Privacy policy
Last updated: July 5, 2026
The short version: we store the minimum needed to run your scheduling, we never sell it, and you can delete all of it yourself. The longer version follows.
What we collect
Account information: your name, email address, and timezone, provided when you sign up.
Calendar availability: when you connect a calendar, we read busy and free time ranges to compute your availability. We store those time ranges, not the titles, descriptions, attendees, or contents of your events.
Booking data: when a guest books, we store their name, email, timezone, the meeting time, and any notes or answers they choose to provide. Guests do not need an account.
Payment status: if you enable paid meetings, payments are processed by Stripe on your own Stripe account. We store whether a booking was paid and the amount. We never see or store card numbers.
Agent conversations: if you use the AI assistant, your messages, its replies, and preferences you ask it to remember are stored so it can serve you across sessions.
Usage basics: page views and a handful of anonymous product events (for example that a booking was completed, never who booked it) via privacy-friendly analytics.
What we never do
We never sell your data, and we never share it with anyone except the service providers listed below who are required to process it on our behalf.
We never read the contents of your calendar events.
The AI assistant never changes your calendar without your explicit approval, and you can switch it off entirely at any time.
Service providers
We rely on a small set of processors to run LumenCal: Clerk (sign-in), Convex (database and backend), Vercel (hosting and analytics), Composio (calendar connections via OAuth you can revoke at any time), Stripe (payments and billing), Resend (email delivery), and AI model providers accessed through Vercel AI Gateway (agent and brief text generation; your data is not used to train models under the zero-data-retention configuration).
Your rights and controls
You can disconnect any calendar at any moment. LumenCal removes its stored connection immediately; to fully revoke the OAuth grant, also remove LumenCal from your calendar provider's account permissions (Google or Microsoft security settings).
You can delete your account from Settings. This permanently removes your bookings, event types, calendar connections, agent history, and any subscription, and cancels billing.
Guests can cancel or reschedule any booking through the private manage link in their confirmation email.
If you are in a jurisdiction with data-access rights (such as the GDPR or CCPA), you may request a copy or correction of your data by emailing us.
Retention and security
Operational records such as email delivery logs and AI usage counters are kept for up to 90 days, then deleted automatically.
Data is encrypted in transit and at rest by our providers. Access to production systems is limited to the operator of the service.
Contact
Questions about this policy: support@parrisdigital.com. We will update this page when our practices change, and the date below always reflects the current version.