Privacy policy · Valkyra Labs

Who we are and what this covers

Valkyra Labs operates this website and uses Valkyra CRM to manage its enquiries and meeting bookings. This policy explains how we handle information through those services, including an optional Google Calendar connection for meeting hosts.

If you use a CRM workspace operated by another business, that business manages its customer records and decides how they are used. Contact that workspace operator about its records; our role and any additional processing terms are set out in the relevant service agreement.

For a privacy question or request, use our website enquiry form and write “Privacy request” in your message. We will use the contact details you provide to respond. Do not include passwords, access tokens or unnecessary sensitive information.

Information we handle

Enquiries: your name, email, any optional details you provide, your message, submission time and the source of your enquiry.
Meetings: attendee contact details, chosen time and timezone, meeting notes you supply, booking status, and the appointment identifier or meeting link returned by the calendar provider.
Connected hosts: Google account email, primary-calendar timezone, connection status and authorization credentials. The Google Calendar section below explains these separately.
Technical information: request and security logs handled by our infrastructure, such as IP address, browser information, referring page, time and error details.
Referral links: when you follow one of our tracked links, its identifier, click time, browser information, referring page, host and a derived IP value may be sent to our link-measurement service. A derived IP value is not a guarantee of anonymity.

We use this information to answer enquiries, arrange meetings, maintain business records, carry out requested follow-up work, understand referral activity and protect the service from misuse. Sending an enquiry does not by itself subscribe you to unrelated marketing.

Google Calendar connection

Connecting a calendar is optional and belongs to the signed-in CRM member. Website visitors can request a meeting without connecting a Google account. Booking only becomes available after a host connects a calendar, confirms working hours and is selected as the website meeting host.

What we access and why

Account identity: OpenID and email identify the consenting Google account and check that its email is verified.
Calendar list: read access lets the integration find the primary calendar, its timezone, access role and supported conference features.
Availability: free/busy access checks occupied time ranges so visitors are offered available times.
Owned-calendar events: the permission Google grants allows reading, creating, changing and deleting events on calendars the host owns. Our current integration uses the primary calendar to create requested appointments and look up appointments it created when confirming or recovering a booking.

The requested Calendar scopes are calendar.calendarlist.readonly, calendar.events.freebusy and calendar.events.owned, together with identity/email access. The integration does not request Gmail inbox or Google Drive access.

How booking data is used and shared

We compare working hours, Google free/busy information and existing CRM reservations. Visitors receive bookable times; private titles and descriptions from the host’s other events are not exposed by the availability response.

To create an appointment, we send Google the booking time, host/attendee information and relevant meeting details. Google may send an invitation and provide a Google Meet link. The attendee, host and authorized workspace users can see the booking details needed to arrange and manage that meeting. A confirmed booking can create a CRM contact, submission and meeting-preparation task.

Storage and safeguards

The CRM stores connection metadata and booking records in its database. Refresh credentials are held in Supabase Vault and used by the server to refresh authorization; they are not placed in public website code or returned by the booking widget. Data is transmitted over HTTPS. We do not copy the host’s whole calendar into the CRM.

Limited Use

Our use and transfer of Google data follows the Google API Services User Data Policy, including its Limited Use requirements. Google data is used to provide the calendar and booking features described here. It is not sold, used for advertising, or used to train general-purpose AI models.

We do not allow unrelated human access to Google data. Outside the booking features you authorize, access is limited to your specific consent, necessary security investigations or legal requirements.

Disconnecting and removing data

Use Widgets or Integrations → Disconnect my calendar in the CRM to disable the connection for bookings. You can also revoke access from your Google Account’s third-party connections. The CRM attempts Google revocation when disconnecting; use Google’s controls if you need to confirm access has been revoked.

Disconnecting does not automatically delete existing Google Calendar events, invitations or CRM business records. To request deletion of stored connection details, credentials or associated CRM records, contact us. We will verify the request and explain any records that must be retained. Deleting a CRM record does not recall invitations or copies held by other meeting participants.

Browser storage and external content

The website saves a theme preference in browser local storage. CRM enquiry and booking widgets may keep a request reference in the browser so a retry can be recognized instead of creating a duplicate submission. Infrastructure providers may use cookies or similar mechanisms for security and service delivery.

You can clear browser storage or restrict external content through your browser. Doing so may reset preferences or affect form loading and retry recovery. External links and embedded previews have their own privacy practices.

Retention and security

We retain information for the purposes described here, including responding to enquiries, managing services and appointments, security, resolving disputes and meeting applicable legal obligations. The period depends on the record and its purpose; we do not promise immediate deletion of every backup or another participant’s copy.

We use access controls and service safeguards appropriate to the information. No online service can guarantee absolute security. If you believe your account or information is at risk, contact us without sending credentials through the enquiry form.

Your choices and privacy requests

You may ask about the information we hold, request access or correction, request deletion, raise a privacy complaint, or withdraw optional permissions. We may need to verify your identity and authority before acting, and will explain any applicable limit on a request.

Use the contact form, identify the relevant enquiry, booking or workspace, and describe your request. We will assess it and respond using your supplied contact details. If you are dissatisfied, you may contact the privacy regulator relevant to your location where applicable.

The website and meeting features are intended for business and professional use and are not directed at children. Please do not submit another person’s information without authority.

Changes to this policy

We will update this page when these practices change and show the revision date above. Where a change requires new consent, including a new use of Google data, we will request that consent before using data for the new purpose.

See our terms of use for website and booking conditions.