Privacy Policy

Last updated: Jul 14, 2026 10:43 PM

We value your privacy very highly. Please read this Privacy Policy carefully before using the https://lessago.co website (the “Website”) operated by Codestodian Ltd, a(n) Private Limited Company formed in England, with a registration number of 16026184 (“us, we, our”) as this Privacy Policy contains important information regarding your privacy and how we may use the information we collect about you.

Your access to or use of the Website is conditional upon your acceptance of and compliance with this Privacy Policy. This Privacy Policy applies to everyone, including but not limited to visitors, users and others, who wish to access or use the Website.

By accessing or using the Website, you agree to be bound by this Privacy Policy. If you disagree with any part of this Privacy Policy, you do not have our permission to access or use the Website.

What information we collect and store

Event and participant information

• Event name, host display name, participant display names, candidate dates, optional time window, availability choices, event status and final date, timestamps, and an optional event location.

• For a selected location, the formatted address, Google place identifier, latitude, and longitude may be stored so that the location and map can be shown.

• Random event, host-management, and participant-edit identifiers used in share links and to authorise event or availability changes. A participant edit token is stored in the browser local storage so that the participant can return to edit availability.

Calendar connections

Calendar connection is optional. If you connect Google Calendar, the browser requests read-only access to calendar lists and events. If you connect Microsoft Outlook Calendar, the browser requests delegated Calendars.Read access. The browser may read calendar names or identifiers and event subject, start and end times, availability or transparency status, cancellation status, and whether an event is all-day, solely to calculate possible busy periods.

OAuth access tokens and raw calendar event content are held only temporarily in your browser. They are not sent to or stored on LessAgo servers and are discarded after the one-time import or when you cancel. LessAgo does not run background calendar synchronisation. Only the availability that you review and submit is stored. If you choose to export a finalised event to Google Calendar, the final event details you approve are sent to Google.

Technical and analytics information

Our hosting and security providers may process IP address, user-agent, request path, timestamps, and diagnostic information. If and when Umami analytics is enabled, the limited analytics described in the Analytics programs section will also be processed. LessAgo does not use analytics to collect event names, participant names, locations, availability, calendar content, secret links, or account identifiers.

Future accounts

LessAgo does not currently require a user account. If account features are introduced, we may collect an account name and email address, a password hash or third-party sign-in identifier, session and security records, preferences, plan or billing metadata, and service communications. A payment provider, rather than LessAgo, would process full card details if paid features are introduced. We will update this Privacy Policy and provide appropriate notice before materially different account, payment, or persistent calendar-sync processing begins.

Legal bases and visibility

Depending on the context, we process this information to provide the service or take requested pre-contract steps, with consent for optional calendar connections, for our legitimate interests in operating, securing, and improving LessAgo, and where necessary to comply with law or resolve disputes.

Anyone with an event participant link may see the event details needed to respond. Anyone with the secret host link can see participant names, response method, availability, and response timestamps and can manage the event. After finalisation, the host name and names of participants available on the selected date may be visible to people with the event link. Users should treat host and participant edit links as confidential.

With whom we share your personal information

• Other LessAgo users: event and participant information is shared with people who have the relevant participant, host, or edit link as described above.

• Railway and its PostgreSQL hosting services: store and process the event, participant, and availability records needed to operate LessAgo, and may process technical logs.

• Cloudflare: provides network delivery and security services and may process IP address, user-agent, request path, timestamps, and security diagnostics.

• Google Maps and Places: receives map or place-search requests when a map or location feature is used. A selected place, formatted address, latitude, and longitude may then be stored with the event.

• Google and Microsoft: process information when you choose to connect a Google or Outlook calendar. Calendar event content and OAuth tokens remain in the browser and are not disclosed to LessAgo hosting providers. Google also receives final event details if you choose the Google Calendar export.

• Umami: if and when analytics is enabled, processes the limited, route-sanitised usage information described below. We do not send names, email addresses, event details, availability, calendar content, or secret identifiers to Umami.

• Authorities and advisers: information may be disclosed where reasonably necessary to comply with law, protect rights or safety, investigate misuse, or establish, exercise, or defend legal claims.

Service providers may process information only for the functions we ask them to perform and subject to their applicable contractual and legal obligations.

How we protect your personal information

We have implemented the following measures to protect and safeguard your personal information:

• Limiting the amount of personal information that we collect to strictly necessary only
• Using SSL encryption or other secure technologies when receiving or sending personal information beyond internal networks
• Destroying and/or deleting personal information once we no longer need it
• Maintaining up-to-date software and safeguards
• Performing regular due diligence of vendors who have access to personal information
• Physically and/or logically separating systems containing personal information from public networks such as the Internet

Children's privacy

This Website is intended for use by a general audience and does not offer services to children. Should a child whom we know to be under 18 send personal information to us, we will use that information only to respond to that child to inform them that they cannot use this Website.

Analytics programs

Analytics will be configured so that secret host routes and event routes are excluded or reduced to generic route templates. Search parameters are excluded. We will not send event or host identifiers, participant-edit tokens, names, email addresses, account identifiers, event names, locations, availability, or calendar content to Umami. We will not use Umami identify features or personal custom-event properties. If that configuration or the analytics provider materially changes, we will update this Privacy Policy before the change.

Information retention

The participant edit token in browser local storage remains until it is cleared, becomes invalid, or the related event is deleted. OAuth access tokens and raw Google or Microsoft calendar event content are held only temporarily in the browser and are discarded after the one-time calendar import or cancellation.

If account features are introduced, account information will be retained while the account is active and then deleted or anonymised within a reasonable period, subject to legal, security, backup, fraud-prevention, and dispute-resolution requirements. Technical security records may be retained for a limited period reasonably necessary for those purposes.

Your rights

Depending upon where you reside‚ you may have the following rights with regard to your personal information:

Exercising your rights

You may exercise the rights specified above by submitting a consumer request to:

Barry McAuley
Founder
[email protected]
Codestodian Ltd, 66 Paul Street, London, EC2A 4NE
England
https://codestodian.io

We will need to verify your identity prior to effectuating your request. To verify your identity, you will need to provide us with the following information with your request:

• Name
• Email address
• Online identifier
• Account name
• Event details and availability

Please note that we may be unable to process your request if you do not provide us with the above information.

We will respond to most consumer requests within 30 days of receipt. However, some requests may take longer. We will notify you in writing if we need more time to respond. We have the ability to deny your request(s) if certain exceptions in the law apply. If we do deny your request, we will provide you with the reasons for such denial.

Complaints

Residents of the United Kingdom may lodge a complaint with the United Kingdom Information Commissioner's Office by following the steps on this Lodge a Privacy Complaint (United Kingdom) page.

Accountability

The following person is accountable and responsible for our privacy practices and procedures:

Barry McAuley
Founder
[email protected]

You may lodge a complaint with us by contacting the person accountable and responsible for our privacy practices and procedures at the contact information above. Residents of Canada may also lodge a complaint with the Office of the Privacy Commissioner of Canada by visiting this File a Privacy Complaint (Canada) page or calling 1-800-282-1376. Residents of Quebec may also lodge a complaint with the Office of the Privacy Commissioner of Quebec by filling out this Quebec Privacy Commission page or calling 1-888-528-7741.

Location of data processing

All data processing activities undertaken by us take place in Netherlands, United Kingdom, and United States.

Third-party websites

This Website may contain hyperlinks to websites operated by parties other than us. We provide such hyperlinks for your reference only. We do not control such websites and are not responsible for their contents or the privacy or other practices of such websites. It is up to you to read and fully understand their Privacy Policies. Our inclusion of hyperlinks to such websites does not imply any endorsement of the material on such websites or any association with their operators.

Do Not Track

Do Not Track (“DNT”) is a preference you can set on your browser to inform websites that you do not want to be tracked. We do not support DNT. You can either enable or disable Do Not Track by visiting the Preferences or Settings page of your browser.

Transferring data

We may transfer your personal information for processing to United States. This means that your information may be processed outside of your country of residence and it may be accessible to law enforcement and national security authorities of that country and jurisdiction. Please note that we use standard contractual clauses, additional safeguards, and adequacy decisions to transfer data.

Questions

If you have any questions about this Privacy Policy, please contact us at [email protected].

Changes to Privacy Policy

Before introducing materially different processing—such as persistent background calendar synchronisation, paid account features, or personal analytics identifiers—we will update this policy and obtain any consent required by law before that processing begins.