Privacy Policy

ManageCal is operated by SuperSphere Labs LLP, a limited liability partnership with its registered office at A-266, Triveni Nagar, Jaipur 302018, Rajasthan, India (“we”, “us”).

For your account (your email address and sign-in details) we are the Data Fiduciary under the DPDP Act (the “controller”, in the terms of other laws): we decide how that information is used. For what your organisation puts into its calendars (events, notes, custom field values, and the people it adds), your organisation is the Data Fiduciary and we handle that information on its behalf as its Data Processor. Questions about that content are best sent to your workspace’s owner or administrator first.

• Your account: your email address, a name if one is added, when you first signed in and when you last did. There are no passwords; ManageCal signs you in with a link sent to your email address.
• Sign-in links: when a link is requested we store a one-way hash of it (never the link itself), when it expires, and the IP address the request came from.
• Your workspaces: which workspaces you belong to, your role in each, and which calendars you can see and at what level.
• Calendar content: the events, descriptions, custom field values and settings that you and your colleagues enter, and a record of who created or last changed events and who changed calendar settings.
• Server logs: the IP address, time and address of each request to the app, used to keep the service running and secure.

We do not ask for, and ManageCal has no field designed for, financial, health, biometric or other sensitive information. Please do not put it into calendar content.

The website (this site, as opposed to the app you sign in to) sets no cookies and runs no analytics or advertising scripts. Its fonts are served from our own servers, so visiting it does not send your details to a font provider either.

• To sign you in, keep you signed in, and show you the calendars you have been given.
• To send the three kinds of email the product sends: a sign-in link when you ask for one, a link to finish creating an account when you ask with an address that has none yet, and a note when someone adds you to a workspace.
• To protect the service, for example limiting how often sign-in links can be requested from one address or for one email.
• To investigate problems you report, and to meet legal obligations.

We use personal information only for these purposes. We do not sell it, use it for advertising, or send marketing email. If that ever changes it will only be with your consent.

Under the DPDP Act we may process your personal data with your consent, or for a use the Act recognises as legitimate. For ManageCal:

• Your account. You give us your email address so that we can sign you in and run the service you, or your organisation, asked for. We use it only for that purpose.
• People added by an organisation. When an organisation adds someone to its workspace, it is the Data Fiduciary for that decision and is responsible for having a lawful reason to do so, for example that the person works with it. We process that information on its instructions.
• Logs and rate limits. These are part of running the service securely, which the Act requires us to do with reasonable security safeguards.
• Legal obligations. We keep some records where the law requires it.

Where we rely on your consent, you may withdraw it at any time by writing to hello@managecal.com. Withdrawing it does not affect what was done before, and because ManageCal cannot sign you in without your email address, it will mean closing your account.

• Your organisation. Workspace owners and administrators can see the email addresses of the people in their workspace, and calendar administrators can see who has access to their calendars. What colleagues can see of events depends on the access they are given, which your organisation controls.
• Hosting: Google Cloud, which runs the servers that ManageCal, its database and its backups are kept on, in India.
• Email delivery: Resend, which delivers the sign-in and workspace emails described above. It receives the recipient’s address and the message. Resend is based in the United States, so this information is handled outside India.
• Where the law requires it, for example in response to a valid order from a court or a government authority.

Each provider handles personal data only on our instructions and under a contract that requires it to keep the data secure. Transfers outside India are made only as the DPDP Act permits, and never to a country the Government of India has restricted.

• Sign-in links work once and expire after 15 minutes, and links to finish creating an account after 60 minutes. Their records are deleted automatically within about an hour of expiring. Asking for a link creates no account: that happens only when you finish creating one.
• Your session lasts up to 7 days, or until you sign out.
• Your account is kept while you belong to a workspace. If you are removed from one, your account remains so that you can be added back; ask us and we will delete it.
• Calendar content is kept until your organisation deletes it, or until its workspace is closed, which a workspace owner can ask us to do.
• Backups of the database are kept for 14 days, then deleted. Something you delete can remain in a backup until that backup expires.
• Server logs are rotated and deleted automatically after a short period.

When information is no longer needed for the purpose it was collected for, and the law does not require us to keep it, we delete it.

The app sets one cookie, mcToken, which keeps you signed in. It is strictly necessary for the app to work, lasts up to 7 days, cannot be read by scripts on the page, and is only sent over an encrypted connection. The app sets no other cookies, and the website sets none.

All traffic to ManageCal is encrypted. Sign-in links are stored only as one-way hashes, work once and expire after 15 minutes. People only receive the calendar details their access allows: details that are hidden from someone are never sent to their browser. The database is backed up nightly. No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India, as the DPDP Act requires, and CERT-In where the Information Technology Act requires.

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you and how we use it, and know who we have shared it with;
• have it corrected, completed or updated, and have it erased when it is no longer needed;
• withdraw consent you have given, as easily as you gave it;
• have a complaint about how we handle your data answered by our Grievance Officer; and
• nominate someone to exercise these rights for you if you die or become unable to.

To use any of these rights, write to hello@managecal.com. We may need to confirm it is you, and for calendar content we may refer you to your organisation, which controls it. If you live outside India, the law where you live may give you further rights, such as receiving your data in a portable form or objecting to how it is used; ask us and we will honour them where they apply.

If you have a concern or complaint about how ManageCal handles your personal data or your content, contact our Grievance Officer:

Grievance Officer
SuperSphere Labs LLP
A-266, Triveni Nagar, Jaipur 302018, Rajasthan, India
hello@managecal.com

We will acknowledge your complaint within 24 hours and resolve it within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

ManageCal is a tool for organisations and is only for people aged 18 or over. We do not knowingly process the personal data of anyone under 18. If you believe a child is using ManageCal, write to hello@managecal.com and we will delete their account.

If we change this policy we will update the date at the top of this page, and tell workspace owners about any significant change before it takes effect.

Questions about this policy or your information: hello@managecal.com, or write to SuperSphere Labs LLP, A-266, Triveni Nagar, Jaipur 302018, Rajasthan, India.