Scheduling tools bury critical privacy facts in 4,000-word policies. Here's a 15-minute audit that surfaces the flags that matter most: what they collect, what they share, what they retain, and whether their practice matches the policy.
Step 1: Ctrl-F for 'analytics' and 'advertising'
If the policy mentions analytics or advertising partners by name (Google Analytics, Mixpanel, Meta Pixel, LinkedIn Insight), the booking page is probably loading their scripts. Open DevTools and verify.
Step 2: Search for 'legitimate interest'
If the tool uses legitimate interest as a lawful basis for analytics or marketing processing, that's legally fragile. EU regulators have increasingly rejected this basis on public-facing pages.
Step 3: Look for a retention section
Specific retention periods ("30 days," "until account deletion") are good. Vague retention ("as long as necessary") fails GDPR scrutiny and typically means "indefinitely."
Step 4: Find the sub-processor list
A good policy publishes the list of third-party processors: mail sending, cloud hosting, payment, analytics. If you can't find this list, the tool is probably not enterprise-ready.
Step 5: Check the DSR flow
How do I delete my data? Is there a self-serve button, or do I have to email a ticket queue? Tools with self-serve deletion take privacy seriously.
This is part of our privacy-first scheduling pillar guide — 18 articles covering every privacy angle.
Frequently Asked Questions
Where is Cal Clear's privacy policy?
At calclear.app/privacy-policy. It's plain-English, under 2,000 words, and lists our three sub-processors explicitly.
What's the #1 red flag in a scheduling privacy policy?
Vague retention. 'We keep your data as long as necessary for business purposes' means 'forever' in practice, and will not survive a GDPR enforcement action.
Try privacy-first scheduling, free
Cal Clear runs zero trackers on booking pages and auto-deletes booking data on your schedule. Start at calclear.app.