Cal.com and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No, with narrow wording: Cal.com does not use Customer Data to train or fine-tune generally available AI models and requires the same of its AI subprocessors.

Vendor's wording: “Cal.com does not use Customer Data to train or fine-tune generally available AI models, and requires the same of its AI Subprocessors.”

Source: cal.comTerms of Service 4.5 Beta and AI featuresChecked on 19 October 2026

United States. Cal.com says data is processed in the United States; some subprocessors process elsewhere (primary database and storage are at AWS, United States).

Vendor's wording: “We’re a US company and data is processed in the United States; some subprocessors process it elsewhere”

Source: cal.comPrivacy policy, International transfersChecked on 19 October 2026

No EU hosting.

No on Teams: the pricing comparison lists 'US & EU hosting' (choose where your data is hosted) only for the Organizations and Enterprise plans.

Vendor's wording: “Choose where your data is hosted to meet regional data residency requirements.”

Source: cal.comComparison table, Data management & security, row 'US & EU hosting' (check icons under Organizations and Enterprise, cross icons under Individual and Teams, read from the page HTML)Checked on 20 October 2026

DPA on request.

Yes. The DPA at cal.com/dpa is part of the Terms of Service for every account, free or paid; a signed DPA can also be obtained via the Trust Center.

Vendor's wording: “under the Data Processing Agreement at cal.com/dpa, which is part of our Terms of Service for every account, free or paid.”

Source: cal.comPrivacy policy, The short versionChecked on 19 October 2026

Published.

Yes, public: https://trust.cal.com/subprocessors. 22 entries. AI providers: OpenAI, Anthropic and Retell AI (opt-in AI features).

Vendor's wording: “Cal.com engages the third parties below to process customer personal data. Each is bound by a data processing agreement.”

Source: trust.cal.comSubprocessors tableChecked on 19 October 2026

On the list.

Active (Cal.com, Inc; EU-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Cal.com'Checked on 19 October 2026

After the account ends you get at least 30 days to export; Cal.com then deletes the data, normally within 90 days; backups follow a separate schedule. Bookings can be exported or deleted any time.

Vendor's wording: “Following the applicable export period, Cal.com will delete Customer Personal Data in accordance with its standard deletion schedule, normally within 90 days”

Source: cal.comDPA 10.2-10.3Checked on 19 October 2026

2 on the Trust Center: ISO 27001 certificate and SOC 2 Type 2 report; the security page also names CCPA, GDPR and HIPAA.

Vendor's wording: “ISO 27001, SOC 2 Type II, CCPA, GDPR, and HIPAA certifications”

Source: cal.comSecurity page, introChecked on 19 October 2026