location text, place information, coordinates, travel mode and routing information.

We use this information to provide location and travel-related functionality, not for advertising purposes.

6. AI Assistants and MCP Connections

Heldrey may allow you to connect compatible AI assistants, agents or other software through interfaces such as MCP.

This functionality is optional.

When you authorize an external assistant or application to access Heldrey, that assistant may receive information returned by the Heldrey tools and permissions you have authorized. Depending on the request, this could include rules, account configuration, calendar-related information, previews, activity or other information required to perform the requested operation.

Heldrey does not automatically provide an external AI assistant with unrestricted access to all of your calendar data.

Once information has been provided to an external service that you chose to connect, that service’s own privacy practices and terms may also apply.

Heldrey itself does not need to send your calendar to a general-purpose AI model in order for its deterministic rules to operate.

7. Analytics, Cookies and Advertising Technologies

We use cookies and similar technologies for purposes such as:

• authentication and maintaining sessions;
• security;
• remembering settings;
• referral attribution;
• understanding how our website and service are used;
• measuring product and website performance;
• measuring campaigns and conversions; and
• advertising and marketing.

Depending on the services enabled, these technologies may include services provided by companies such as Google and Meta.

Where applicable law requires consent for non-essential analytics or advertising technologies, we use them subject to the user’s consent choices.

You can change or withdraw your consent using the privacy or cookie controls we provide. Withdrawing consent does not affect processing that occurred lawfully before consent was withdrawn.

On this website, the footer control label depends on your region: Cookies Notice in Israel, Cookie Preferences in the EEA, Brazil, and other regions, and Do Not Sell My Info in the United States (including California). Optional tools currently listed: Google Analytics, Google Ads. Strictly necessary: Klaro, Cloudflare. Klaro remembers these choices for 180 days. Measurement and advertising tags run through Google Tag Manager and Google Consent Mode v2 when a container is configured.

Essential technologies required for authentication, security or operation of the service may operate without optional analytics or advertising consent where permitted by law.

Google Workspace data obtained through Google’s APIs is kept separate from advertising use as described in Section 3.

8. When We Share Information

We do not provide unrestricted access to your information.

We may share or make information available to third parties in the following circumstances.

Service providers

We use service providers to operate Heldrey. Depending on the service and features enabled, these may include providers of:

• cloud infrastructure and database hosting;
• network, security and content-delivery services;
• authentication and Google API services;
• mapping and routing services;
• transactional email delivery;
• analytics and measurement;
• advertising services where permitted and consented to;
• monitoring and operational infrastructure; and
• other technology necessary to operate Heldrey.

Our infrastructure and service providers may include companies such as Google and Google Cloud, Cloudflare, Resend, and Meta, depending on the functionality being used.

These providers process information for their respective purposes and subject to applicable contractual terms, privacy obligations and their own policies where relevant.

Services you connect

If you choose to connect Heldrey to another service, including an AI assistant or MCP client, information may be provided to that service as necessary to carry out your request.

Legal and security purposes

We may disclose information where we reasonably believe disclosure is necessary to:

• comply with applicable law or a valid legal process;
• protect the security or integrity of Heldrey;
• investigate fraud, abuse or security incidents;
• protect the rights or safety of Heldrey, our users or others; or
• establish, exercise or defend legal claims.

Business transactions

If Heldrey is involved in a merger, acquisition, financing, reorganization or sale of all or part of its business or assets, information may be transferred as part of that transaction, subject to applicable legal and contractual requirements.

Google Workspace data remains subject to applicable Google data-use restrictions.

9. Teams

If you use Heldrey through a Team, certain account-level information may be visible to Team administrators, such as your name, email address, membership status, role or whether your account has completed required setup.

Heldrey’s Team functionality is designed so that Team administrators do not automatically receive access to a member’s personal calendar events, individual rules, activity history or other private calendar content merely because they administer the Team.

Information that a user deliberately shares as Team content, such as shared templates, may be visible to the appropriate Team members.

10. Communications

We may send service-related communications such as:

• account and authentication messages;
• security notices;
• Team invitations;
• trial or subscription information;
• important product or service notices;
• notifications generated by features you enable; and
• responses to support requests.

Some service communications are necessary to operate your account and may not be optional.

Where we send optional promotional or marketing communications, we will provide appropriate choices to unsubscribe where required by applicable law.

11. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Policy.

The appropriate retention period depends on factors such as:

• whether your account remains active;
• whether the information is needed to provide a feature;
• synchronization and operational requirements;
• security and fraud-prevention needs;
• the need to maintain history or support undo and troubleshooting;
• applicable legal, accounting or contractual requirements; and
• the sensitivity and nature of the information.

Some information may therefore be retained for different periods.

A period shown to you in the product — for example, the period of activity history displayed in the interface — does not necessarily represent the complete technical retention period for every underlying record.

We seek to avoid retaining personal information longer than reasonably necessary for its purpose.

12. Account Deletion

You may request deletion of your Heldrey account and associated personal information by contacting [email protected].

We may ask you to verify your identity or provide information reasonably necessary to locate your account before processing the request.

We will process valid deletion requests in accordance with applicable law.

Account deletion does not necessarily mean that every piece of information disappears from every system immediately.

We may retain a limited amount of information where reasonably necessary and legally permitted for purposes such as:

• preventing fraud or abuse;
• enforcing service or trial eligibility restrictions;
• complying with legal obligations;
• maintaining security records;
• resolving disputes; or
• establishing or defending legal claims.

For example, we may retain the minimum account-identifying information reasonably necessary to determine that an introductory trial has previously been used, even after the associated account has otherwise been deleted.

Information may also remain temporarily in backups or other protected recovery systems until those copies are overwritten or removed through their normal lifecycle. Such information is not intended to be used for ordinary product purposes after a valid deletion request has been completed.

13. Disconnecting Google

Disconnecting Google from Heldrey and deleting your Heldrey account are different actions.

If you disconnect a Google connection, Heldrey stops future processing through that connection and removes the stored credentials used by Heldrey for that connection.

Disconnecting Heldrey does not delete events or other information from your Google Calendar merely because Heldrey previously interacted with them.

You may also manage or revoke Heldrey’s access through your Google Account.

Other information associated with your Heldrey account may remain until it is separately deleted or no longer needed under this Policy.

14. Security

We use technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration or disclosure.

Depending on the type of information and system involved, these measures include practices such as:

• encrypted network connections;
• protection of authentication credentials;
• encryption of stored Google OAuth credentials;
• hashing of certain session and authorization tokens;
• access controls;
• separation of application responsibilities;
• security and operational monitoring; and
• limiting access according to operational need.

No internet service or storage system can guarantee absolute security. We therefore continually evaluate and improve safeguards based on the nature of the service and the risks involved.

If you believe your Heldrey account or information may have been compromised, contact [email protected].

15. International Processing

Heldrey and its service providers may process information in countries other than the country where you live.

Different countries may have different privacy and data-protection laws.

Where applicable law requires additional safeguards for international transfers, we take steps designed to use appropriate legal mechanisms and protections available for those transfers.

16. Your Privacy Rights and Choices

Depending on where you live and the law that applies to you, you may have rights concerning your personal information, including rights to:

• request access to information about you;
• request correction of inaccurate information;
• request deletion;
• request restriction of certain processing;
• object to certain processing;
• request portability of certain information;
• withdraw consent where processing is based on consent; and
• submit a complaint to an applicable data-protection authority.

These rights are not absolute and may be subject to conditions or exceptions under applicable law.

To exercise a privacy right, contact [email protected].

We may need to verify your identity before fulfilling a request, particularly where responding to the request could expose account or calendar information.

You may also change many settings and preferences directly within Heldrey.

17. Information About People Who Are Not Heldrey Users

Calendar events may contain information about attendees, organizers or other people who are not Heldrey users.

Heldrey may process this information because it appears in a calendar connected by one of our users and is necessary to provide calendar functionality requested by that user.

For example, attendee or organizer information may be relevant to a rule that distinguishes internal from external meetings.

We do not use calendar participant information to add those people to marketing lists merely because they appeared in a user’s calendar.

If you believe Heldrey processes information about you through another user’s connected calendar and you have a privacy request, you may contact [email protected]. We may need to consider the rights and privacy of the Heldrey user and other people when responding.

18. Legal Bases Where Applicable

Where applicable data-protection law requires a legal basis for processing, our legal bases may include:

Providing the service or taking steps at your request. For example, creating your account, synchronizing your calendar and executing the functionality you configure.

Our legitimate interests. For example, securing and operating Heldrey, preventing abuse, troubleshooting problems, improving the product and administering our business, where those interests are not overridden by applicable privacy rights.

Consent. For example, where consent is required for optional analytics, advertising technologies or certain access to information.

Legal obligations. Where processing is necessary to comply with applicable law or valid legal requirements.

The appropriate legal basis depends on the particular processing activity and applicable law.

19. Children

Heldrey is intended for adults and professional use and is not intended for individuals under 18 years of age.

We do not knowingly seek to create accounts for children under 18.

If you believe a child has provided personal information to Heldrey, contact [email protected].

20. Changes to This Privacy Policy

We may update this Privacy Policy as Heldrey develops, our practices change or legal requirements evolve.

When we make material changes, we will update the effective date and, where appropriate, provide additional notice.

We encourage users to review this Policy periodically.

21. Contact

For privacy questions, requests, account-deletion requests or concerns about how Heldrey handles information, contact:

Heldrey
Email: [email protected]. Related: Trust, Terms, Google API Limited Use disclosure.