Privacy Policy

Last updated: 13 October 2026

Who we are

Whenity is operated by Sakash Agrawal, an individual based in Hyderabad, Telangana, India. You can reach us at admin@whenity.com with any question about this policy or your data.

Two kinds of people use Whenity

This matters, because our responsibilities differ.

Hostscreate a Whenity account and publish a booking page. For a host's own account data, we decide how it is used.

Inviteesbook a meeting on someone's booking page. That information is collected for the host, and the host decides how it is used: we process it on the host's behalf. We also use a limited part of it for our own purposes — the invitee's email address and IP address, to detect and block abuse of booking pages, and the email address, to send the booking emails described below.

If you booked a meeting and want your details removed, contact the host whose page you used. You can also contact us and we will help.

What we collect from hosts

• Name, email address, and profile picture (a web address you give us, or the picture Google provides if you sign in with Google)
• Your chosen username, which becomes part of your public booking link
• Your time zone
• Your availability, event types and booking settings, including any meeting location you enter, such as a phone number or address
• Your password, stored only in a scrambled (hashed) form we cannot read back
• If you use teams: your team's name (and logo, if you add one), and the email addresses of people you invite
• If you use developer features: your API keys (stored only in hashed form) and the web addresses you send webhooks to
• Sign-in records, including the IP address and browser your session was created from
• Account status records, such as a reason recorded if an account is suspended

If you sign in with Google, we receive your name, email address and profile picture from Google.

What we collect from invitees

When you book a meeting, the host's booking page asks for:

• Your name and email address
• Your time zone
• Your phone number, only if the host's meeting requires one
• Any notes you write, and answers to questions the host has set up
• A reason, if you give one when you cancel

We check your IP address to stop abuse of booking pages. Our abuse-prevention records hold only a scrambled (hashed) form of your email address and IP address — never the address or the IP address itself.

We do not ask invitees to create an account. We do not use analytics or advertising tools, and we do not track invitees across other websites. If a host's profile picture is stored by another service (for example Google), your browser loads it from that service, which can see your IP address.

Google user data

This section explains what Whenity does with information it receives from Google, when a host signs in with Google or connects Google Calendar.

What we access

• Sign in with Google: your name, email address and profile picture.
• Google Calendar, only if you connect it. We ask for two permissions. With the first (read-only calendar access), we read the list of your calendars to pick the ones you own or can edit, and we read the times you are busy in them. We read busy times only — never the titles, descriptions or attendees of your existing events. With the second (access to events), we add an event to your primary calendar when someone books with you, and remove it if that booking is cancelled or moved.

How we use it

Only to provide Whenity's scheduling features: signing you in, working out when you are free so your booking page offers only open times, and putting bookings in your calendar. People viewing your booking page see open times only, never your calendar.

How we store it

Google's access credentials are encrypted before they are stored. Your busy times are read when they are needed and are not stored. We keep the ID of each calendar event we create, so that we can remove it later.

Who we share it with

No one, except the service providers listed below that run Whenity for us, and only as needed to provide the service.

Limited Use

Whenity's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data we receive from Google is:

• never used for advertising, including retargeted, personalised or interest-based advertising
• never sold
• never used to develop, improve or train artificial intelligence or machine-learning models
• never read by people, except with your permission, to investigate security or abuse, to comply with the law, or in aggregated and anonymised form for running the service

Removing Google's access

You can disconnect Google Calendar in Whenity at any time; this deletes our copy of the access credentials. To remove Whenity's access completely, also remove Whenity from the third-party connections in your Google Account — we do not currently do that for you.

Other calendar, meeting and CRM tools

If a host connects Outlook, we read their busy times in the same way, and add each booking to their calendar and remove it if the booking is cancelled or moved.

The calendar event we create — in Google Calendar or Outlook — contains the invitee's name and email address (as an attendee), a title made from the event name and the invitee's name, any notes and answers the invitee gave, the meeting location (which is the invitee's phone number when the host has chosen to call them), and a link to reschedule or cancel. For team events, the other hosts are added as attendees. Google Calendar sends the invitee an invitation for the event.

If a host connects Zoom or Microsoft Teams, we create a meeting for each booking, titled with the event name and the invitee's name, and delete it if the booking is cancelled. Google Meet links are created the same way, as part of the Google Calendar event.

If a host connects Zoho CRM or HubSpot, the invitee's name, email address, phone number (if given), and the booking's details are sent to that host's CRM. This happens only if the host has connected it.

A host can also set up webhooks, which send each booking's details to a web address the host chooses, and can use API keys to read their bookings from our API. Both include the invitee's name, email address, time zone and answers, the meeting time, and the meeting link.

Who else handles this data

We use a small number of service providers to run Whenity:

We do not sell personal data, and we do not share it for advertising.

Where your data is stored

Whenity's data is stored and processed in several countries: the database in Singapore; the application, error monitoring and reminder scheduling in the United States; email delivery in Japan; and backups in India. Services a host connects process data in their own locations.

Wherever you are, this means your data is processed outside your own country, where data protection laws may differ from yours. If you are in the UK or the European Economic Area, your data is transferred outside your region.

Cookies

Whenity uses only cookies that are strictly necessary: to keep hosts signed in, and short security cookies while signing in with Google or connecting another service. We use no advertising, analytics or tracking cookies, so we do not show a cookie banner. Two display preferences — light or dark theme, and whether the dashboard sidebar is collapsed — are kept in your browser and are not sent to us. The Cookies page lists them.

How long we keep it

We do not yet delete most data automatically after a fixed period. Today:

• Host account data, availability and event types are kept while the account exists.
• Bookings, including the invitee's details, and records of the emails we sent, are kept with no fixed end date — also after the host's account is closed.
• Sign-in records are deleted when you sign out, reset your password, or your account is closed. Expired ones are not yet deleted automatically.
• Abuse-prevention records (hashed forms of an email address and an IP address) are deleted automatically about a day after they are made.
• Webhook delivery records are kept until the host removes that webhook.
• Administrative records of actions taken in our support tools are kept as a permanent audit trail. They include the staff member's email address, the account affected, and a hashed IP address.

Backups

Our database provider keeps short-term restore points so we can recover from mistakes, and we keep encrypted backups of the whole database for up to 12 months. Backups are locked: we do not edit them or erase data from them early, so data deleted from Whenity stays in existing backups until they expire on schedule.

Closing an account

To close your account, email admin@whenity.com. There is no self-service option yet. When we close an account:

• Your name, email address and profile picture are replaced with anonymous values.
• Your sign-in credentials, connected-service credentials, sessions, API keys, webhooks and team memberships are deleted.
• Upcoming bookings are cancelled: we tell the invitees, and remove the calendar events, meeting links and CRM meetings we created, where those services allow it.
• Your booking page stops working.

Some information is kept:

• Your username, so it cannot be reused by someone else, and your time zone.
• Your event types, past and cancelled bookings (including invitees' details), and records of emails we sent.
• The audit record of the closure.
• Copies in backups, until those backups expire (up to 12 months).
• Copies held by services you connected — calendar events, CRM records and data sent to your webhooks stay with those services.

We delete our copy of your connected-service credentials, but we do not currently revoke Whenity's access at Google, Microsoft, Zoom, Zoho or HubSpot. You can remove it in your account settings with each of those services.

Support access to accounts

Whenity staff can view a host's account as that host, but only when the host asks us for help, to investigate security or abuse, or where the law requires it. This access is read-only — no changes can be made to the account — and every such session is time-limited and recorded in an audit log that cannot be altered afterwards.

Security

Connection credentials for Google sign-in, Google Calendar, Outlook, Microsoft Teams, Zoom, Zoho CRM and HubSpot are encrypted before they are stored. Passwords and API keys are stored only in hashed form. Backups are encrypted before they leave our systems.

No service can promise perfect security, but we will tell affected users if a breach puts their data at risk.

Your rights

Depending on where you live — including under India's Digital Personal Data Protection Act, 2023 — you may have the right to ask us for a copy of your data, to correct it, to delete it, or to object to how it is used.

Write to admin@whenity.com and we will respond. We do not yet have self-service tools for exporting or deleting data, so we handle these requests by hand. If you are an invitee, please tell us which booking page you used, so we can find your record.

If you are unhappy with our response, you may complain to the data protection authority where you live.

Grievance Officer

For any complaint about how we handle your personal data, contact our Grievance Officer, Sakash Agrawal, at admin@whenity.com.

Children

Whenity is not intended for anyone under 18, and we do not knowingly collect their data.

Changes

If we change this policy in a way that matters, we will update the date at the top and, where the change is significant, tell account holders by email.

Contact

admin@whenity.com