Privacy Policy

CalenDeus is a self-hosted WordPress plugin. It runs entirely on your own WordPress installation. We do not operate any central server that stores booking data from our customers' websites. Appointment data entered by your visitors stays on your server.

When you visit or use this website (calendeus.com), we may collect:

• Technical data: like any website, our hosting provider receives your IP address, browser type and the pages you request in server logs. We use this only to operate and secure the site. We do not use analytics or advertising trackers.
• Contact and support messages: if you contact us or open a support ticket, we collect your name, email address and the content of your message, and use them to respond to you.
• Purchase information: when you buy a Pro licence, payment is processed by Stripe. We store your email address, the order record (amount, currency, tax, Stripe order references, receipt link) and the licence key issued to you, so we can deliver the licence, provide downloads and handle support or refunds. We never see or store your payment card details.
• Account sign-in: signing in to your account is passwordless. We store your email address and a short-lived, single-use sign-in token, and we set a signed session cookie in your browser once you are signed in.
• Licence activations: if you install the Pro plugin, we store the site URL it is activated on, the plugin version it reports, and the time it last checked in.
• Newsletter: only if you opt in (at checkout or from your account page), we store that choice and use your email address to send product news. Every newsletter email has a one-click unsubscribe link, and you can turn it off at any time from your account.

• To perform our contract with you: processing your order, issuing and validating your licence, providing downloads, updates, your account and support.
• To meet legal obligations: keeping invoices and order records for tax and accounting.
• For our legitimate interests: keeping the site and licence system secure, preventing fraud and abuse (for example spam-protection on forms and rate-limiting), and answering enquiries.
• With your consent: sending the newsletter. You can withdraw consent at any time.

We do not sell your personal data and we do not use it for automated decision-making or profiling.

When your website visitors use the booking form, the following information may be stored in your WordPress database:

• First name, last name
• Email address
• Gender: shown and required on the default form; it can be hidden or made optional with the Pro form builder
• Appointment date and time
• The service booked, its price, and the booking status
• Booking notes, and any custom fields you add with the Pro form builder
• Consent: a yes/no flag recorded with the booking's submission timestamp. The consent checkbox is always shown and always required.
• Phone number: shown and optional on the default form; it can be made required or hidden with the Pro form builder

You are the data controller for this information, and we never receive it. As a WordPress site operator, you are responsible for informing your visitors about the data you collect, your legal basis for processing it, and providing mechanisms to exercise their rights (access, deletion, portability) under applicable privacy laws such as GDPR.

We share personal data only with providers that help us run this service, and only as much as they need:

• Stripe (payments, tax calculation): on the Stripe-hosted checkout page, Stripe collects your email address, billing address, any VAT/tax ID you provide and your payment details. Card details never touch our servers. See the Stripe Privacy Policy.
• Hostinger (website hosting and database).
• Resend or our SMTP mail provider (sign-in links, licence and order emails, support replies, newsletter).
• Cloudflare Turnstile (spam protection on the contact form): it processes technical browser signals and your IP address to tell humans from bots. See the Cloudflare Privacy Policy.

Some of these providers may process data outside the European Economic Area (for example in the United States). Where they do, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Licence Validation & Updates (Pro plugin)

The Pro plugin talks to calendeus.com to keep your licence and your copy of the plugin up to date. When it activates, deactivates, re-checks a licence, or looks for an update, it sends us your licence key, the URL of the site it is installed on, and the plugin version. We use this only to confirm the licence is valid, enforce the one-site-per-licence limit, and serve the correct update package. No booking data, customer data, or WordPress content is ever sent to us.

Update Checks (free plugin)

The free plugin checks calendeus.com for updates about twice a day. Each check sends the URL of the site and the installed plugin version, and our server necessarily sees the site's IP address. No licence key is involved, and no booking data, customer data or WordPress content is sent. We use this only to tell the site whether an update is available.

Google Calendar API

If you (as a site owner) connect Google Calendar, the plugin talks directly from your server to Google's API using credentials you provide. We never see this data. Google's handling of it is governed by the Google Privacy Policy. CalenDeus asks for the narrowest access it needs:

• https://www.googleapis.com/auth/calendar.events: create, update and delete the booking events it syncs, and read events on the calendar you choose so it can block conflicting time slots
• https://www.googleapis.com/auth/calendar.events.freebusy: see when you are busy

It cannot create, delete or share calendars, or change calendar settings.

CalDAV Providers

If you configure CalDAV sync (Outlook, iCloud, Nextcloud, etc.), CalenDeus communicates with the URL you provide using the credentials you supply. We have no visibility into this connection.

This website sets only strictly necessary cookies: a signed session cookie that keeps you signed in to your account (it expires after 30 days or when you sign out). Cloudflare Turnstile may use similar technologies on the contact form for bot protection. We do not use analytics, advertising or remarketing cookies, so no cookie consent banner is needed.

The CalenDeus plugin itself does not set cookies on your visitors' browsers.

• Support enquiries and tickets: up to 24 months after the conversation ends, then deleted.
• Purchase and order records: as long as your licence exists and for up to 7 years after that, as required for accounting and tax purposes.
• Account and licence activation data: for as long as your account exists. You can remove a site activation yourself from your account at any time.
• Sign-in tokens: short-lived and single-use.
• Newsletter preference: until you unsubscribe.
• Server logs: kept by our hosting provider for a limited period, typically no longer than a few weeks.

For data stored on your WordPress installation, retention is at your discretion and subject to your own privacy policy obligations.

Under the GDPR and similar laws, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten"). We may need to keep order records we are legally required to retain.
• Object to or restrict certain processing
• Data portability
• Withdraw consent (for example to the newsletter) at any time, without affecting earlier processing

To exercise any of these rights, contact us via our support page. We will respond within one month.

You also have the right to lodge a complaint with a data protection supervisory authority. In Cyprus, that is the Commissioner for Personal Data Protection. You can also contact the authority in the EU country where you live.

We take reasonable technical and organisational measures to protect information we hold. However, no internet transmission is completely secure. We recommend that you also ensure your WordPress installation is kept up to date and secured appropriately.

CalenDeus and this website are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page, and for material changes we will notify customers by email.

The data controller is:

• Fooderloo Ltd, trading as Ace and Zeros
• Registered in the Republic of Cyprus, company number HE 409280
• VAT number: CY10409280Z
• Registered address: Milou 14, Geri, 2202 Nicosia, Cyprus
• Email: support@calendeus.com

If you have questions or concerns about this Privacy Policy or how we handle data, email us or reach out via our support page. See also our Terms of Service and Refund Policy.