Privacy Policy

Last updated: 10 October 2026

This policy explains what personal data Opencals collects, why, where it is stored, who else handles it, and what rights you have. We have tried to write it so you can read it in one sitting.

1. Who we are

Opencals is run by Stanislav Tyshchenko as a sole proprietorship registered in Poland, based in Warsaw. In this policy "Opencals", "we" and "us" mean that business.

Contact for anything in this policy: contact@opencals.com. Security issues: security@opencals.com.

We have not appointed a Data Protection Officer, because the GDPR does not require one for a business of our size and type. Privacy questions go to the founder directly.

2. Whose data this covers

• Visitors to opencals.com and our documentation.
• Merchants: the businesses (clinics, salons, studios and others) that use the Opencals dashboard, and their staff.
• Customers: people who book with a merchant through an Opencals storefront, widget, template, the Storefront API or our Shopify app.

3. Controller or processor

• For Visitor and Merchant data (your account, billing, support conversations, website analytics), Opencals is the controller.
• For Customer data that merchants collect through Opencals (bookings, contact details, intake form answers, payments, notes), the merchant is the controller and Opencals is the processor. We handle that data only to run the service for the merchant, under our Data Processing Agreement. If you booked with a merchant and want to access or delete your data, contact the merchant first. We will help them answer you.

4. What we collect

Visitors

• Pages viewed, referrer, approximate location from IP address, device and browser details.
• Analytics and advertising cookies, only after you consent where the law requires it (see section 8).
• Anything you send us through a contact or demo form.

Merchants

• Name, email, phone, business name and address, staff accounts and roles.
• Billing details. Card data is handled by Stripe; we never see or store full card numbers.
• Configuration: services, prices, locations, schedules, forms, email templates.
• Conversations with our onboarding assistant and support emails.
• Technical logs: IP address, user agent, timestamps, actions taken in the dashboard.

Customers (processed for merchants)

• Name, email, phone, booking details, and anything the merchant's booking form asks for.
• Payment status and invoices. Card data goes directly to Stripe or Shopify Payments.
• Some merchants, such as clinics, may ask for information that counts as health data. The merchant decides what to collect and is responsible for having a lawful basis for it. We store it on the merchant's behalf and do not use it for anything else.

5. Why we use it, and our legal basis

We do not sell personal data. We do not use Customer data for advertising, and we do not use it to train AI models.

6. Where your data is stored

Opencals runs on Amazon Web Services in the London region (eu-west-2), United Kingdom. Our databases, file storage, backups, email sending and most of our AI processing are in that region. The UK has an adequacy decision from the European Commission, so data can move between the EU and the UK without extra safeguards.

Some providers process data outside the UK and EEA. They are listed in section 7. Where data goes to a country without an adequacy decision, we rely on the provider's Standard Contractual Clauses or its certification under the EU–US Data Privacy Framework.

7. Who else handles data (subprocessors)

Merchants who connect other integrations decide what data flows to those services. We will update this list when it changes.

8. Cookies

The marketing site uses strictly necessary cookies and, only with your consent in the UK, EEA and Switzerland, Google Analytics, Google Ads and Microsoft Clarity. You can withdraw consent at any time by clearing this site's data in your browser, which brings the cookie banner back, or by emailing us. The dashboard and storefronts use cookies needed for sign-in, security and checkout.

9. How long we keep data

• Merchant accounts: while the account is active. After you close it, we delete or anonymise account and Customer data within 90 days, unless the merchant exports it or asks us to delete it sooner.
• Invoices and accounting records: for the period Polish tax law requires (currently five years from the end of the tax year).
• Backups: daily backups are kept for up to 35 days and monthly backups for up to 12 months, then deleted automatically.
• Security and audit logs: up to 180 days.
• Visitor analytics: according to the provider's retention settings, at most 14 months.

10. How we protect it

Data is encrypted in transit with TLS. Access to production is limited to the founder and requires multi-factor authentication. We log administrative activity and monitor for threats. We test our infrastructure and code against recognised security frameworks using automated tools. What we do, and what we have not done yet, is on our Security page.

If a personal data breach is likely to put people at risk, we will tell the affected merchants without undue delay, so they can meet their own reporting duties. Where we are the controller, we will notify the supervisory authority within 72 hours as the GDPR requires.

11. Your rights

Under the GDPR and UK GDPR you can ask to access, correct, delete, restrict or port your data, object to processing based on legitimate interests, and withdraw consent at any time. Email contact@opencals.com. We answer within one month.

If your data is held for a merchant (you booked an appointment), the merchant handles your request and we help them.

You can also complain to a supervisory authority. In Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You can also go to the authority where you live or work.

California residents: we do not sell or share personal information as the CCPA defines those terms.

12. Children

Opencals is not aimed at children. Merchants who take bookings for children must get any consent their local law requires.

13. Changes

If we change this policy in a way that matters, we will update the date at the top and email merchants before the change takes effect.