Last Updated: October 5, 2026
1. Introduction
Hetk Technologies OÜ (Registry Code: 17181483) operates the calendar synchronization service at hetk.io (“Service”). This policy explains how we handle your personal data.
Contact: [email protected]
2. Information We Collect
Account Information
You sign in with Google or Microsoft. Apple iCloud calendars are connected afterwards with an app-specific password. When you sign in, we receive:
- Email address
- Display name
- Profile picture URL
Legal basis: Contract performance (to create and manage your account)
Calendar Data
To sync your calendars, we access:
- Event details (title, time, location, attendees)
- Calendar names
- Free/busy status
What we store: Event content (titles, descriptions, locations, attendees) is processed in memory during sync and not stored. We retain minimal sync metadata (event identifiers, change tokens, and event timing) to detect changes and prevent duplicates. This metadata is deleted when you remove a sync relationship, and its change history within 1 month. To debug the service, we also keep scrubbed records of the requests we exchange with Google, Microsoft and Apple: they contain no event text (no titles, descriptions, locations or email addresses), only scrambled codes that cannot be turned back into that text, and we delete them after 7 days (backup copies expire within a further 7 days).
Legal basis: Contract performance (to provide the sync service you requested)
Payment Information
Stripe processes payments. Hetk sends Stripe your email, your plan and an internal account ID. You enter card details directly with Stripe. Hetk stores only Stripe’s reference IDs, and asks Stripe for your card’s brand, last 4 digits and expiry when it shows them to you.
We never see or store your full card number.
Legal basis: Contract performance (to process your subscription)
Usage Data
We collect basic usage data:
- Login timestamps
- Feature usage statistics
- Error logs
- Signup source: when you sign up, we add one to a monthly count of which website or campaign referred you and which page you first viewed on hetk.io (short names only, never the full address). The count is not linked to your account, and no cookies are used for it.
Legal basis: Legitimate interest (to improve the service and fix bugs)
3. Google Calendar Data
Hetk’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What We Access
When you connect a Google Calendar account, we request access to:
- Your calendar list (names and identifiers)
- Calendar events (title, time, location, attendees, description, free/busy status)
- Event change notifications (via Google Calendar push notifications)
How We Use Google Data
We use Google Calendar data solely to provide the calendar synchronization service you requested. Specifically, we:
- Read events from your Google Calendar to sync them to your other connected calendars
- Write events to your Google Calendar when syncing from your other connected calendars
- Monitor for changes via webhooks to keep your calendars in sync
How We Store Google Data
- Google OAuth tokens are encrypted before storage and stored in Azure SQL within the EU
- Event content (titles, descriptions, locations, attendees) is processed in memory during sync operations and not stored
- Sync metadata (event identifiers, change tokens, content hashes, event timing) is stored to detect changes and prevent duplicates while a sync relationship is active
- Sync metadata is deleted when you remove a sync relationship or disconnect your Google account, and its change history within 1 month
How We Share Google Data
Google Calendar data is shared only with the destination calendar provider(s) you have configured in your sync relationships (e.g., Microsoft Outlook, Apple iCloud). We do not share Google data with any other third party.
What We Do NOT Do with Google Data
- We do not use Google data for advertising, retargeting, or interest-based marketing
- We do not sell, lease, or trade Google data to third parties, data brokers, or information resellers
- We do not use Google data for purposes unrelated to the calendar sync functionality
- We do not allow humans to read your Google data unless you give explicit consent, it is necessary for security purposes, or it is required by law
Revoking Access
You can revoke Hetk’s access to your Google account at any time:
- From within Hetk: disconnect your Google Calendar account in Settings
- From Google: visit Google Account Permissions and remove Hetk
If you revoke access, Hetk stops the syncs that use that account as soon as it next tries to use it, usually within an hour. A revoked token stops working at once. When Hetk notices the revocation, it deletes the tokens it stored for that account, and a weekly cleanup deletes any that were not deleted then. Until Hetk notices, it keeps them encrypted. Unlinking the account or deleting your Hetk account deletes them at once. Backup copies of deleted tokens expire within 7 days.
4. How We Use Your Information
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Provide calendar sync | Calendar data, OAuth tokens | Contract |
| Process payments | Payment info | Contract |
| Send service emails | Email address | Contract |
| Improve the service | Usage data | Legitimate interest |
| Prevent fraud | Account data, logs | Legitimate interest |
5. How We Share Your Information
We do not sell your personal data.
We share data only with:
| Recipient | Purpose | Data Shared |
|---|---|---|
| Google, Microsoft, Apple | Calendar sync | Calendar data via OAuth |
| Stripe | Payment processing | Email, plan, internal account ID |
| Microsoft Azure Communication Services | Transactional emails | Email address |
| Microsoft Azure | Hosting | All data (encrypted) |
| Cloudflare | Security & CDN | Traffic data |
We may also disclose data if required by law.
6. Data Storage & Security
Where We Store Data
- Primary: Microsoft Azure, North Europe (Ireland)
- Backups: Azure SQL geo-redundant backups, stored in North Europe (Ireland) and its paired Azure region, West Europe (Netherlands)
Hetk stores your data in the EU (Microsoft Azure, North Europe). Payment, network and email processors such as Stripe, Cloudflare and Google may process some data outside the EU under their own data-transfer safeguards.
Security Measures
- TLS 1.2 or newer encryption in transit
- Database encrypted at rest (Azure SQL transparent data encryption)
- OAuth tokens encrypted before storage
7. Your Rights
Under GDPR, you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your account and data (with one narrow exception: the free-trial record described in section 8, which we keep to enforce the one-trial-per-account limit)
- Export your data (portability)
- Object to processing based on legitimate interest
- Disconnect any calendar account, or delete your Hetk account, at any time
To exercise your rights: Email [email protected]. We respond within 30 days.
To complain: You can lodge a complaint with the Estonian Data Protection Inspectorate:
- Website: aki.ee
- Email: [email protected]
8. Data Retention
| Data Type | Retention Period |
|---|---|
| Active account data | While account is active |
| Cancelled or expired accounts | Deleted after 30 days of inactivity; logging in keeps your account |
| Sync metadata | While sync relationship is active; deleted on removal, and fully gone (including settings and copy history) within 1 month |
| Payment records | 7 years (legal requirement) |
| Server logs | 90 days |
| Account deletion record | Kept indefinitely — the date an account was deleted, why, and how many sync records were removed. Contains no email address, name, or calendar content |
| Free-trial record | Kept indefinitely, and survives account deletion — a one-way, keyed fingerprint of the sign-in identifier your calendar provider gives us (your Google, Microsoft or Apple account ID), together with the start and end dates of each free trial. We do not keep the account ID itself, and once you delete your account the record is no longer linked to it. We keep it so the 21-day free trial cannot be taken repeatedly by deleting and re-creating an account. It contains no email address, name, payment detail, or calendar content, and we do not use it for anything else |
9. Cookies & Tracking
We use minimal cookies:
- Essential cookies: Session management only
- Analytics: Cloudflare Web Analytics (privacy-focused, no personal data collected)
We do not use:
- Advertising cookies
- Third-party tracking pixels
- Cross-site tracking
10. Additional Information
Children
Our service is not for users under 16. We don’t knowingly collect data from children.
Third-Party Links
Our site may link to external services. We’re not responsible for their privacy practices.
Changes to This Policy
We’ll notify you of significant changes via email. Minor updates will be posted here with an updated date.
11. Contact Us
Hetk Technologies OÜ Registry Code: 17181483 Email: [email protected]
Supervisory Authority Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) Website: https://www.aki.ee Email: [email protected]