Privacy notice

1. Summary

Weekstead is built for organization-authorized business accounts. We use information to provide and secure the calendar features an organization and its users choose to enable. We do not sell personal information, share it for cross-context behavioral advertising, or use Google Workspace data received by Weekstead for advertising. Weekstead does not use your data to train artificial intelligence models.

2. Scope and responsibility

These commitments describe Weekstead's handling of information. Google Workspace and customer-configured services handle information under their own applicable terms and privacy policies.

This notice explains how Weekstead handles information when you visit weekstead.com, request access, sign in, connect a calendar, or use the Weekstead service.

Weekstead acts as the controller of personal information it uses to operate the website, manage access requests and accounts, secure the service, and communicate with customers. For business-calendar, team, and member information that an organization directs Weekstead to process, the organization acts as the controller and Weekstead acts as its processor or service provider. The organization is responsible for authorizing its users, calendars, rooms, team membership, shared calendars, and notification destinations.

3. Information we collect

Access requests

We collect the work email address you submit and the date of the request. Cloudflare Turnstile processes a short-lived challenge token and technical information needed to detect automated abuse.

Account and authorization information

When you sign in with Google, we receive your Google account identifier, verified email address, name, profile information, and Workspace domain. We retain your account email address. Calendar authorization is a separate step. We store authorization credentials in encrypted form so Weekstead can perform the features you enable.

Calendar and product information

Depending on the features you use, Weekstead processes calendar events and their participants, times, locations, responses, and private Weekstead properties; free-busy information; Working Location; room addresses and metadata; product preferences; team membership and invitations; shared-calendar configuration and copies; notification configuration; synchronization state; and records of actions Weekstead considered or performed.

Recent-room discovery scans accepted room attendees in up to 90 days of recent meetings. Its temporary candidate results contain a room address, a bounded display hint, the latest occurrence, and an occurrence count. They do not retain event identifiers, titles, bodies, or attendee lists. Separate short-lived decision captures may contain the Calendar responses and configuration needed to explain and safely replay a Room Booking decision. These captures can include event titles, descriptions, attendee details, and other Calendar response content.

Device, session, and operational information

We process session identifiers, request timestamps, internet protocol addresses, user agents, requested paths, security events, categorical authorization outcomes, error information, and service-operation records as needed to authenticate users, protect the service, diagnose failures, and keep automation reliable. We design application logs to omit calendar content, authorization codes, tokens, and user email addresses.

Support and communications

We process the messages and contact information you or your organization provide when communicating with us.

4. Google Workspace data

Identity sign-in requests basic OpenID, email, and profile information. If you separately authorize Calendar access, Weekstead requests permission to read and change events and to read Calendar information. These permissions let Weekstead monitor event changes, evaluate and update meetings for Room Booking, read Working Location, discover accepted room attendees when you request a scan, check room availability, and validate room metadata.

If an authorized user chooses to create a Weekstead-managed Team OOO calendar, Weekstead separately requests permission to create app-owned calendars and inspect or change the sharing rules of calendars that user owns. Weekstead uses those permissions to create the shared calendar, maintain out-of-office copies, and share the calendar with the exact members the team configures.

Weekstead's use and transfer of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Workspace data only to provide or improve the user-facing features you authorize, protect the service, comply with law, or complete another transfer that the policy permits with the required consent.

We do not permit people to read Google Workspace data unless you explicitly ask us to examine specific data for support, access is necessary for security or legal compliance, or the data has been aggregated and de-identified for permitted internal operations. We do not transfer Google Workspace data to advertising platforms, data brokers, or information resellers.

5. How and why we use information

• Review and respond to access requests.
• Authenticate users, enforce organization boundaries, and maintain authorized Calendar connections.
• Provide Room Booking, Team OOO, Focus Time, Slack Status, setup, activity, notifications, and support.
• Apply customer configuration and perform actions that authorized users request.
• Protect accounts, prevent abuse, investigate errors, and maintain service reliability.
• Comply with law and enforce the Terms of service.

Where applicable law requires a legal basis, Weekstead relies on performance of a contract to provide requested accounts and services; its legitimate interests in reviewing access requests, securing and maintaining the service, preventing abuse, diagnosing failures, and communicating with customers; compliance with legal obligations; and consent when Weekstead specifically requests it. An organization determines the applicable legal basis for the business-calendar, team, and member information it directs Weekstead to process on its behalf.

We do not use connected-calendar data for unrelated marketing or to build profiles for advertising.

6. Sharing and service providers

We disclose information only as needed to operate the service, follow an organization's instructions, protect Weekstead and its users, complete a business transaction subject to appropriate safeguards, or comply with law. Google Workspace data would be transferred as part of a business transaction only with the explicit prior consent required by Google policy.

• Google provides identity and Calendar services.
• Cloudflare delivers the public website, stores access requests, and provides abuse protection.
• Infrastructure providers process encrypted or access-controlled information to host the application, databases, workflows, and operational records.
• Customer-configured destinations, such as Slack or Microsoft Teams, receive a notification only when an authorized customer configures that destination.
• Professional advisers and authorities may receive information when reasonably necessary to obtain advice, protect rights, or comply with legal process.

A Team OOO shared calendar and optional notification are visible to the people and destination configured by that team. Weekstead keeps each customer's information and actions within the owning organization, provider, environment, team, user, calendar, and destination boundaries.

International processing

Weekstead is operated from the United States. Weekstead and its service providers may process and store information in the United States and other countries where they operate. Privacy laws in those countries may differ from the laws where you live. Where applicable law requires additional safeguards for an international transfer, Weekstead will use an approved legal mechanism.

7. Retention

We keep information only for the period needed for the purpose described below, unless a longer period is required to resolve a security issue, meet a legal obligation, or establish or defend a legal claim.

• Application sessions expire after no more than 14 days.
• Privacy-minimized authorization-attempt history is normally deleted after 90 days.
• Recent-room discovery jobs and unselected candidates are normally deleted after 7 days.
• Short-lived Room Booking decision captures are normally deleted after 30 days.
• Calendar authorization credentials are retained while the connection is active and removed after the authorized disconnect process completes.
• A user who has no automation enabled and has not signed in for 90 days has their Calendar authorization disconnected automatically; their account, saved configuration, and prior activity records remain.
• When the user's organization asks Weekstead to delete the user, a 30-day grace period begins. After that period, periodic processing deletes the account, configuration, activity, and team information once required cleanup is complete. There is no fixed completion date. The account cannot sign in while the request is pending, and disconnection of its integrations begins when the request is accepted. The request can be withdrawn before deletion. A user who owns a team with other members must transfer team ownership before the request can be accepted.
• Support information is retained while needed to handle the organization's instructions.
• Access requests remain on the access review list until an authorized operator removes them or the requester asks us to delete them.

Disconnecting Calendar stops new automation and begins removal of the Calendar connection and scheduled updates. It does not by itself delete the user's identity, saved configuration, or prior activity records; deletion happens only through the request described above.

8. Organization controls and individual rights

Authorized organization users can control membership, feature configuration, shared-calendar access, notification destinations, Calendar authorization, Room Booking preferences, and temporary pauses. A user can disconnect Calendar authorization without deleting their sign-in identity. A user's organization can ask Weekstead to delete the user's account, which removes the user from their teams at once and starts the grace period and cleanup process described in the Retention section.

Your organization may be responsible for responding to a request concerning information it directed Weekstead to process. You should first contact your organization's administrator for that information. You or the organization may also ask Weekstead to provide access to, correct, or delete information. Depending on where you live, you may also have rights to receive a portable copy, object to or restrict processing, withdraw consent where processing relies on consent, appeal a refusal, or complain to your local data protection regulator. These rights may be subject to exceptions under applicable law. We may need to verify the request and the requester's authority before acting.

Weekstead does not sell personal information or share it for cross-context behavioral advertising. We therefore do not offer a sale or targeted-advertising opt-out.

9. Cookies and tracking

The public marketing site does not use an advertising or general analytics provider. It uses Cloudflare Turnstile on the access-request form, and hosting infrastructure may create standard security and request logs. The signed-in application uses a secure, HTTP-only session cookie.

Weekstead does not track your activity over time across unrelated websites for advertising. Because we do not sell personal information, share it for cross-context behavioral advertising, or perform that cross-site tracking, the site does not respond differently to browser Do Not Track or Global Privacy Control signals.

10. Children's privacy

Weekstead is a business service for organization-authorized accounts. It is not directed to children, and we do not knowingly collect personal information directly from children.

11. Security

Weekstead uses access controls, encrypted credential storage, protected sessions, environment separation, customer-bound destinations, and data-minimization measures designed to protect information. No storage or transmission system can be guaranteed completely secure.

12. Changes to this notice

We may update this notice as the service, its features, or its service providers change. We will post the revised notice here and change the date above. We will provide additional notice or request consent before using Google Workspace data for a new purpose when required by law or Google policy.

13. Contact

Contact Weekstead at privacy@weekstead.com with a privacy question or request. Product guidance is also available in the Weekstead help center.