Privacy Policy

Last updated: 2026‑05‑30 · Effective immediately

This Privacy Policy describes how Bernhard Consulting and Holdings, Ltd., a company doing business as DoxaBlox, Doxa, DoxaCal, and Chai ("we," "us," the "Operator"), collects, uses, and discloses personal information in connection with the DoxaCal service and its related brands (the "Service"). It is intended to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA, Canada) and the Personal Information Protection Act (PIPA, British Columbia), and applicable carrier requirements for SMS messaging.

1. Information We Collect

1.1 Information you give us

Account information — name, email address, and, if you set one, a password (stored only in hashed form).
Phone number — if you enter one to receive SMS notifications, attach it as an identity key, or invite someone by text.
Calendar content — if you connect Google Calendar, Apple iCloud, or another integration, we receive event titles, times, attendees, and related metadata necessary to compute availability and write events back when you choose.
Booking and scheduling data — booking pages you create, share links, slot holds, polls, and the votes or responses submitted by participants.
Communications — messages you send to us (support emails, feedback).

1.2 Information collected automatically

Device & usage — browser, OS, IP address, pages viewed, and timestamps, used to operate, secure, and improve the Service.
Cookies and similar technologies — to keep you signed in, remember preferences, and measure aggregate usage. You can disable non‑essential cookies through your browser; essential cookies are required for the Service to function.

1.3 Information from third parties

If you sign in with or connect a third‑party account (e.g., Google), we receive the information you authorize that provider to share with us, subject to your settings there.

2. How We Use Your Information

Provide, operate, secure, and improve the Service;
Compute mutual availability and present scheduling options;
Send transactional messages (account verification, booking confirmations, room invitations, poll completions, reminders, and account‑related alerts) by email or SMS;
Detect and prevent abuse, fraud, and security incidents;
Comply with legal obligations and enforce our Terms.

We do not use your information to advertise to you, and we do not sell or rent personal information.

3. SMS Messaging — Specific Disclosures

Plain‑language summary: if you give us a phone number, we will only text you about the scheduling activity tied to your account or rooms you joined. You can stop receiving SMS at any time by replying STOP. We do not share your phone number with advertisers, and we do not sell it. Mobile information collected for SMS will not be shared with third parties or affiliates for marketing or promotional purposes.

SMS is sent through our service provider Twilio, which acts as a data processor on our behalf and is contractually restricted to processing your information for the purpose of delivering messages.
Reply STOP to any message to opt out of further SMS from us. Reply HELP for help.
Message and data rates may apply through your carrier. Message frequency varies with your activity.
Opting out of SMS does not remove your account or prevent you from receiving equivalent notifications by email.

4. When We Share Information

We share personal information only as follows:

With your direction — for example, when you share a booking page, send an invitation, or join a scheduling room, the people you involve will see the information necessary to participate (such as your name, the candidate times, and your votes).
With service providers — vendors who help us operate the Service under contractual confidentiality obligations, including: BeanHive (hosting and database), Twilio (SMS delivery), AWS Simple Email Service (email delivery), Google (calendar integration), and Apple (calendar integration).
For legal reasons — to comply with a valid legal process, enforce our Terms, or protect the rights, property, or safety of DoxaCal, our users, or the public.
Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

We do not sell personal information, do not rent it, and do not disclose it for cross‑context behavioural advertising.

5. Calendar Data — Scope and Handling

When you connect a calendar, we read only what is necessary to provide the Service: free/busy windows and, where you opt in, full event details for the calendars you select. We do not modify your calendar without your action, and we write to your calendar only when you create or accept a booking. You can disconnect a calendar at any time from the Integrations page; on disconnection, we cease ongoing reads and delete cached event data within 30 days.

Where a participant in a scheduling room grants a one‑time calendar permission, availability is used transiently to compute conflict flags for that session only and is not stored beyond the session. A continuous link is stored only after the participant has validated their identity.

6. Data Retention

We retain personal information for as long as your account is active, as needed to provide the Service, and as required to meet legal, accounting, or reporting obligations. Specific retention windows are configurable per user and per region; we apply the policy associated with your account. You may request deletion of your account and associated data through your settings or by contacting us; we will honour such requests subject to legal retention obligations.

History associated with an unvalidated identity key is segregated from interactive access and retained only for legal, audit, and dispute‑resolution purposes, under a retention policy that is editable and reviewable on request.

7. Data Security

We protect personal information with industry‑standard safeguards, including encryption in transit (TLS), encryption at rest where supported by our hosting provider, access controls, and routine security review. No method of transmission or storage is fully secure; we cannot guarantee absolute security.

8. Your Rights

Subject to applicable law, you have the right to:

Access the personal information we hold about you;
Request correction of inaccurate or incomplete information;
Withdraw consent for processing (subject to legal or contractual restrictions);
Request deletion of your account and associated personal information;
Lodge a complaint with the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or the Commission d'accès à l'information du Québec.

To exercise these rights, email legal@doxacal.com.

9. International Transfers

The Service is operated from Canada and may use service providers located in the United States and other jurisdictions. Where personal information is transferred outside Canada, it may be subject to the laws of the receiving jurisdiction (including lawful access by their authorities). We require service providers to apply protections consistent with this Policy.

10. Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Changes to this Policy

We may update this Policy from time to time. We will revise the "Last updated" date above and, for material changes, will notify you through the Service or by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact

Bernhard Consulting and Holdings, Ltd. — Legal & Privacy
Email: legal@doxacal.com
Postal: 4106 av de l'Hôtel-de-Ville, Montréal, Québec, H2W 2H1, Canada

This Policy is governed by the laws of the Province of British Columbia and the federal laws of Canada applicable therein.