Legal

Privacy Policy

Last updated: 28 September 2026

1. Who we are

This Privacy Policy explains how Circleup Ltd., Rappstrasse 15, 8408 Winterthur, Switzerland (“Circleup”, “we”, “us”) processes personal data when you use the Circleup mobile app, Circleup invitation links and the website www.circleup.ai (together, the “Service”). Circleup is the controller responsible for this processing. We follow the Swiss Federal Act on Data Protection (nFADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

Contact for privacy questions: privacy@circleup.ai.

2. Data we process in the app

Account data

When you sign up, we process your name, email address and/or phone number, and your profile picture if you add one. You can sign in with email or phone, or with your Google account. If you use Google Sign-In, Google shares your name, email address and profile picture with us.

Calendar data

If you connect a Google or Microsoft calendar, Circleup reads the times you are busy so it can suggest free slots and avoid double bookings, and it creates, updates and deletes the events of meetings you arrange with Circleup. Circleup does not change calendar entries that were not created with Circleup.

When you share availability with someone, they only see the free/busy windows you choose to share. Titles, descriptions, attendees and locations of your other calendar entries are never shown to other users. You can disconnect a calendar at any time under “Connected Accounts” in your profile.

Contacts

With your permission, Circleup accesses your device’s contact list so you can find and invite people you want to meet. We only store the contacts you actively invite or add to Circleup (for example, to set a reconnect reminder). Due to a technical limitation of the operating system, contact access also includes profile pictures; we do not use or upload them. You can withdraw contact access at any time in your device settings.

Meetings, invitations and reminders

To run the Service, we store the meetings you arrange: participants, proposed and agreed times, the venue, your invitation message, and the reconnect rhythm you set per contact. The people you invite see the information needed to respond, such as your name, the proposed times, the venue and your message.

Invitees without an account

If you receive a Circleup invitation link, you can respond in your browser without an app or account. To confirm the meeting, we process your first name, surname and email address so we can send you the calendar invitation and share your response with the person who invited you. If you choose a restaurant and turn on direct booking, we also process your mobile number as described below.

AI restaurant booking

When direct booking is turned on, our AI agent phones the restaurant and books the table in the name of the person who chose the restaurant and turned on direct booking. This can be the inviter in the app or the invitee using the invitation link.

To make the reservation, the restaurant receives that person’s name and mobile number, together with the booking details such as date, time and number of guests. A phone number is required so the restaurant can contact the guest with questions or follow-ups about the booking. We pass these details to the restaurant for the booking only; we do not share them with anyone else or use them for marketing. The call is carried out through a voice-AI service provider acting on our behalf and bound by our instructions. We store the outcome of the request so we can show the booking status. Once the restaurant has the reservation, it processes that data under its own privacy policy.

Usage, device and diagnostic data

When you use the app, we collect technical data such as device type, operating system, app version, IP address, crash reports and how features are used. We use this to keep the app working, fix errors and improve the Service.

Notifications

If you allow notifications, we process a device token to send you push notifications, for example when someone accepts an invitation or a reconnect reminder is due.

3. Data we process on the website

• Analytics: we use Plausible Analytics, a privacy-friendly tool that does not use cookies and does not collect personal data. It gives us aggregated statistics such as page views and referrers.
• Forms: when you fill in a contact, demo or download form, we process the details you enter (such as name, email, company and message) to reply to you and, where you asked for it, send you the requested content. These details are stored in our customer relationship management system.
• Hosting and logs: the website is hosted on Amazon Web Services. Like any web server, it processes technical data such as IP addresses to deliver pages and protect the site.
• Embedded content: pages may load fonts from Google Fonts and embedded videos from YouTube. When this happens, your browser connects to Google’s servers, which receive your IP address.

The website does not use advertising or tracking cookies.

4. Why we process your data

• To provide the Service you asked for: your account, scheduling, calendar sync, invitations, reminders and restaurant bookings (performance of our contract with you).
• To keep the Service secure and working and to fix errors (our legitimate interest).
• To improve Circleup based on aggregated usage (our legitimate interest).
• To communicate with you about your account, changes to the Service and, if you opted in or asked for it, news and content from Circleup (your consent or our legitimate interest). You can unsubscribe at any time.
• To access your contacts, calendars and notifications only with your permission (your consent, which you can withdraw at any time).
• To comply with legal obligations (legal obligation).

We do not sell your personal data, and we do not use it for advertising.

5. Service providers

We work with carefully selected providers that process data on our behalf and only according to our instructions:

• Cloud hosting for the app backend and database, located in the EU.
• Google Firebase for app analytics and push notifications.
• Sentry for error and crash monitoring.
• A voice-AI provider that places restaurant booking calls on our behalf.
• Google and Microsoft for calendar connections and Google Sign-In, when you choose to use them. Their own privacy policies apply to your accounts with them.
• Email and SMS providers to send sign-in codes, invitations and service messages.
• Amazon Web Services for hosting the website, Plausible for website analytics, and Attio as our customer relationship management system for website enquiries.

We also share data with other users as described above (for example, your name and proposed times with the people you invite), and with restaurants when direct booking is turned on. We may disclose data if required by law, to protect our rights or the safety of users, or as part of a merger or sale of our business, in which case we will inform you beforehand.

6. International transfers

Your app data is hosted in the EU. Some providers listed above may process data in other countries, including the United States. We only transfer personal data to countries without an adequate level of data protection if appropriate safeguards are in place, such as the EU Standard Contractual Clauses or certification under the Swiss-US or EU-US Data Privacy Framework.

7. How long we keep your data

We keep your account data for as long as your account is active. When you delete your account, we delete or anonymise your personal data within 30 days, unless we are legally required to keep it longer. Diagnostic data and crash reports are kept for a shorter period and only as long as needed to fix issues. Website enquiries are kept as long as needed to handle your request and our relationship with you.

8. Security

We use technical and organisational measures to protect your data, including encrypted connections (TLS), access controls and data minimisation: we only request the calendar and contact access the Service needs. No method of transmission or storage is completely secure, but we work to protect your data and will inform you as required by law if a breach affects you.

9. Your rights

Depending on applicable law, you have the right to:

• request access to the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• receive your data in a portable format;
• object to or restrict certain processing;
• withdraw your consent at any time, without affecting processing that happened before.

To exercise these rights, email privacy@circleup.ai. You can also delete your account directly in the app. You have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EU, with your local data protection authority.

10. Children

Circleup is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy when the Service or the law changes. We will post the new version on this page and update the date above. For significant changes, we will also notify you in the app or by email before they take effect.

12. Contact

Circleup Ltd., Rappstrasse 15, 8408 Winterthur, Switzerland
Email: privacy@circleup.ai

See also our Terms & Conditions.