Privacy Policy
Last updated: October 2026 · Effective immediately
At Proxiya, we take your privacy and data sovereignty seriously. This Privacy Policy explains what data we collect when you use Proxiya Scheduling, how we protect connected calendars and video integrations (Google, Zoom, Microsoft, Stripe), and how you can exercise your GDPR, UK GDPR, and CCPA data subject rights at any time.
1. Data Controller & Contact Details
Proxiya (https://www.proxiya.com) is operated by Breakout Ventures / Breakout Ltd ('Proxiya', 'we', 'us', or 'our'), headquartered in Manchester, United Kingdom. For all privacy, data protection, GDPR, UK GDPR, or CCPA inquiries, you can contact our Data Protection team at hello@proxiya.com or by telephone at +44 (0) 737 514 0862.
2. Information We Collect
We collect information you provide directly when creating a workspace, configuring Event Types, or booking a session: (a) Account & Profile Data (name, email address, timezone, workspace branding); (b) Booking & Invitee Data (invitee name, email address, selected time slot, timezone, and responses to host intake questions); (c) Calendar & Video Integration Metadata (encrypted OAuth 2.0 tokens, busy/free time windows, and generated Zoom / Google Meet / Microsoft Teams meeting URLs); and (d) Payment Metadata (Stripe Checkout session IDs, payment status, and refund status; full payment card numbers are processed directly by Stripe and never touch Proxiya servers).
3. How We Use Your Information & Legal Basis
Under UK GDPR and EU GDPR, we process personal data on the following legal bases: (a) Performance of a Contract: displaying accurate calendar availability, scheduling bookings, generating Zoom/Google Meet links, processing Stripe payments/refunds, and sending transactional booking confirmations; (b) Legitimate Interests: securing our platform, preventing abuse and double-bookings, and maintaining audit logs; and (c) Consent: where you explicitly authorize third-party OAuth integrations (Google, Zoom, Microsoft, Stripe) or opt into product updates.
4. Google, Zoom & Microsoft OAuth Data Usage (Limited Use Disclosure)
When you connect Google Calendar/Google Meet, Zoom, or Microsoft 365/Outlook, Proxiya accesses only the scopes required to check calendar conflicts and create, update, or delete calendar events and video meetings for bookings you host. Proxiya's use and transfer to any other app of information received from Google APIs and Zoom APIs adheres strictly to the Google API Services User Data Policy (including the Limited Use requirements) and the Zoom Marketplace Developer Agreement. We never sell OAuth data, never use calendar or meeting content for advertising or AI model training, and encrypt all OAuth access and refresh tokens at rest using AES-256-GCM.
5. Your Data Subject Rights (UK GDPR, EU GDPR & CCPA)
Regardless of your location, Proxiya grants all users and invitees comprehensive data subject rights under the UK GDPR, EU GDPR (Articles 15–22), and the California Consumer Privacy Act (CCPA/CPRA): • Right of Access (Subject Access Request): Request a copy of all personal data we hold about you. • Right to Rectification: Correct inaccurate or incomplete account or booking information at any time via Dashboard → Settings or your booking management link. • Right to Erasure ('Right to be Forgotten'): Request permanent deletion of your account, booking records, and connected OAuth credentials. • Right to Restrict Processing & Right to Object: Request that we limit or stop processing your personal data. • Right to Data Portability: Receive your workspace and booking data in a structured, machine-readable format (JSON/CSV). • Right to Withdraw Consent: Revoke Google, Zoom, Microsoft, or Stripe OAuth access at any time with one click under Dashboard → Integrations. • CCPA Non-Discrimination & No Sale of Data: We never sell or share personal information for cross-context behavioral advertising, and we never discriminate against users who exercise their privacy rights. To exercise any of these rights, email hello@proxiya.com with the subject line 'Data Rights Request'. We respond to all verified requests within 30 days (or sooner as required by law).
6. Account Deletion, OAuth Revocation & Data Retention
You have full control over your account and personal data. You can disconnect any third-party integration immediately via Dashboard → Integrations, which revokes and deletes stored OAuth tokens. You can request complete account and workspace deletion at any time via Dashboard → Settings or by emailing hello@proxiya.com with the subject 'Account Deletion Request'. Upon receipt, all profile data, event types, stored OAuth tokens, and personal identifiers are permanently purged within 30 days, subject only to mandatory statutory tax/accounting retention for completed Stripe payment transactions.
7. Data Security & International Transfers
We implement industry-standard technical and organizational safeguards, including TLS 1.3 encryption in transit, AES-256-GCM token encryption at rest, row-level workspace isolation, cryptographic rate limiting, and strict role-based access controls. Where data is processed outside the UK or EEA by vetted sub-processors (such as Stripe, Google, Zoom, Microsoft, or Railway cloud infrastructure), transfers are protected by UK International Data Transfer Addenda (IDTA) and EU Standard Contractual Clauses (SCCs).
8. Cookies & Updates to This Policy
We use essential session cookies to authenticate your workspace and functional storage to remember your theme preferences. See our Cookie Policy (/cookies) for full details. We may update this Privacy Policy periodically and will update the 'Last updated' date below.
Need to exercise a Data Subject Right or request deletion?
Email our Data Protection Officer directly at hello@proxiya.com.