Nalkatti
PricingStart for free

Last updated November 6, 2026

Privacy policy

Plain answers about the data Nalkatti handles, and how you stay in control of it.

Nalkatti helps teams share when they're free and schedule meetings, and helps businesses take bookings, rentals and stays. This policy explains what we collect, why, and the choices you have. We don't sell your data, show ads, or use your data to train AI models. If you booked with a business that uses Nalkatti, see If you book with a business.

What we collect

  • Account details: your name, email address, time zone, the kind of business you tell us you run, and a hashed password. If you sign in with Google or Microsoft, we receive your name, email address and profile picture from them.
  • What you enter: your weekly availability, date-specific changes, teams you create or join, invitations, events you schedule and your replies to them, and the events you add to your built-in Nalkatti calendar (title, time, place, description, repeats and reminders) until you delete them.
  • Connected calendars (optional): if you connect a Google or Outlook calendar, we store the account's email address, encrypted access tokens, and the start and end times of your busy periods for roughly the next 60 days. We never store the titles, descriptions, locations or attendees of your own calendar events.
  • Your business (optional): if you run a business page, its name, address, phone number, website, hours, services, prices and what you rent out, a tax number if you add one for invoices, and the records it keeps about its customers, described below.
  • Billing (paid plans only): your plan, seats, billing period and payment status. Card, UPI and bank details, including for deposits paid to a business, are entered on Stripe's or Razorpay's own pages and stay with them; we never see or store them. For rupee plans, Razorpay may collect a GSTIN and billing address for the tax invoice.
  • AI features (optional): how many changes AI apps make each month, which AI apps (such as Claude or ChatGPT) you allowed to use your account, and your Anthropic API key if you add one (encrypted, and only used for your own assistant messages). We don't store your assistant chats.
  • Technical data: session cookies to keep you signed in, and short-lived server logs (IP address, browser, errors) used for security and troubleshooting. If an email we send bounces or is marked as spam, we note the address and the reason (never the email's contents) so we can fix delivery.

If you book with a business

When you book, rent or stay with a business that uses Nalkatti, that business decides what to ask you and what to do with your answers. It is responsible for your information, and we process it on its behalf. Please ask the business first about your information; if a request reaches us, we'll pass it on.

  • Contact and booking details: your name, email address, phone number if you give it, a delivery address if you ask for delivery, what you booked and when, the number of guests, prices, what you paid at the counter, deposits, and notes on the condition of what you rented. Also any enquiries, quotes, tickets, invoices, packs and gift cards you have with the business.
  • Sensitive details, if the business asks for them: answers to its intake and consent questions, which can include health information, and your ID or licence number. These, and the private notes its staff keep about you, are encrypted when stored. They're shown only to that business's staff, and each time staff open them it's recorded. Our servers have to decrypt them to show them to staff, so this isn't end-to-end encryption. Nobody at Nalkatti reads them unless the business asks us to for support, it's needed for security, or the law requires it.
  • Reviews: if you leave a review, your name, rating and comment appear on the business's public page, unless the business hides it.
  • Room calendars: if a business syncs room calendars with sites such as Airbnb or Booking.com, those sites get only the dates that are taken, not your name or details.
  • How long it's kept: until the business deletes it. Deleting your customer record removes that record, the staff notes, your intake answers and your ID or licence number. Past bookings and rentals keep your name, contact details and what you booked, so the business's history and accounts stay correct, until the business deletes its Nalkatti account.

How we use Google and Microsoft calendar data

When you connect a calendar, we ask for permission to:

  • Read your free/busy times (Google calendar.freebusy, Microsoft Calendars.ReadWrite) so we can remove busy periods from the availability your teams see. Team members see only that you are free or not free at a given time — never why.
  • Manage events we create (Google calendar.events, Microsoft Calendars.ReadWrite) so that team meetings you accept are added to your calendar, and updated or removed if you change your reply or the meeting is cancelled. You can turn this off per calendar. We also register for change notifications so your availability stays up to date.

Nalkatti's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google and Microsoft user data only to provide the features described above. We don't transfer it to others except as needed to provide the service, comply with law, or as part of a merger or acquisition with notice to you; we don't use it for advertising; and no person reads it unless you ask us to for support, it's needed for security, or the law requires it.

The assistant and AI apps

Both are optional and only act when you ask. The assistant uses your own Anthropic API key. When you message it, your message and the calendar details needed to answer it (for example the titles and times of events in the days you asked about) are sent to Anthropic, which runs the Claude model, under your own Anthropic account and its terms, and the answer comes back to you. The conversation stays in your browser tab and is gone when you start a new chat; we don't keep a copy. You can remove your key at any time under Settings → AI & connected apps.

If you connect an AI app (an “MCP” connection) and allow it, that app can read your calendar and, when you ask it to, add or change events for you. What it does with the information is covered by that app's own privacy policy. You can disconnect it at any time under Settings → AI & connected apps. The assistant and AI apps never see other people's event details: for teammates, only busy times.

Who can see your information

  • Members of your teams see your name, email address, time zone, when you're free, and your replies to team events.
  • Businesses you book with and their staff see what you give them, as described above.
  • Service providers who process data on our behalf: Cloudflare (hosting, database and sending email), Stripe and Razorpay (payments for paid plans, and paid bookings and deposits), and Sentry (error reports, when switched on). They may not use it for anything else. The full list is on the trust page.
  • Authorities, only when the law requires it.

Security

All traffic is encrypted with HTTPS. Calendar access tokens, businesses' private customer notes, intake answers and ID or licence numbers are encrypted at rest with AES-256-GCM. Passwords are hashed and never stored in plain text.

Keeping and deleting your data

  • Disconnect a calendar on the Integrations page at any time. We revoke our access with Google or Microsoft and immediately delete that calendar's tokens and busy times. Events we already added to your calendar stay there for you to keep or delete. You can also revoke access from your Google Account or Microsoft account.
  • Delete your account on the Profile page. This permanently deletes your account, availability, calendar connections, replies, any teams you own alone, and any business you own with the customer records and rentals it holds.
  • Download your data on the Profile page, as a JSON file you can keep or take elsewhere.
  • Billing records (invoices and payments) are kept by Stripe or Razorpay for as long as tax law requires, even after you delete your account.
  • Busy times are replaced at every sync, so past ones don't pile up. Server logs are kept for at most 7 days, and email delivery problems for 90 days after the last one.

Your rights

Wherever you live, you can ask to see, correct, download or delete your data, and object to how we use it. Most of this you can do yourself in the app; for anything else, contact us and we'll reply within 30 days. If you're in the EU or UK and unhappy with our reply, you can complain to your data protection authority. Companies that need a data processing agreement can use our DPA.

Changes and contact

If we change this policy in a meaningful way we'll update the date above and tell signed-in users. Questions or requests: ajaysaiux@gmail.com.