Privacy Policy — Sapienti Booking Appointments

Last updated: 07 September 2026

This policy describes how Sapienti Booking Appointments uses personal information when you request or manage an appointment, connect a Google account, or attend an associated Google Meet meeting. The service operates through centrosapienti.com and book.centrosapienti.com using self-hosted Cal.diy.

1. Who is responsible

The service is operated by Sapienti International School — SIS, Rua de Birre 183, 2750-217 Cascais, Portugal (“Sapienti”, “we”, “us”). For privacy questions or requests, contact info@sapienti.one, telephone +351 967 660 163, or write to that address.

2. Information we process

  • Enquiries and bookings: name, email, phone number, selected curriculum or service, optional notes, appointment date and time, timezone, assigned host, booking reference, and cancellation or rescheduling information.
  • Connected Google accounts: account/profile information supplied by Google, calendar identifiers and calendar lists, calendar permissions, availability and event information needed to check conflicts and manage appointments, and OAuth access/refresh tokens. We do not receive your Google password.
  • Appointment events: relevant participant names/emails, event identifiers, descriptions, times, booking status and Google Meet joining links.
  • Technical information: authentication/session cookies, IP address, browser information and operational/security logs needed to run and protect the service.

Please do not include identity documents, medical information, payment-card details or other sensitive information in booking notes. An enquiry can be submitted without connecting a Google account; Google authorization is for account holders connecting their calendars.

3. Why we use information and our legal bases

We use enquiry and booking information to respond to your request and arrange, provide, change or cancel appointments, including steps at your request before entering a contract. We process necessary security and operational data for our legitimate interests in maintaining a safe, reliable service, subject to your rights. We obtain your authorization before connecting your Google account, and you can withdraw that authorization. We may retain information when required by applicable law. We do not make automated decisions with legal or similarly significant effects through this booking service.

4. Google Calendar and Google Meet

When a calendar owner authorizes the integration, Cal.diy uses Google APIs to identify available calendars, check selected calendars for conflicting events, and create, update or delete appointment events in the selected destination calendar. It requests Google Meet conference links for appointments configured to use Google Meet. Depending on Google’s permissions and API responses, event information beyond free/busy status may be accessible; our use is limited to the appointment functionality described here.

Calendar owners choose which connected calendars are checked and which writable calendar receives bookings. Attendees may receive appointment details or calendar invitations through Google when those features are enabled. Disabling application email does not itself disable Google’s notifications. This integration does not read Gmail messages, access Google Drive files, or record Meet audio/video.

Sapienti Booking Appointments’ use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not sold, used for advertising or credit decisions, or used to train generalized artificial intelligence or machine-learning models. Human access to Google user data is limited to circumstances permitted by that policy, such as your affirmative agreement to support access, security investigations, or legal requirements.

5. Sharing and service providers

Relevant booking details are available to the assigned host and authorized Sapienti personnel. Google receives information needed to operate connected Calendar and Meet features; meeting participants receive the details needed to attend. Our hosting provider, Hostinger, processes information to host the website and self-hosted booking application. Self-hosting Cal.diy does not require sending booking records to a hosted Cal.com account.

We may disclose necessary information to service providers supporting the service, advisers, or authorities where legally required, with appropriate restrictions. We do not sell booking information. Google’s handling of its own services is described in Google’s Privacy Policy. Provider processing may involve countries outside the European Economic Area; where required, applicable transfer safeguards must be in place. Contact us for information about the safeguards applicable to your data.

6. Storage, retention and deletion

Enquiries and booking records are stored in the website/booking databases; connected events are also stored in Google Calendar. We retain information for as long as needed to handle appointments, follow-up requests, security issues and applicable legal obligations. There is currently no fixed automatic deletion interval for booking records; contact us to request deletion. Backup copies may persist until replaced under the applicable backup process and are not intended for routine use.

You can disconnect Google in Cal.diy’s calendar settings and revoke access through your Google Account connections. Revocation stops future authorized API access but does not automatically erase existing booking records or events already created in Google Calendar. Contact us to request deletion of retained service data; you can separately manage events in your Google calendar. We may retain limited records where a legal obligation or other lawful basis requires it, and will explain any applicable exception.

7. Security and your rights

We use HTTPS and access controls to protect the service. Authorized operators must safeguard credentials and calendar access. No online service can guarantee absolute security.

Where applicable, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting processing already lawfully performed. Send requests to info@sapienti.one; we may need proportionate identity verification. You may complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD) or your relevant supervisory authority.

8. Children, cookies and changes

Appointments concerning children should be arranged by a parent, guardian or otherwise authorized representative where required by law. Provide only the information needed for the appointment. Contact us if a child has supplied information without appropriate authorization.

Authentication and security cookies support booking administration. The surrounding Sapienti website may use additional technologies governed by its separate website privacy/cookie notices and applicable consent controls; this policy does not authorize advertising use of Google calendar data.

We may update this policy as the booking service changes. The date above identifies the latest version; material changes requiring notice or renewed consent will be handled before the relevant new processing.