CalPay back to home CA EN ES

Privacy policy

Last updated: 3 October 2026.

CalPay is booking and payment software developed by Sicena (David Portabella, Manresa, Catalonia, Spain). Contact: info@sicena.com.

This policy explains two different relationships, because the data we process isn't the same in each case:

• The professional who uses CalPay to offer their available hours.
• The person booking an appointment with that professional.

If you're the professional

To show your free hours and place appointments on it, CalPay needs access to your calendar. With your explicit permission, and only with the calendar.freebusy and calendar.events permissions, it does exactly two things:

• Checks when you're busy on the calendars you've indicated. Only the busy time slots are requested, never the title, attendees, or content of your appointments.
• Creates the event for a confirmed booking on the calendar you've indicated, invites whoever made it, and requests a video call room.

CalPay does not read or modify any other calendar, your email, your contacts, or your files, and it doesn't ask for any permission to do so.

Limited use of Google data. CalPay's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: your calendar data is used solely to provide you the booking service; it is not sold, not transferred to third parties, not used for advertising, and not read by any person, unless you expressly authorize it to resolve an issue, the law requires it, or it's essential for security reasons.

The authorisation token Google gives us is stored encrypted (AES-256-GCM) in the professional's database, with a key that is not kept inside the database, and is used only to refresh access. You can withdraw it at any time from your Google account settings or from CalPay's admin page; from that moment CalPay stops accessing the calendar and stops offering times. If you want your whole installation deleted, write to us and it is done.

If you've booked an appointment

To manage the booking, this data is processed: your name, your email, the chosen time, the payment status and, if there is one, the message you wrote. If someone else pays for the appointment, also their email; if it's a gift, the name and email of whoever receives it.

The legal basis is performance of a contract: without this data, the appointment can't be made or remembered. The emails that are sent (confirmation, video call link, reminders, cancellation) are part of the service, not commercial communications.

Card numbers never pass through CalPay. Payment is handled directly by Stripe, which acts as the payment services provider and issues the receipt. We only receive whether the payment succeeded, the amount and, if you provided it, the tax ID for invoicing.

Where the data lives and for how long

Bookings are stored in a database file belonging to the professional serving you, hosted on our own server in the European Union. There is no third-party analytics service, no tracking cookies, and no advertising profiles. The visit count we keep uses no cookies and identifies no one.

Bookings are kept for as long as necessary for the relationship with the professional and to comply with applicable accounting and tax obligations. After that period, they are deleted.

The data processors involved are: Stripe (payments), Google (calendar and video call) and Brevo (sending the service's emails). Data is not shared with anyone else.

How we protect the data

A professional's calendar data is sensitive data and is treated as such. These are the concrete measures:

• Encryption in transit. All traffic between the browser, CalPay and the Google and Stripe APIs goes over HTTPS with TLS. CalPay is never served over an unencrypted connection.
• Least data, least permission, and encrypted. Only two Google scopes are requested: reading when the professional is busy (calendar.freebusy) and creating and managing the events of bookings made through CalPay (calendar.events). No calendar content is stored: the only Google data kept is the authorisation token, and it is stored encrypted with AES-256-GCM, with a key held outside the database. The encryption also authenticates it: a tampered database does not decrypt, it fails.
• Restricted access to the server. The databases live on a server we run ourselves in the European Union, in files readable only by the service account (mode 640). The only administrative account is root, which can only connect over SSH with a public key: password login is disabled. The account the application runs as has no interactive shell.
• Encrypted backups. They are made with restic, which encrypts and authenticates the whole repository. The backup key is not kept on the application server.
• Encrypted credentials. The Google, Stripe and email credentials are stored encrypted with SOPS and are only decrypted on the server at deploy time. No credential is ever in the clear in the code repository.
• Effective deletion. When the professional withdraws access from CalPay's admin page, the token is revoked with Google and deleted from the database at the same moment. From then on CalPay cannot access the calendar again.

Incidents. If a security breach affecting personal data occurred, it would be reported to the people affected and to the Spanish Data Protection Agency within the 72 hours the GDPR requires.

Your rights

You can request access, rectification, erasure, restriction, portability and objection by writing to info@sicena.com. We'll respond within the legal timeframe. If you're not satisfied, you can file a complaint with the Spanish Data Protection Agency or the Catalan Data Protection Authority.

Changes

If we change this policy, we'll update the date at the top. Significant changes will be notified by email to the professionals using CalPay.