Privacy Policy

This Privacy Policy applies specifically to SmartCal (smartcal.org) and is separate from the SR PRO Group company Privacy Policy and other products’ Privacy Policy. Each product has its own dedicated policy.

Operated by: SR PRO Group
Effective Date: September 2026 | Last Revised: September 2026

1. Overview & Who We Are

SmartCal is a managed B2B demo-booking platform built and operated by SR PRO Group. It turns inbound demo-request form submissions into immediate meeting-booking experiences: routing each prospect to the correct salesperson, displaying available meeting slots, creating the meeting on the salesperson’s calendar (Google Workspace or Microsoft 365), and synchronising the booking with the tenant’s HubSpot instance. SmartCal is deployed as a managed service by SR PRO Group on behalf of client organisations (“tenants”).

SR PRO Group refers collectively to SR Professional Marketing Inc (a Maryland, US corporation) and SR Professional Marketing Ltd (an Israeli company), both wholly owned by Ronen Wasserman. US and UK tenants are served under SR Professional Marketing Inc; Israeli tenants are served under SR Professional Marketing Ltd. The data practices described in this policy apply equally across both entities.

1.1 User Roles

This Privacy Policy covers three distinct categories of individuals whose personal data SmartCal processes:

• Tenant Admins — representatives of client organisations (e.g. Grip, AlgoSec) who configure and operate SmartCal’s admin interface, manage routing rules, connect salesperson calendars, and review booking data.
• Salespeople — individuals within a tenant organisation whose calendar availability SmartCal accesses to display booking slots and on whose calendar SmartCal creates meeting events.
• Prospects — individuals who submit a demo-request form on a tenant’s website and whose personal data flows into SmartCal’s booking flow. Prospects interact with a tenant-branded booking page and do not create a SmartCal account.

SR PRO Group acts as a data processor on behalf of each tenant, who is the data controller for prospect and salesperson personal data within their deployment. Prospects should direct privacy rights requests to the tenant organisation whose booking page they used (e.g. the company whose demo they requested), not to SR PRO directly, except where SR PRO is the only party that can fulfil the request.

2. Google Workspace Data — Access, Use, Storage & Sharing

SmartCal integrates with Google Workspace Calendar via the Google OAuth 2.0 protocol to access salesperson calendars on behalf of tenants. Below is a comprehensive disclosure of how we handle Google user data, in compliance with Google’s API Services User Data Policy.

2.1 What Google Data We Access

• Email address of the authorising salesperson, to identify the calendar owner (scopes: openid, email)
• Events on calendars the salesperson owns (scope: https://www.googleapis.com/auth/calendar.events.owned): to create, update and cancel the demo meetings SmartCal books
• Free/busy availability (scope: https://www.googleapis.com/auth/calendar.freebusy): to show genuinely available slots, without event details
• No other Google data (Gmail content, Drive, Contacts, or data belonging to other users) is accessed or requested

2.2 How We Use Google User Data

• To retrieve the salesperson’s available time slots and display them to the inbound prospect
• To create a calendar event on the assigned salesperson’s Google Workspace calendar upon a confirmed booking
• To update or cancel the calendar event when a prospect reschedules or cancels via their secure management link
• Google data is used solely for the purposes above and for no other purpose
• We do not use Google user data to serve advertising, build user profiles, or sell to third parties

2.3 How We Store Google User Data

• OAuth tokens (access tokens and refresh tokens) are stored in encrypted form on our servers, hosted by DigitalOcean in Amsterdam, the Netherlands (European Union), and are never exposed in the SmartCal admin interface
• Tokens are retained only for as long as the salesperson’s calendar connection is active; they are deleted immediately upon disconnection or tenant offboarding
• Calendar availability data (free/busy slots) is retrieved in real time and is not stored beyond the duration of the active booking session
• Meeting event metadata (title, date/time, attendees) is stored as part of the booking record for the duration of the tenant’s engagement with SR PRO

2.4 How We Share Google User Data

• We do not sell, rent, or trade Google user data to any third party
• Booking details (salesperson name, meeting time) are shown to the prospect who made the booking, solely to confirm their booking
• We do not share Google data with advertising networks or data brokers
• We may share data with trusted sub-processors (listed in Section 10) solely to operate the service, under strict confidentiality obligations
• We may disclose data if required by law, court order, or to protect the rights and safety of our users

2.5 Limited Use Disclosure

SmartCal’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We access Google data only to provide and improve the SmartCal demo-booking service directly requested by the tenant, and for no other purpose.

3. Microsoft 365 Data — Access, Use, Storage & Sharing

SmartCal integrates with Microsoft 365 Calendar via Microsoft OAuth 2.0 to access salesperson calendars on behalf of tenants. The data practices in this section mirror those for Google Workspace data above.

3.1 What Microsoft Data We Access

• Microsoft account identity (display name and email address) of the authorising salesperson
• Microsoft Calendar read/write access (scope: Calendars.ReadWrite) — to retrieve available time slots and create meeting events on the salesperson’s calendar
• Free/busy availability data — to display genuinely available booking slots to prospects
• No other Microsoft data (email content, OneDrive, Teams messages, Contacts, or data belonging to other users) is accessed or requested

3.2 How We Use Microsoft User Data

• To retrieve the salesperson’s available time slots and display them to the inbound prospect
• To create a calendar event on the assigned salesperson’s Microsoft 365 calendar upon a confirmed booking
• To update or cancel the calendar event when a prospect reschedules or cancels via their secure management link
• Microsoft data is used solely for the purposes above and for no other purpose
• We do not use Microsoft user data to serve advertising, build user profiles, or sell to third parties

3.3 How We Store Microsoft User Data

• OAuth tokens are stored in encrypted form on our DigitalOcean Amsterdam (EU) servers and are never exposed in the SmartCal interface
• Tokens are retained only for as long as the salesperson’s calendar connection remains active; they are deleted immediately upon disconnection or tenant offboarding
• Availability data is retrieved in real time and not stored beyond the active booking session

3.4 How We Share Microsoft User Data

• We do not sell, rent, or trade Microsoft user data to any third party
• We may share data with trusted sub-processors solely to operate the service, under strict confidentiality obligations
• We may disclose data if required by law, court order, or to protect user safety

4. Information We Collect

4.1 Prospect Data (collected at booking)

• Name, company, email address, and any other fields submitted via the tenant’s demo-request form (e.g. country, region, job title — used for routing to the correct salesperson)
• Chosen meeting date, time, and prospect-local timezone
• A short-lived intake context created at form submission and used only to route and display available slots; this context is discarded once the booking is confirmed or abandoned
• Booking status and history (confirmed, rescheduled, cancelled) and associated timestamps
• Secure, opaque, booking-scoped management tokens embedded in the calendar invitation — used to enable reschedule and cancellation without prospect login; these tokens are single-use and time-limited

4.2 Salesperson Data

• Name, email address, and calendar account details provided by the tenant admin
• Calendar availability data (free/busy slots) retrieved in real time via OAuth
• Booking load, connection health status, and last calendar sync timestamp

4.3 Tenant Admin Data

• Name, email address, and role (Admin or Viewer) within the SmartCal workspace
• Authentication details via Google Workspace or Microsoft 365 sign-in (no separate SmartCal password is created)
• Routing rules, availability settings, and configuration preferences

4.4 Audit & System Data

• Audit history records: routing decisions and matched rules, booking changes, calendar integration events (connection, sync, error), team-access changes, and settings changes — retained for administrative accountability
• Usage and diagnostic logs: IP address, browser type, and request metadata — retained for 72 hours and then automatically deleted
• HubSpot synchronisation status and retry logs

5. How We Use Your Information

• Booking delivery — to receive prospect form submissions, evaluate routing rules, display available slots, and create calendar events on behalf of the tenant
• Calendar management — to create, update, and cancel calendar events on salesperson calendars via Google Workspace or Microsoft 365 OAuth
• HubSpot synchronisation — to upsert prospect contact records and create meeting-activity records in the tenant’s HubSpot instance
• Reschedule & cancellation — to validate secure management tokens and process prospect-initiated changes
• Admin operations — to provide tenant admins with booking dashboards, routing tools, salesperson management, and audit history
• Security & reliability — to detect abuse, apply rate limits to public booking endpoints, maintain idempotency, and respond to incidents
• Legal compliance — to comply with applicable laws and protect our legal rights

6. Legal Basis for Processing

We process personal data on the following legal bases:

• Contract — processing necessary to deliver the SmartCal service to the tenant under the applicable service agreement
• Legitimate interests — processing necessary for SR PRO’s legitimate interests in operating and improving SmartCal (e.g. audit logging, security monitoring), where these do not override the rights of individuals
• Legal obligation — processing required to comply with applicable law
• Consent — where a prospect has submitted a demo-request form indicating consent to be contacted by the tenant (the tenant is responsible for obtaining and documenting this consent)

7. Prospect Data & Tenant Responsibility

Prospects interact with SmartCal via a tenant-branded booking page. SR PRO processes prospect personal data as a data processor acting on the tenant’s instructions. The tenant is the data controller for prospect data and is responsible for:

• Ensuring the demo-request form (hosted on the tenant’s website, e.g. via Webflow) includes an appropriate privacy notice informing prospects that their data will be used to schedule a meeting and processed by SmartCal
• Obtaining any consent required by applicable law before prospect data is submitted to SmartCal
• Defining and communicating prospect data retention periods, which SR PRO will implement per the tenant’s instructions in the applicable service agreement
• Responding to prospect privacy rights requests (access, deletion, correction) that do not require SR PRO’s direct involvement; SR PRO will assist the tenant in fulfilling such requests

Prospects who wish to exercise a privacy right (such as deletion of their booking record) should contact the organisation whose demo they requested. SR PRO will fulfil requests that require direct action on our systems upon instruction from the tenant or, where the tenant is unavailable, upon direct request to privacy@srpro.marketing.

8. Data Retention

• Salesperson OAuth tokens — retained while the salesperson’s calendar connection is active; deleted immediately upon disconnection or tenant offboarding
• Booking records — retained for the duration of the tenant’s engagement with SR PRO and for the period specified in the applicable service agreement; cancelled bookings are retained for audit and reporting purposes
• Prospect personal data — retention periods are defined per tenant in the applicable service agreement and implemented by SR PRO on the tenant’s instruction. SR PRO does not apply a uniform prospect retention period across all tenants.
• Audit history records — retained for the duration of the tenant’s engagement and for a reasonable period thereafter for dispute resolution and accountability
• Usage and diagnostic logs — retained for 72 hours, then automatically deleted
• Tenant admin account data — retained until the workspace is closed; deleted within 30 days of tenant offboarding

Upon expiration of the applicable retention period or upon tenant offboarding, data is securely deleted using AES-256 cryptographic erasure or provider-certified deletion methods. All deletion events are logged.

9. Security

We take reasonable and appropriate technical and administrative measures to protect personal information, including:

• Encryption of OAuth tokens and sensitive data at rest (AES-256-CBC) and in transit (TLS 1.2 minimum, TLS 1.3 preferred)
• Provider credentials and OAuth tokens are kept server-side only and are never exposed in the SmartCal interface or included in logs
• Secure, opaque, booking-scoped management tokens for prospect-facing reschedule and cancellation — no persistent prospect login or account is created
• Tenant-aware authorisation on every request — one tenant cannot access another tenant’s bookings, routing rules, salesperson credentials, or prospect data
• Rate limits applied to all public booking intake and management endpoints to prevent abuse
• Idempotency controls on booking creation to prevent duplicate calendar events
• Personal data is redacted from diagnostic logs before the 72-hour retention window
• Access controls limiting data access to authorised SR PRO personnel on a need-to-know basis
• Incident response procedures to address any unauthorised access or data breach
• 24-hour cyber incident response coverage through CFC Underwriting (Lloyd’s of London syndicate)

No system is completely secure. If you believe your data may have been compromised, contact us immediately at privacy@srpro.marketing.

10. Sub-Processors

SmartCal uses the following sub-processors to operate the service. All sub-processors are contractually bound to handle data in compliance with applicable privacy laws and our data protection obligations. SR PRO notifies tenants of any material sub-processor changes at least 30 days in advance.

Tenants who deploy SmartCal using their own HubSpot instance are themselves responsible for their HubSpot DPA. SR PRO’s access to the tenant’s HubSpot environment is governed by the applicable service agreement.

11. Cookies & Similar Technologies

SmartCal uses cookies and similar technologies to operate the service.

• Essential / session cookies — required for admin authentication and core booking-flow functionality; cannot be disabled without impairing the service
• Preference cookies — remember admin settings and workspace configuration between sessions

SmartCal does not use analytics tracking cookies or serve interest-based advertising. Prospect-facing booking pages do not set any SmartCal cookies beyond those strictly necessary to complete the booking flow.

You may disable cookies through your browser settings; disabling essential cookies may prevent the SmartCal admin interface from functioning correctly.

12. International Data Transfers

SmartCal’s primary infrastructure is hosted by DigitalOcean in Amsterdam, the Netherlands (EU). SR PRO Group’s operational staff in the United States access this data to provide the managed service, which constitutes a transfer of personal data from the EU to the US.

• EU / EEA tenants and prospects: we rely on Standard Contractual Clauses (SCCs) as the legal mechanism for transfers of personal data from the EU to SR PRO’s US-based personnel.
• UK tenants and prospects: transfers from the United Kingdom to the United States are covered by the UK-US Data Bridge framework and/or the UK International Data Transfer Agreement (UK IDTA).
• US tenants and prospects: data is processed by a US company and stored on EU servers. No additional transfer mechanism is required for US-to-EU data flows.
• Israeli tenants: served under SR Professional Marketing Ltd (Israeli entity). Israel has been recognised by the EU as providing adequate data protection; no additional transfer mechanism is required for Israel-EU data flows.

13. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data processed by SmartCal. To exercise any right, contact privacy@srpro.marketing. We will respond within 30 days.

Note for prospects: as SR PRO acts as a data processor for the tenant, your primary point of contact for privacy rights is the organisation whose demo you requested. SR PRO will fulfil requests directly where the tenant’s involvement is not required or available.

13.1 All users

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data (subject to legal and contractual retention requirements)
• Withdrawal of consent — salespersons may revoke calendar OAuth access at any time via their Google or Microsoft account settings, which immediately disables SmartCal’s access to their calendar

13.2 EU / EEA & UK users (GDPR / UK GDPR)

• Portability — request a machine-readable copy of your data
• Objection / Restriction — object to or restrict certain processing activities
• Complaint — lodge a complaint with your supervisory authority (UK: ICO at ico.org.uk; EU: your national DPA)

13.3 US residents (including California — CCPA)

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale of personal information (SR PRO does not sell personal data)
• Non-discrimination for exercising privacy rights

13.4 Israeli residents

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information where processing is no longer necessary

14. Children’s Privacy

SmartCal is a B2B demo-booking platform directed at business professionals. It is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected such information, we will delete it promptly. Contact privacy@srpro.marketing if you believe a minor has been included in a booking.

15. Privacy Contact

SR PRO Group has designated a Privacy Contact responsible for data protection enquiries and oversight of this Privacy Policy. SR PRO Group is not legally required to appoint a formal Data Protection Officer under GDPR Article 37; however, we are committed to handling all privacy matters with the same diligence and responsiveness.

Privacy Contact: privacy@srpro.marketing

We will acknowledge your request within 5 business days and respond in full within 30 days.

16. Governing Law

This Privacy Policy is governed by the laws of the State of Maryland, United States, without regard to its conflict-of-laws principles. Any disputes arising out of or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the state and federal courts located in Montgomery County, Maryland.

For UK residents, nothing in this clause limits your right to bring a complaint before the UK Information Commissioner’s Office (ICO). For Israeli residents, nothing in this clause limits your rights under the Israeli Privacy Protection Law 5741-1981.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Revised” date at the top of this page. If changes materially affect how we process Google or Microsoft user data, or how we handle prospect personal data, we will notify tenant admins by email at least 14 days before the changes take effect.

Continued use of SmartCal after the effective date of any changes constitutes acceptance of the revised Privacy Policy.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

SR PRO Group
6903 Tilden Lane, Rockville, MD 20852, United States
Privacy & data requests: privacy@srpro.marketing
Product website: https://smartcal.org
Phone: +1 917 775 6516