lexcv.cal Privacy Policy

Version: 6 October 2026.

1. Who is responsible

Lexcv Limited, registered in England and Wales ("Lexcv", "we", "us"), operates lexcv.cal and determines how personal information is used for the service. We are the controller for these purposes and, where applicable in India, the Data Fiduciary. This notice covers the app and its supporting account, calendar, profile, contact and sharing services. Independent providers have their own privacy notices.

Contact the Lexcv Privacy Team at info@lexcv.co for privacy questions, rights requests or complaints, using the subject "Privacy". Identify the account or information concerned, but do not send your password, session tokens or unnecessary identity documents. You can contact us even without an account.

2. Information and purposes

Information comes from you, your device and service interactions, people who invite or share with you, Lexcv account/profile records, and authentication or purchase providers you choose. We process the following categories for the stated purposes:

• Account and identity: email/login identifier, account identifiers, credentials and tokens, verification/recovery information, and names, telephone and date of birth supplied during onboarding. These support registration, authentication, account administration, recovery and account-safety checks. The current onboarding form requires first name, last name, telephone and date of birth; it cannot be completed without them. Public profile information is described separately below.
• Calendars and events: calendar names, descriptions, ownership, visibility and permissions; event titles, descriptions, entered locations, dates, times, time zones, recurrence, status, availability, organiser/attendee identities and responses, identifiers and changes. We store, retrieve, search, synchronise and update these to provide scheduling and collaboration. Event content is sent to Lexcv servers.
• Reminders and notifications: reminder methods, offsets and occurrences, recipient/device identifiers, notification records and delivery/sync acknowledgements. These support reminders, email delivery where selected, local alarms and notification history. Notification permission affects device display, not whether the underlying event is stored on servers.
• Profiles and media: names, headline, description, organisation, public email, telephone, website, profile photograph and banner where provided. These support your profile and identification in search, contacts, invitations and shared calendars. Uploaded media is processed by our services and media-delivery infrastructure.
• Contacts and sharing: contact identifiers/names, relationship requests, acceptances, blocks, contact notes/tags, calendar invitations and access permissions. These support your address book, relationships, access controls and sharing instructions. Other people may supply your details before you register.
• Devices and settings: installation/device identifiers, device label/type, operating system, app version and metadata, time zone, linked sessions and sync state. These support security, device management and synchronisation. Preferences such as language, theme and calendar settings support your requested experience. Some settings and caches remain local; relevant account settings and device records also go to servers.
• Subscriptions and purchases: product/plan identifiers, purchase tokens/references, entitlement and verification results, renewal/cancellation information, and device/trial eligibility where used. These support purchased access, billing verification, fraud prevention and accounting. Google handles Google Play checkout under its own terms; Lexcv's calendar forms do not ask for payment-card details.
• Operations and support: connection/IP and request metadata, timestamps, errors, security/diagnostic records, and support/privacy correspondence. These support authentication, abuse prevention, troubleshooting, incident investigation and reliability. Diagnostics may contain request/response content. Check logs for credentials and personal information before sending them to anyone.

The app does not request device GPS or device-address-book access. An event location or contact you enter yourself, and network information such as an IP address, may nevertheless identify you or others. We do not collect usage-behaviour information except for internal operational monitoring. We do not use advertising identifiers or create advertising or cross-service behavioural profiles.

3. Legal grounds and permission

UK and EEA: we process information necessary to deliver the account, calendar, synchronisation, sharing and subscription services you request to perform our contract with you or take requested steps before that contract. This does not make every possible use necessary. We rely on legitimate interests for proportionate security, fraud/abuse prevention, internal reliability monitoring, support and handling other people's details in invitations and relationships, subject to their rights. Where records or disclosures are required by law, we rely on the applicable legal obligation.

Your agreement and service instructions: by using the Service, you agree to the processing of your information for the purposes and in the manner described in this policy, subject to applicable law. If you do not agree to the processing necessary to provide the Service, do not use the Service. Creating an event, requesting a reminder, saving a public profile or choosing recipients instructs us to perform that function as described here. This agreement does not authorise unrelated purposes or waive statutory privacy rights.

Your choices and rights: you choose what events, profile content and sharing instructions to submit. You may stop using the Service and request account deletion. Where processing legally depends on consent, you may withdraw it by contacting the Privacy Team; withdrawal does not affect earlier lawful processing. We may then be unable to provide the affected function. Using the Service does not waive statutory rights or replace any additional permission required by applicable law.

We apply the legal requirements relevant to your jurisdiction, including India and applicable US states. Processing that requires an additional legal permission or safeguard must not take place without it.

4. Public profiles and sharing

A public profile is not a private account record. Published names, pictures and profile fields can appear in search results, contacts and collaboration. In particular, public email and profile telephone fields can be disclosed in profile views. Do not publish information you want kept private. Login/recovery information and public contact fields are not necessarily the same.

Calendar owners, collaborators, invitees and attendees receive information according to the function and relevant permissions. Sharing may disclose your identity, event details and other participants' information. Review the audience and access rights before saving or sharing. Availability-only access differs from full event access.

Changing permissions or deleting your copy cannot recall a recipient's screenshot, export, email or independently held copy, and does not automatically delete someone else's event. This does not remove our duties to respond to valid rights requests or notify recipients where required.

If you add another person's information, have a lawful reason, provide appropriate information and obtain permission where required. Your agreement is not their consent. Avoid unnecessary private details in descriptions, contact notes and invitations. Contact us about information published or shared improperly.

5. Recipients and service providers

• Other people: calendar owners, collaborators, invitees, attendees and viewers of published profile information, according to the service function and its permissions.
• Service infrastructure and personnel: hosting, replication, storage/backup, media delivery, communications, security and support providers, and authorised personnel who need access for those purposes. Our requirements for providers processing data on our behalf are written terms limiting use to our instructions, confidentiality and appropriate security, assistance with rights requests and incidents, controlled subcontracting, and return or deletion of data when their work ends. They must not use that data for their own advertising or unrelated profiling.
• Google, when used: Google/Firebase authentication for Google sign-in on supported platforms, and Google Play for purchases and subscription management. Relevant account, device or transaction information is processed under those providers' notices. Google sign-in does not itself grant access to a Google Calendar. Lexcv calendar storage is not Google Calendar storage.
• Legal or corporate recipients: authorities, advisers or transaction counterparties where necessary and lawful for legal obligations, valid requests, protection of rights or a business restructuring. A restructuring does not remove applicable protections and purpose limits.

We do not sell personal information, disclose it to advertisers or share it for cross-context behavioural advertising. User-directed calendar/profile sharing is a service function, not advertising-data sharing.

6. Server storage and international replication

Account, event and other service data is held on servers and replicated internationally for operation, synchronisation, availability and recovery. Copies or authorised access may be outside your country, including outside the UK/EEA. Laws and government-access rights differ between countries. We do not promise device-only storage or storage solely within your home country.

Our requirements for restricted international transfers include an applicable adequacy decision or recognised safeguards, such as the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Agreement or Addendum, with the required assessments and additional protections. Indian and other applicable transfer restrictions must also be observed. These safeguards are separate from your agreement to use the Service. Contact the Privacy Team for processing locations, recipients and applicable safeguards, including a copy where appropriate with confidential material redacted.

7. Retention and deletion

Retention must be limited to the relevant purpose and applicable legal requirements. The criteria vary by category:

• Account and content: while needed to maintain the account or calendars, events, profiles and relationships concerned, subject to deletion requests and other people's rights in shared records.
• Sessions, sync records and caches: while needed for access, device management, synchronisation or requested local functionality. Signing out or uninstalling does not delete your server account.
• Operational/security records: for the limited period justified by troubleshooting, investigations and abuse prevention. Internal monitoring does not justify keeping all event content indefinitely.
• Purchase, legal and complaint records: as necessary for applicable accounting, tax, disputes, fraud prevention or legal preservation, limited to the relevant purpose.
• Replicas and backups: deletion must propagate to active systems and be addressed in recovery procedures. An in-app deletion is not a claim that every backup copy disappears instantly. Residual copies must remain access- and retention-limited and must not restore deleted information to ordinary use contrary to a valid request.

Request account deletion through Settings → Account → Delete account or by emailing us. The app submits a request to the identity service and signs out after acceptance; that response is not proof that every server copy has already been erased. Ask us about scope and progress. Identity-account deletion may affect other Lexcv services attached to that account. It does not itself cancel a store subscription; manage that separately with the store.

The standard in-app deletion process schedules the account for permanent deletion after a 30-day waiting period. A successful sign-in while deletion remains pending cancels the request and restores the account. The waiting period is not a promise that every replica, backup or legally retained record is erased within 30 days. Permanent processing depends on the deletion workflow and any applicable legal hold. Contact us if you need to exercise an erasure right without restoring the account, or if you are the sole owner of a shared workspace and the in-app request cannot proceed.

8. Security, local storage and notifications

The client uses encrypted network connections to Lexcv services and platform storage facilities for persisted sessions. The service processes calendar/profile content; this is not a claim of end-to-end encryption or that Lexcv cannot access it. No system guarantees absolute security. Protect credentials, review linked devices and restrict access to your device.

Local storage supports sessions, device identifiers, preferences, caches and reminder schedules, as appropriate to the platform. Browser storage and operating-system backups depend on the platform. We do not use advertising trackers. Our no-sale/no-advertising practices apply whether or not a browser sends Do Not Track or an applicable universal opt-out signal.

Reminders can appear in operating-system notifications, including lock-screen previews according to device settings; email reminders pass through email systems. Anyone with access to the device, account or mailbox may see them. Choose notification previews, permissions and delivery methods accordingly.

9. Rights and regional information

Use the contact in section 1. We may need proportionate verification of identity or an agent's authority, but not your password. We respond within the applicable legal period and explain any lawful refusal, limitation or extension. Exercising rights does not justify unlawful discrimination.

United Kingdom and European Economic Area

Depending on the circumstances, you may access/copy, correct, erase or restrict information, obtain portable data, object to legitimate-interest processing and withdraw consent. You may complain to the UK Information Commissioner's Office or your local EEA supervisory authority without complaining to us first. Rights requests normally require a response within one month, subject to lawful extensions.

We do not use calendar content for advertising profiles or automated credit, employment or insurance decisions. Automated authentication, access, subscription and abuse controls do operate. Contact us about a restriction you believe is wrong, or for information and applicable review rights concerning a decision affecting you.

India

Where applicable and in force, the Digital Personal Data Protection Act and Rules provide rights to information about processing, correction/completion/updating and erasure, grievance redressal, consent withdrawal, and nomination of another person to exercise rights in the circumstances specified by the Act. Consent requests must clearly identify the data and purpose and provide the language choices required by law. Raise requests or grievances with our privacy contact. After using the required grievance route, you may complain to the Data Protection Board of India through its available official process.

The DPDP framework has phased commencement; this notice does not claim every provision is already in force. Existing Indian requirements, including those concerning sensitive personal data, also matter during the transition. International processing remains subject to applicable restrictions, not blanket permission.

United States

Where the relevant state law applies, rights may include access to categories/specific information, portability, correction, deletion, appeals against refusals, and opting out of sale, targeted advertising or certain significant-effect profiling. We do not carry out the sale or advertising activities described above, or use sensitive information to infer characteristics for advertising.

For California residents, sections 2–5 identify the service's categories, sources, purposes and recipients, and section 7 explains retention criteria. Identifiers/credentials, contact/customer records, user content, pictures, purchase records and technical network activity can fall within California categories, including sensitive information where applicable. You or an appropriately authorised agent may request action. Qualifying California requests normally require a response within 45 days, with a notified extension where permitted. Where state law provides an appeal, email "Privacy appeal"; you may also complain to your state attorney general or privacy regulator.

10. Sensitive information and children

Calendar or profile text can reveal health, religion, politics, sexual life/orientation or other sensitive information even without a dedicated form. Avoid unnecessary sensitive details and do not add another person's without an appropriate legal basis and any required permission. Entering text is not a substitute for explicit consent or other special protections where required. Public posting is not a general waiver of rights.

The Service is intended for people aged 18 or over. Do not create an account if you are under 18. If you believe a child has supplied personal information, contact the Privacy Team so we can investigate, restrict the account and address the information as required by law. This age restriction does not remove protections that apply to children's information supplied by another user, such as details in a family calendar.

11. Changes

We identify published notices by version/date and provide notice of material changes as required. A revised notice or continued use does not retrospectively authorise new purposes. Fresh consent must precede a new consent-based use where required. This notice does not replace specific notices or permissions required for particular features, sensitive information or jurisdictions.

Privacy contact: info@lexcv.co