CalendarWP privacy and data guide
This document describes CalendarWP's technical data handling. It is not legal advice.
Data stored
Core CalendarWP stores event posts, taxonomy terms, settings, template overrides, and an occurrence index. RSVP can store attendee name, email, phone, quantity, answers, status, source, and timestamps. Scheduler can additionally store guest details, service/host, booking times, meeting links, notification choices, operational notes, payment references, and integration identifiers.
CalendarWP does not store full payment-card numbers.
Personal Calendars stores an event's assigned WordPress user ID separately from the post author. Event Gallery stores selected attachment IDs, ordering, captions, and presentation preferences; Event Countdown stores per-event display preferences. Events Map uses event/venue records, map preferences, and cached geocoding. These features do not make Media Library files private or encrypt event content.
Compass stores a local search/occurrence index, settings, short-lived question/conversation state, temporary management reports, and token/request accounting. Its AI evidence excludes Personal Calendar events, booking/attendee records, and provider credentials. Visitor search uses public content only, even when the visitor is an administrator.
Core also maintains derived structured knowledge and Markdown for eligible public events, including supported public venue, organizer, taxonomy and add-on information. This is stored knowledge, not a short-lived conversation log. Current occurrences and availability are checked separately. Refreshing event knowledge runs locally; it does not itself send the collection to an AI provider or modify the original events.
Compass stores the administrator's Main goal and System prompt locally. They guide provider answer requests and must not contain credentials or confidential information. Compass FAQs are WordPress posts: published FAQs have public source pages and may be retrieved into an answer request; drafts and password-protected FAQs are excluded. Do not use FAQs as private operational notes.
WordPress privacy tools
CalendarWP registers suggested text for Settings > Privacy > Policy Guide.
RSVP and Scheduler register personal-data exporters and erasers under Tools > Export Personal Data and Tools > Erase Personal Data. Erasure anonymizes terminal records when deleting the record would damage capacity, audit, or payment accounting. Active bookings and records with financial references may require manual review or retention.
Retention
RSVP and Scheduler each provide a retention-period setting. Scheduled cleanup targets eligible terminal records older than the configured number of days. The default is 730 days. Setting retention to match applicable law and the site's business needs is the site owner's responsibility.
Compass conversation access expires after five minutes and retains at most three recent question/intent pairs for follow-up context. WordPress Cron schedules deletion; a throttled cleanup on ordinary site traffic also checks up to 25 expired turns per minute. Physical deletion can take longer on idle sites or with a backlog. Browser conversation tokens/context are held in memory, not persistent browser storage. Management reports expire after fifteen minutes. Token/request accounting stores keyed identities and usage totals, not question text or API keys, with scheduled cleanup after 32 days while Compass and Cron are active. Hosting logs, caches, backups, and provider-side retention are separate.
External services
All visitor-facing third-party integrations are optional.
| Service | Data that may be sent | Trigger |
|---|---|---|
| Mapbox | Venue coordinates, style, access token, IP/request metadata | Administrator enables Mapbox and a visitor loads a venue map |
| Mapbox geocoding | A configured venue address, or a place entered in Compass's location follow-up; access token and request metadata | An enabled map integration resolves an address, or Compass resolves a supplied place for nearby-event filtering |
| Compass provider connection tests: Google Gemini, Cloudflare Workers AI, OpenAI, Anthropic/Claude | The saved provider credential in an HTTPS request; Cloudflare also uses the Account ID | Administrator explicitly tests the provider connection; this requests model-list access, not an event answer |
| Compass AI answers: Google Gemini or Cloudflare Workers AI in this build | Submitted question, limited recent question context, selected permitted event/FAQ evidence, configured conversation instructions, and request metadata | Site owner enables and consents to the audience/data scope, then an authorized visitor or manager submits a question |
| OpenStreetMap | Venue coordinates and IP/request metadata | Administrator enables the embed fallback and a visitor loads a venue map |
| Stripe | Booking/customer details, amount, currency, payment and refund identifiers | Administrator enables paid Scheduler bookings |
| Google Calendar API | Booking title, time, attendee/contact and configured description details | Administrator connects and enables Scheduler Google Calendar |
| Google Calendar Sync OAuth | Readable calendar list; selected event title, description, location, dates, time zone, recurrence, visibility, status, and source link | Administrator connects Google and enables a source |
| Google-hosted iCal feed | Selected event title, description, location, dates, time zone, recurrence, visibility, and status | Administrator saves a Google public or secret iCal address |
| Google/Microsoft/Yahoo calendar links | Event title, time, location, description | Visitor chooses the corresponding calendar link |
| Google Fonts | Font request and IP/request metadata | Administrator enables and configures Google Fonts |
| Adobe Fonts | Project stylesheet request and IP/request metadata | Administrator enables and configures Adobe Fonts |
| Granola | API credential, requested note ID, pagination/date filters, and request metadata; notes are retrieved into WordPress, not uploaded as booking records | Administrator explicitly tests the connection or imports recent notes with Granola enabled |
| CalendarWP licensing service / Envato Market API | Purchase code during verification; site URL, plugin version, WordPress environment type, and a random installation ID linked to the site; opaque license token on connected requests; add-on ID for downloads | Administrator verifies a purchase code; while connected, daily scheduled rechecks, manual revalidation, add-on catalog/update checks and download requests; administrator requests disconnection |
Administrators should review each provider's terms, configure data-minimizing descriptions, restrict API keys, and update the site's privacy policy before enabling a service.
Provider terms and privacy notices
- Mapbox: terms and privacy
- OpenStreetMap Foundation: terms and privacy
- Stripe: legal terms and privacy
- Google: terms and privacy
- Microsoft: services agreement and privacy
- Yahoo: terms and privacy
- Adobe: terms and privacy
- Granola: platform terms and privacy
- Envato: terms and privacy
- Google Gemini: API terms
- Cloudflare Workers AI: data usage
- OpenAI: API data controls
- Anthropic/Claude: commercial terms
Google Calendar, Stripe, and Granola provider accounts are configured once under CalendarWP > Options > Integrations. Shared provider secrets are encrypted at rest and are available only to server-side integration code; password-style fields never return saved secret values to the browser. Only users with the WordPress manage_options capability can save or remove these shared connections. Individual add-ons store their own usage choices separately, so disabling a provider for Scheduler does not delete the site-wide credentials or affect another enabled add-on.
Google Calendar Sync never imports attendees, attendee or organizer email addresses, attachments, reminders, or conference details. Private and confidential events are skipped. A public meeting URL placed in an imported description or location may still become visible with that event, so review Draft imports before publishing. Hiding a synchronized event removes it from CalendarWP displays while retaining a recoverable local record and its encrypted source identity until restoration, source removal, or detachment. OAuth tokens, source calendar IDs, sync tokens, and iCal addresses are encrypted at rest. Secret iCal addresses remain bearer credentials and must not be copied into tickets or support reports.
Pausing or disconnecting preserves imported events. Detaching a source removes its credentials, source record, and mappings while preserving imported posts as ordinary content. Destructive uninstall removes add-on source credentials and sync records under the documented uninstall setting; ordinary deactivation preserves them.
Granola's current Scheduler importer retrieves recent notes and note details, matches them to bookings locally, and stores matched note identifiers, links and summaries in booking metadata. It does not upload booking records or request transcripts in this import flow. Its incoming webhook verifies the configured shared secret and records diagnostic metadata, but does not itself match or import notes in this build. A connected account or accepted webhook is not proof of a completed automatic recap workflow. Disable Granola in Scheduler to stop new imports; removing the shared connection does not erase summaries already imported into bookings.
Manual Granola imports run in bounded batches. When the result says more notes remain, use Import Recent Notes again to continue. WordPress stores the pending cursor, scan dates and a hashed account/folder scope in a non-autoloaded progress option; that option contains no recap text or API key. The selected folder is checked before a recap is attached. A changed account or folder starts a new recent-note scan; initial migration also preserves an older previous import date. Completed scans overlap the original scan-start timestamp so later updates can be checked again. Pending progress is retained across ordinary requests and deactivation, and removed by the core's explicitly enabled destructive uninstall. This is a manual import flow, not automatic webhook processing.
Recap matching compares participant emails and meeting time. Equally close bookings require administrator review instead of arbitrary selection. The six recap fields are saved together using the existing booking metadata, with transactional InnoDB booking and metadata tables required; no automatic table conversion is performed. Storage errors leave the import retryable. Existing privacy export and erasure use the same metadata fields.
Purchase-code verification is an explicit administrator action under CalendarWP > Options > Purchase Code. The raw purchase code is exchanged for an opaque CalendarWP license token and is not retained in the local WordPress database; the token, a masked code and verification metadata are stored. While connected, automatic daily rechecks and add-on catalog/update checks reuse the token and site details without asking for the code again. The installation ID is random, not anonymous: it is sent alongside the site URL. Choose Disconnect purchase code to request disconnection from the licensing service and remove the local license token. Disconnection does not recall requests already sent or erase the service's existing records. The Envato author API token belongs on the CalendarWP licensing service and must never be bundled in the distributed plugin.
Compass controls and location
Instant search, index rebuilding, and local management checks do not call an AI provider. Saving a provider credential makes no external request; explicitly testing it does. In this build, answer testing offers Gemini 3.5 Flash-Lite and Cloudflare Workers AI Llama 3.1 8B Instruct Fast or Llama 3.3 70B Instruct Fast. OpenAI/Claude connections do not currently make their candidate answer models selectable.
Visitor AI and management AI both start off and require separate owner consent, a tested provider, and finite token limits. Sending private editorial/report evidence requires an additional owner choice and the requesting manager's current WordPress permissions. Compass will not enable private evidence for Gemini unless the owner confirms paid-service status. This setting is not verification of the provider account's billing state; review the selected provider's actual terms and eligibility.
To stop new AI questions, disable the relevant audience under CalendarWP > Options > Add-on Settings > Compass. Local search remains available. To stop sharing private editorial evidence, turn that option off. Changes do not retract information already submitted or cancel processing already underway at a provider. Shared credentials can be explicitly removed under Options > Integrations when no other enabled add-on requires that connection. Disabling Compass AI does not disable Mapbox or other consumers of a shared provider.
Visitors can decline device location and use other filters. When they explicitly share browser coordinates, Compass sends them to this WordPress site for comparison with stored venue coordinates; it does not send those device coordinates to the AI provider or add them to retained question history. A city, postal code, or other place supplied after a location prompt may be sent to Mapbox for geocoding when configured. Text typed into an AI question is still part of the question sent to the selected AI provider; users should not enter sensitive information there.
Update the site's own privacy policy before enabling these services. The plugin's administrator guidance and this document describe technical behavior; they do not establish that the site's configuration meets every legal or provider requirement.
Security and diagnostics
Booking forms use nonces or booking-specific signed tokens, and provider webhook endpoints use their integration's verification controls. Compass additionally separates public sessions from nonce-protected management requests. High-frequency public routes have rate limits; limits and identity handling differ by endpoint. These controls do not replace a site's security monitoring. Diagnostics expose versions, non-identifying runtime and feature state, aggregate counts, and sanitized operational codes while omitting secrets and record contents. Review any report before sharing it.
Uninstall
Data is preserved by default. When destructive cleanup is explicitly enabled and confirmed, CalendarWP removes its options, transients, cron jobs, roles/capabilities, occurrence and booking tables. Event posts and taxonomy terms are removed only when the separate content-removal option is enabled.
On multisite, each site's cleanup choice applies to its own data, including pending Granola import progress. Scheduler host access, host image and display settings are shared user metadata; core uninstall removes those shared settings only when every site has explicitly enabled and confirmed cleanup. A site retaining its data therefore also retains the shared host settings. Unrelated user metadata is never included in this cleanup.
Compass has a separate, site-scoped removal choice in its Add-on Settings. Deactivation stops background work and invalidates active conversations without deleting stored data. Physical cleanup pauses while Compass is inactive; stored conversation data may remain until reactivation or explicitly authorized deletion. WordPress may expire cached reports independently. Deleting the plugin preserves data by default; opting into removal deletes Compass-owned records, not original events, taxonomy terms, media, Google synchronization settings, or shared integration credentials. A multisite network applies each site's own choice. Backups and provider records are not removed by plugin uninstall.