Privacy notice

What personal information we collect, why, who sees it, how long we keep it, and your rights. Last updated 24 October 2026.

Who we are

[Your company’s legal name] (“Kalpati”, “we”) decides how and why the personal information described here is used, which makes us its controller under UK data protection law.

What we collect and why

When you book a consultation

What: Your name, work email, business name, team size, what you tell us about your business, and the time and time zone you choose.
Why: To hold your call, send you its details, prepare for it, and follow up afterwards.
Lawful basis: Taking the steps you ask for before a possible contract, and our legitimate interest in replying to business enquiries.

When you have a client account

What: Your name, email address, your organisation and role, and the automation requests your team submits. Passwords are stored only as a one-way hash we cannot read.
Why: To provide your workspace, keep it secure, and do the work your organisation has asked for.
Lawful basis: Our contract with your organisation, and our legitimate interest in running the service securely.

When you use this website

What: Your IP address and browser details. For signed-in sessions we store these with the session.
Why: To keep the site secure, prevent abuse (for example repeated booking or sign-in attempts) and fix problems.
Lawful basis: Our legitimate interest in protecting the service and the people who use it.

We check booking messages automatically, on our own server, to filter out spam and to help us prepare (for example by recognising your industry). Bookings that look like spam may not be kept. These checks have no legal or similarly significant effect on you; if you think a genuine booking went missing, email us.

We don’t sell personal information, and we don’t use it for advertising.

Cookies

We only use cookies that the site needs to work, so we don’t ask for cookie consent. There are no analytics or advertising cookies.

Sign-in cookies (named better-auth.session_token and better-auth.session_data) keep you signed in to your workspace. They last up to 14 days and are removed when you log out.
sidebar_state remembers whether the workspace sidebar is open. It lasts 7 days.

Only the service providers we need to run Kalpati, each under contract:

Hosting: [Your hosting provider and country], which runs our servers and database.
Cloudflare, which protects the site and delivers it to your browser, and so processes your IP address and request details.
Jitsi Meet (meet.jit.si, run by 8x8), which hosts the video call when you join it. We don’t record consultation calls.
Google Calendar, only if you choose to add your call to it.

We may also disclose information when the law requires it. Some providers process data outside the UK; where they do, the transfer is protected by safeguards recognised in UK law, such as the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.

How long we keep it

Booking details are deleted automatically 12 months after the call.
Account information is kept while your organisation uses Kalpati, and deleted when the relationship ends unless the law requires us to keep it longer.
Sign-in sessions are deleted once they expire, after at most 14 days.
Server logs are kept briefly for security and troubleshooting, then overwritten.
Database backups are deleted after 14 days.

Your rights

You can ask us to:

give you a copy of the personal information we hold about you;
correct anything that is wrong or incomplete;
delete it, or restrict how we use it;
stop using it where we rely on legitimate interests;
send it to you or another organisation in a portable format.

Email [privacy@your-domain]. It’s free, and we’ll reply within one month. You can also cancel a booking yourself at any time from the private link you received when you booked.

Complaints

Please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

If we change how we use personal information we’ll update this page and the date at the top.