Privacy Policy

Last updated: 13 October 2026

This Privacy Policy explains what information Orario collects, how we use it, and the choices you have. It applies to our websites and the Orario booking platform.

Who we are

Orario is run by Michail Koutsouris, an individual rather than a company ("we", "us"), who is the controller of the account information, the Google and Microsoft data and the other information this policy describes. Your customers' booking data is the exception: your business controls it, and we process it for you (see "Your customers’ data" below). To reach us about your data, email support@getorario.com.

Information we collect

Account information you provide: your name, email address, and business details.
Sign-in with Google, Microsoft or Facebook: if you choose to sign in with one of them, we receive your name and email address, and from Google and Facebook your profile picture, to find your login or create your account and show your avatar. Until a sign-in is linked to a login or creates one, we hold your name, address and, from Google and Facebook, the link to your picture for up to 30 minutes while you choose what to do, and delete them within the hour after that. We never receive the password of that account.
Connected Google Calendar (optional): if a staff member connects Google Calendar, we write their appointments into a Google calendar they own, where we have turned that on for their business, or into one calendar we create in their Google account for them. Either way we manage only the events we created. See "Google user data" below.
Connected Outlook calendar (optional): where we have turned it on for their business, a staff member can connect an Outlook calendar instead. We create one calendar in their Microsoft account for their appointments and read and change only that calendar and the events we wrote in it. See "Microsoft user data" below.
Payment details: when an admin buys a plan or a service from us, we send Polar, our merchant of record, the admin's email address (for the setup service, the contact email they give), a reference to the business (its ID and booking-page name, with our signature of the ID), and the buyer's IP address, which Polar uses to work out the tax. The payment itself happens on Polar's own checkout page. The card number, the billing address, whether the buyer is a business and its VAT number are entered there and go to Polar and to Stripe, its payment processor. We never see the card number. We read back only the card's brand, last four digits and expiry, to show them on the Billing page. Polar's notifications to us carry the billing address and the VAT number, and we do not store them.
Booking data your customers submit through your booking page, such as their name, contact details, and appointment details.
Usage and device information such as log data, IP address, and browser type, used to keep the service secure and reliable.
When your login was last used: we record the time whenever you sign in, and about once a day while you use Orario. A support session our staff open for your business does not count. We use it only for the rule for unused logins: after 12 months without use we disconnect any calendar you connected and, if your login has another way in, remove its sign-in with Microsoft, as described below. It is deleted with your login.

How we use information

To create and authenticate your account, run your booking page, show your profile picture, send transactional emails on your behalf, process subscription payments, provide support, and keep the service secure. We do not sell your personal data, and we do not use Google, Microsoft or Facebook profile data for advertising.

Google user data

This section covers what Orario receives from Google when you sign in with Google, or when a staff member connects Google Calendar. Where it differs from the rest of this policy for Google data, this section applies.

What we access

Sign in with Google gives us an identifier for your Google account, your name, email address and profile picture. We use them to create your account, sign you in and show your avatar. When you sign up with Google, your name fills the sign-up form, and the name you keep there also becomes your business's first staff member, which its booking page, its booking emails and its calendar events show until you rename that staff member.
Your own Google calendar ("Your Google calendar" on the Calendar connection page), where Orario has turned it on for your business, puts your appointments in a Google calendar you already have. It gives us permission to see the list of your calendars and to see, add, change and delete events on the calendars you own (your primary calendar and calendars you created). Orario reads the list of your calendars at three moments: when you connect, to start with your primary calendar; each time you open the Calendar connection page, to show you the calendars you can choose from; and when you pick one, to check that it is one of yours. It touches only the events it created, which it finds by a private reference stored on each.
A separate Orario calendar is the alternative, and the only choice where Orario has not turned on your own Google calendar for your business. It gives us permission to create calendars in your Google account and to manage events in the calendars Orario creates. Orario creates one, named "Orario ·" followed by your business name, and writes your appointments there. With this permission Google does not let Orario see your other calendars or anything in them.
Every few hours, and every minute while the Calendar connection page is open, Orario checks the connection: that Google still accepts its access, that the calendar it writes to still exists, and whether that calendar is shown in your list. With your own Google calendar it reads only the entry of the calendar you chose and, when that is not your primary calendar, your primary calendar's entry, to confirm the calendar is yours; never the whole list. Every few hours it also reads the upcoming events it wrote, found by their private reference, and puts back any that were changed or deleted in Google Calendar. It never reads an event it did not create.

How we use it

We use Google data only to run the feature you turned on. For calendar sync that means one event per appointment, with the client's name, the services, the location, the time, the length and the total, which we update or delete when the appointment changes or is cancelled. Each event also shows the booking reference, the professional's name and their label in Orario, whether the booking was made on the booking page or in the dashboard, and a line saying the booking has notes when it has some (never the notes themselves). It has a reminder an hour and a day before the appointment and the professional's colour. Hidden properties on the event, which Google Calendar does not show, hold the booking reference, the identifiers Orario uses for the professional, the shop and the services, the professional's label in Orario, the client's name, the total, the length, whether the booking was anonymous, where it was made, and a marker that says Orario wrote it. Orario reads back only the booking reference and the marker. We never write a client's phone number, email address or notes to Google. We do not use Google data for advertising, and we do not sell it.

Who receives it

Cloudflare hosts Orario. We store the Google tokens and the calendar's identifier in our database there. Your business's own data exports never include them, and nobody in your business sees them in the dashboard.
Sentry receives our error reports. Before a report is sent, we remove email addresses, phone numbers, tokens and calendar identifiers from it, so Sentry receives no Google tokens, calendar identifiers or Gmail addresses.
Brevo sends our account emails, so it receives your name and email address, and Polar runs subscriptions, so it receives the email address of the admin who starts a paid plan. Either can be one Google gave us when you signed up with it. Neither receives calendar data or tokens.
Your business's clients see its staff names on its booking page and in its booking emails, so they can see the name Google gave us when it named your first staff member.

We never transfer Google data to advertisers, data brokers or information resellers, and the only AI service that can receive any of it is the translation described under AI and machine learning, for a name an admin asks it to translate. We would disclose it only when the law requires it, to protect the security of Orario or its users, or as part of a merger or sale of our business, and in that last case only after telling you and asking for your agreement.

How we protect it

We encrypt Google access and refresh tokens before we store them, with keys kept as secrets outside the database. The identity token Google sends with them, whenever you sign in with Google or connect a Google account for sign-in or for a calendar, is stored as Google sends it, unencrypted. Everything travels over TLS. Calendar identifiers, which for your primary calendar are your Gmail address, never appear in our logs or error reports. Orario staff helping your business in a support session cannot open, change or disconnect a staff member's calendar connection, cannot remove a login or a staff profile that has one, and do not rename the calendars when they change the business's name.

How long we keep it, and how to delete it

While a calendar is connected we keep the Google tokens, the identifier and name of the calendar we write to, the identifier and link of each event we created, when we last synced, and when we last checked the connection and what the check found.
Because Google issues them with every sign-in and every connection of a Google account, we also keep an access token and a refresh token for your basic profile, encrypted, and the identity token Google sends with them, which holds your name, email address and profile picture and which we store unencrypted, until you remove Google under Account > Sign-in and security, disconnect a calendar that uses that Google account, or your login is deleted.
Disconnecting, from the Calendar connection page of your account, deletes the Orario calendar from your Google account with every event in it. With your own Google calendar we delete the upcoming events Orario wrote, and past ones stay in your calendar. Either way we then ask Google to revoke Orario's access and delete the tokens and event identifiers we kept. The Google account itself stays linked to your Orario login, so you can still sign in with it; the last item below says how to remove that link.
Deleting your Orario account does the same before we erase the account. So does your business removing your login or your staff profile.
If a staff member's login has not been used for 12 months, we disconnect their calendar as described above.
Deleting your business takes it offline at once. Its staff members' calendars stay in place during the 30-day recovery window, so a restore brings everything back. When the window ends we delete them, including the past appointments Orario wrote to a staff member's own Google calendar, revoke access for every staff member, and only then erase the business.
When Google does not answer at once, we keep a copy of the tokens only in the task that finishes the deletion, and delete that copy when the task ends, which is once Google has confirmed everything or after about two hours of Google not answering. If Google no longer accepts our access (for example because you removed it yourself), we cannot reach the calendar any more: we delete what we kept, and the page tells you what to delete in Google Calendar yourself.
You can also remove Orario from your Google Account permissions page at any time. Orario then stops syncing, and we delete the tokens it can no longer use when you disconnect, when you delete your account, or when we erase your business.
Revoking ends the access Google gave Orario for that Google account. The Google account stays linked to your Orario login, so you can still sign in with it, and Google asks for your permission again when you do. To remove that link, open Account > Sign-in and security and press Remove on the Google row (disconnect a calendar that uses that Google account first), or email us.

Limited Use

Orario's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Google Workspace APIs, including the Google Calendar API, will adhere to the Google User Data Policy, including the Limited Use requirements.

AI and machine learning

We do not use Google data, or anything derived from it, to create, train or improve any AI or machine-learning model, personalized or not, and we never send calendar data or Google tokens to an AI service. The automatic translation in the dashboard sends only the catalog text an admin asks it to translate, such as a service, shop or staff name, to Cloudflare Workers AI, which does not use it to train models. A staff name can be the name Google gave us, because a new business's first staff member is named after its owner. We do not use Google data to determine credit-worthiness or for lending.

Aggregated and anonymized data

We do not build aggregated or anonymized datasets from Google data, and we do not use it for analytics about our users.

Human access

Nobody at Orario reads your calendar data or Google tokens unless you ask us to for a support request and agree to it, it is needed to investigate abuse or a security incident, or the law requires it. Orario's operators see each login's name and email address, which can be the ones Google gave us, in our administration console and in a support session for your business, and use them only to run the service, answer support requests and keep it secure.

Microsoft user data

This section covers what Orario receives from Microsoft when you sign in with Microsoft, or when a staff member connects an Outlook calendar. Where it differs from the rest of this policy for Microsoft data, this section applies.

What we access

Sign in with Microsoft gives us an identifier Microsoft creates for Orario alone, your name and your email address. We use them to find your Orario login, or to create your account when you sign up with Microsoft, and to sign you in. We keep the identifier, and your name and address as part of the account you create; until the sign-in is linked to a login or creates one, we hold them for up to 30 minutes while you choose what to do, and delete them within the hour after that. We keep no Microsoft token from a sign-in.
For an Outlook calendar, an identifier for your Microsoft account, which Microsoft creates for Orario alone. The calendar connection does not ask Microsoft for your name, email address or photo.
Permission to read and write your calendars. Microsoft offers no permission for a single calendar, so its screen asks for full access to all of them. With it, Orario creates one calendar in your Microsoft account, named "Orario ·" followed by your business name, and writes your appointments there. Orario reads and changes only that calendar and the events it wrote in it. To find them it asks Microsoft for the items carrying a private tag Orario stored on them, and Microsoft answers with those items only.
Every few hours, and every minute while the Calendar connection page is open, Orario checks that Microsoft still accepts its access and that the calendar still exists. Every few hours it also reads the upcoming events it wrote, found by their private tag, and puts back any that were changed or deleted in Outlook.

How we use it

We use what a sign-in gives us only to find your Orario login, to create your account when you sign up with Microsoft, and to sign you in. When you sign up with Microsoft, your name fills the sign-up form, and the name you keep there also becomes your business's first staff member, which its booking page, its booking emails and its calendar events show until you rename that staff member. We use the calendar permission only to keep your appointments in that calendar. That means one event per appointment, with the client's name, the services, the location, the time, the length and the total, which we update or delete when the appointment changes or is cancelled. Each event also shows the booking reference, the professional's name and their label in Orario, where the booking was made, and a line saying the booking has notes when it has some (never the notes themselves), with a reminder an hour before. Hidden properties hold the booking reference and a marker that says Orario wrote it, and the Orario calendar carries a hidden tag so Orario can find it again. We never write a client's phone number, email address or notes to Microsoft, and we never invite anyone to an event. We do not use Microsoft data for advertising, and we do not sell it.

Who receives it

Cloudflare hosts Orario. We store the encrypted Microsoft tokens and the calendar's identifier in our database there. Your business's own data exports never include them, and nobody in your business sees them in the dashboard.
Sentry receives our error reports. Before a report is sent, we remove tokens, calendar and event identifiers and email addresses from it.
Brevo sends our account emails, so it receives your name and email address, and Polar runs subscriptions, so it receives the email address of the admin who starts a paid plan. Either can be one Microsoft gave us when you signed up with it. Neither receives calendar data or tokens.
Your business's clients see its staff names on its booking page and in its booking emails, so they can see the name Microsoft gave us when it named your first staff member.

We never send Microsoft data to advertisers, data brokers or information resellers, and the only AI service that can receive any of it is the translation described under AI, aggregation and human access, for a name an admin asks it to translate. We would disclose it only when the law requires it, to protect the security of Orario or its users, or as part of a merger or sale of our business, and in that last case only after telling you and asking for your agreement.

How we protect it

We encrypt Microsoft access and refresh tokens before we store them, with keys kept as secrets outside the database. Everything travels over TLS. Calendar and event identifiers never appear in our logs or error reports. Orario staff helping your business in a support session cannot open, change or disconnect a staff member's calendar connection.

How long we keep it, and how to delete it

The link that sign-in with Microsoft uses between your Microsoft account and your Orario login stays until you press Remove on the Microsoft row under Account > Sign-in and security, your login is deleted, or the rule for unused logins removes it. Disconnecting an Outlook calendar does not remove it. If your login has not been used for 12 months and has another way in, we email you and then remove the link 30 days later. We keep it on a login that has no other way in, because removing it would lock you out of your business.
While the calendar is connected we keep the Microsoft tokens, the calendar's identifier and name, the identifier and link of each event we wrote, when we last synced, and when we last checked the connection and what the check found.
Disconnecting, from the Calendar connection page of your account, deletes the Orario calendar from your Microsoft account with every event in it. We then delete the tokens, the event identifiers and the calendar's link between your Microsoft account and your Orario login. A sign-in with Microsoft is a separate link and stays. Deleting your Orario account does the same, and so does your business removing your login or your staff profile. Deleting your business does it for every staff member when the 30-day recovery window ends.
If a staff member's login has not been used for 12 months, we disconnect their calendar as described above.
When Microsoft does not answer at once, we keep a copy of the tokens only in the task that finishes the deletion, and delete that copy when the task ends, which is once Microsoft has confirmed the deletion or after about two hours of Microsoft not answering.
Microsoft does not let an app withdraw a permission you gave it. After a disconnect Orario holds no token that can use it, and the last one Microsoft issued stops working after 90 days unused. You can remove Orario yourself at any time, for a personal account at account.live.com/consent/Manage and for a work or school account at myapps.microsoft.com. If your organisation's administrator approved Orario for everyone, only they can remove it. Writes to your calendar stop within about an hour and a half of a removal, and the next check tells you on the Calendar connection page.
If Microsoft no longer accepts our access, we cannot reach the calendar to delete it. We delete what we kept, and the page tells you to delete the calendar in Outlook yourself.

AI, aggregation and human access

We do not use Microsoft data, or anything derived from it, to create, train or improve any AI or machine-learning model, and we do not build aggregated or anonymized datasets from it. We never send calendar data or Microsoft tokens to an AI service. The automatic translation in the dashboard sends only the catalog text an admin asks it to translate, such as a service, shop or staff name, to Cloudflare Workers AI, which does not use it to train models, and a staff name can be the name Microsoft gave us. Nobody at Orario reads your calendar data or Microsoft tokens unless you ask us to for a support request and agree to it, it is needed to investigate abuse or a security incident, or the law requires it. Orario's operators see each login's name and email address, which can be the ones Microsoft gave us, in our administration console and in a support session for your business, and use them only to run the service, answer support requests and keep it secure.

Service providers we share with

We share data only with the providers that help us operate Orario:

Cloudflare: hosting and infrastructure, and the automatic translation in the dashboard (Workers AI).
Polar: subscription billing and payments, as our merchant of record.
Brevo: sending transactional emails.
Sentry: error reports, with email addresses, phone numbers, tokens and calendar identifiers removed before they are sent.
Google: sign-in with Google, and Google Calendar when a staff member connects it.
Microsoft: sign-in with Microsoft, and Outlook calendars when a staff member connects one.
Meta (Facebook): only if you choose to sign in with Facebook.

Your customers’ data

You are the controller of your customers’ booking data; Orario processes it on your behalf. You can export or delete it from your dashboard.

Data retention

We keep your information while your account is active. Deleting your account removes it immediately; deleting your organization takes it offline at once and permanently erases its data after a 30-day recovery window, except where we must retain it to meet legal or accounting obligations. A connected Google Calendar is removed as described under "Google user data", and a connected Outlook calendar as described under "Microsoft user data".

Cookies

We use strictly necessary cookies to sign you in and keep the service secure, a short-lived cookie that keeps your reads consistent with your own writes across our database replicas, and, only if you switch it, a one-year preference cookie that remembers light or dark mode. Paying happens on Polar's own checkout page, not on ours, so any cookies set while you pay are Polar's and Stripe's, under their policies. We do not use advertising or analytics cookies.

Your rights and data deletion

You can access, correct, export, or delete your data at any time from your dashboard. A staff member can disconnect Google Calendar from the Calendar connection page of their account. An Outlook calendar is disconnected from the same page. To remove a Google, Microsoft or Facebook sign-in from your login, press Remove on its row under Account > Sign-in and security, or email us; you can also remove Orario's access in your Google Account or Facebook settings at any time, and Microsoft's at account.live.com/consent/Manage for a personal account or myapps.microsoft.com for a work or school account. To delete all of your data, remove your organization from the dashboard (it is erased for good after a 30-day recovery window) or email us at support@getorario.com and we will process the request.

Contact

For any privacy request, contact us at support@getorario.com.