Privacy policy

Kairobot is a group scheduling service operated by:

Omelas, Netherlands Chamber of Commerce (KvK) 98455303, VAT NL005331814B35. Email: events@kairobot.work.

Write to that address for anything about your data — questions, requests or complaints. We have not appointed a data protection officer; we are not required to.

For organizers — the businesses and people who sign up — we are the controller: we decide how their account and billing data is used.

For guests and participants — the people an organizer invites — we are a processor. The organizer decides whom to invite and why, and is the controller of that data; we handle it on their behalf and only to run their events, under our data processing agreement. If you were invited, the organizer named in your invitation is your first contact for your data. You can also write to us and we will help, or pass your request on.

• Organizer accounts — business name, account email, display language, and a sign-in ID from Firebase Authentication. If you sign in with Google, Google tells us your email address and name.
• Billing — Stripe customer and subscription IDs and the subscription status. Card details go to Stripe only; we never see them.
• Events, recurring events and tournaments — titles, descriptions, locations, dates, times and settings the organizer enters, plus the times we find and the results the organizer records.
• Guests’ contact details — an email address or phone number and an optional name, supplied by the organizer so we can send invitations, reminders and confirmations.
• Availability — the times a guest marks for an event, or the weekly availability a tournament participant sets, and any message they send the organizer when asking to change their answer.
• Delivery records — whether an email or text was sent, and when.
• Server logs — IP address, time, and the page or API address requested, kept for security and troubleshooting. The private part of invitation links is removed from logs.

We do not ask for special categories of data (such as health or religion). Organizers should not put them in event titles or descriptions.

• Running an organizer’s account and service — performing our contract with the organizer (Art. 6(1)(b) GDPR).
• Guests’ data — processed on the organizer’s instructions to schedule their events; the organizer is responsible for having a lawful basis to invite you (Art. 28 GDPR).
• Invoices and payment records — our legal obligations under tax and accounting law (Art. 6(1)(c)).
• Security, abuse prevention and server logs, and warning an unused account before we delete it — our legitimate interest in a safe, lean service (Art. 6(1)(f)).

Kairobot picks times automatically from the answers it receives. This is scheduling, not a decision with legal or similarly significant effects; the organizer can always change the time.

• The organizer sees the guests they invited, their answers and status.
• Other participants of the same tournament see display names, fixtures, results and standings — never anyone’s email address or phone number.
• Kairobot staff — a small number of system administrators can view an organizer’s account and its events and tournaments, for support and operations. Each such access is recorded in an audit log.
• Service providers (sub-processors) host, deliver and bill for the service under contracts that bind them to the same protections — see the full list.

We never sell personal data or use it for advertising.

The application and its database run on our server in Germany. Some providers are outside the EU or have parent companies there (Google for sign-in, Stripe’s US parent, Cloudflare); transfers rely on the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. Details are on the sub-processors page.

• Events and tournaments, with their guests, answers and results: deleted 12 months after they end, or earlier when the organizer deletes them.
• Organizer accounts: until the organizer closes the account (Settings → Close account), which deletes it and everything in it at once. An account without a paid plan that has not been used for 24 months is deleted too — we email the owner 30 days before, and signing in keeps it.
• Webhook records from Stripe: 90 days. Invoices themselves are kept by Stripe for as long as tax law requires.
• Server logs: rotated automatically and capped at about 30 MB, which is typically days to weeks of traffic.
• Administrator audit log: 24 months.
• Backups: an encrypted copy of the database is made every night and kept for 14 days, so anything deleted disappears from backups within 14 days.

Everything travels over encrypted connections. Invitation and schedule links are long random tokens that we store only as one-way hashes, so a database leak does not leak working links; invitation links expire and are replaced whenever a new one is sent. Each organizer’s data is separated from every other organizer’s, and staff access is logged.

Kairobot sets no tracking or advertising cookies and uses no third-party analytics. Your browser stores only what the service needs:

• the Firebase sign-in session, for organizers who sign in;
• that you dismissed our privacy notice;
• the display language you picked in the app, if you changed it.

None of this is used to track you, so no consent banner is needed.

You can ask for access to your data, correction, erasure, restriction, a portable copy, or object to processing based on legitimate interest. Organizers can delete events, guests and their whole account themselves. Guests can ask the organizer, or us — we answer within one month.

You can also complain to a data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens, or the authority where you live.

Kairobot is a tool for organizers and is not aimed at children. Organizers who invite minors — for example to a youth tournament — are responsible for any parental consent the law requires, and should share only what is needed (a first name is enough).

We announce changes on this page and update the date above. If a change materially affects organizers, we also email account owners.