Privacy Policy

The demo request form asks for your first and last name, business name, email address, phone number, industry, estimated monthly lead volume, and optionally a short description of your primary challenge. Every one of those fields is sent to Vayrk when you submit the form.

To stop the form being flooded, Vayrk also keeps a one-way scrambled version of your internet address, email address and phone number. It cannot be turned back into the originals, it is used only to limit repeat requests, and rows older than 48 hours are deleted the next time the form is used.

To contact you about the demo you asked for, and to prepare for that conversation. We do not sell it, and we do not share it for anyone else's advertising.

The demo form has a separate box for text messages. It starts unchecked, it is optional, and the form works the same way without it. Submitting the form with the box unchecked does not give Vayrk permission to text you, and we will not.

If you check it, you agree to receive automated text messages from Vayrk at the phone number you entered, about your demo request: confirming it, arranging a time and following up. Message frequency varies. Message and data rates may apply. Agreeing is not a condition of requesting a demo or of buying anything.

Vayrk is not sending these texts yet. US mobile carriers require a business to register before it texts, and Vayrk's registration is not finished. Until it is, checking the box records your choice and no text is sent.

What we record. When you check the box, Vayrk keeps the exact wording you agreed to and its version, the phone number, the date and time, the internet address and browser the form was sent from, and which demo request it came with. Vayrk texts only numbers in the +1 country code, which the United States, Canada and some other countries share, and it reads any ten-digit number as one of those. If the number you enter cannot be read that way, checking the box records nothing.

Stopping. Reply STOP to any text from Vayrk and the texts stop. Reply HELP for help, or email privacy@vayrk.com. Once a number has replied STOP, checking the box on this form again does not opt it back in. Replying START from that phone does, unless more than one of our contact records shares the number; in that case email privacy@vayrk.com.

Your mobile number is not shared for marketing. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Vayrk does not sell your mobile number or your text-message consent, and does not share either with third parties or affiliates for their marketing or promotional purposes. The only others that handle them are the providers named under “Who processes it” below, which keep the record and deliver a text for Vayrk, and the mobile carriers that carry it.

Supabase stores it. Vercel hosts the site and serves the request. Twilio is Vayrk's text-message provider; it receives the phone number you enter here only when Vayrk sends that number a text, which happens only if you checked the text-message box. Resend delivers email.

Each of those handles the data on Vayrk's behalf to provide the service, and for no other purpose.

This section covers the Vayrk platform rather than this website. If your business connects a Google Calendar to Vayrk, Vayrk asks Google for three permissions, and only these three.

See the list of calendars you can write to — so you can choose which calendar Vayrk should book into. Vayrk only asks Google for calendars where you are the owner or a writer.

Create, change and delete events — on that one calendar, so an appointment booked in Vayrk appears on it, moves when it is rescheduled, and comes off it when it is cancelled.

Read your busy times — through Google's free/busy service, so Vayrk does not offer a slot you are already committed to. Free/busy returns the start and end of each busy period and nothing else: no titles, no descriptions, no guests, no locations.

Vayrk reads your busy periods for a rolling window of roughly the next sixty days. That runs on a schedule every fifteen minutes for each connected calendar, and again immediately after you connect or reconnect.

Separately, every ten minutes, Vayrk writes the appointments you have booked in Vayrk onto the calendar you chose. Each event carries the service type in its title, the appointment notes in its description, the start and end time with a timezone, and two identifiers that let Vayrk match the event back to the appointment. That information comes from Vayrk, not from your calendar.

Vayrk does not read the contents of your calendar events. It does not request, receive or store event titles, descriptions, guests, locations, or attachments from your calendar.

In Vayrk's Supabase database, and nowhere else. Four things are kept: the connection itself — the Google refresh token, the id, name and timezone of the calendar you chose, the permissions Google granted, when it was connected and by which Vayrk user, and the status and last error of the connection; the busy snapshot — the calendar id and the start and end of each busy period, which is deleted in full and rewritten from scratch on every sync; one link row per appointment, holding the Vayrk appointment id, the calendar id, and the Google event id Vayrk created; and, while an appointment is still waiting its turn to be written to Google, a queue row holding the Vayrk appointment id and whether the event should be written or removed.

The refresh token is encrypted before it is written, using AES-256 in GCM mode with a key held in Vayrk's server environment and never in the database. Short-lived access tokens are requested from Google when they are needed and are never written to the database.

Google Calendar data is not sold. It is not used for advertising, or transferred to anyone for advertising. It is not used to train or improve generalised artificial intelligence or machine learning models. It is used to schedule your appointments and to keep your availability accurate, and for nothing else.

Vayrk uses the Google data it receives only to provide the Google Calendar features you asked for: connecting a calendar, listing the calendars you can write to, checking your availability, and creating, updating and removing Vayrk appointments on the calendar you chose. It is not used for anything else.

Vayrk does not sell Google user data. It is not shared with advertisers, ad networks, data brokers or resellers, and it is not used or disclosed for advertising, retargeting, lending, creditworthiness, or any other purpose unrelated to the calendar features above.

Two service providers handle it, both on Vayrk's behalf. Supabase hosts the database where the connection and the calendar records described above are stored. Vercel hosts the application, serves the requests, and runs the scheduled syncs on the ten- and fifteen-minute cadences described above. Each may process that data only to host, secure, maintain and operate Vayrk and to provide the functionality you requested, and for no purpose of its own. No one else receives it: the only other party Vayrk sends it to is Google itself. Twilio and Resend, named further up this page, never receive Google Calendar data.

It is not used for AI or machine learning. Google Workspace API data is not used to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. Vayrk does have AI features elsewhere in the product; Google Calendar data is not sent to them, and it is not sent to any AI or machine learning provider.

The narrow exceptions. Vayrk may disclose Google user data where applicable law requires it, such as a valid legal demand, or where reasonably necessary to investigate a security incident, prevent fraud or abuse, or protect the rights, property or safety of Vayrk and its users.

In transit. Every leg is encrypted with TLS: your browser to Vayrk, Vayrk to Google's APIs, and Vayrk to its database. Vayrk is served over HTTPS only.

At rest. The Google refresh token is the only Google credential Vayrk keeps, and it is encrypted with AES-256-GCM before it is written, with a key held in Vayrk's server environment and never in the database. Short-lived access tokens are requested from Google when they are needed and are never written down.

Secrets stay on the server. The Google client secret, the token encryption key and the privileged database credential exist only in server-side environment configuration. They are never sent to a browser and never appear in a page Vayrk serves. The same configuration is what Vayrk's own systems and the Vayrk personnel who administer that environment use; nothing else can reach it.

The permission handshake is signed. The state value Vayrk sends to Google is signed with HMAC-SHA256, bound to a single-use nonce placed in an HttpOnly cookie, checked with a constant-time comparison, and expires after ten minutes. A callback that does not match all of that is rejected.

Isolated per business, at the database. All four Google Calendar tables have row-level security enabled and carry no policy granting access to signed-in users; direct access is revoked outright. No browser can read them. They are reachable only from Vayrk's server code, which scopes every read and write to one business, so one business cannot see another's calendar data.

Only owners and admins can change it. Connecting a Google Calendar, choosing which calendar to use, and disconnecting are restricted to the owner or an admin of your business. The scheduled syncs run only when called with a secret Vayrk holds, again checked with a constant-time comparison.

You can end the access yourself. Disconnecting takes effect immediately and deletes everything Vayrk stored about the connection, including the encrypted refresh token. The next section sets out exactly what that removes and the one step to take at Google.

Vayrk's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

An owner or admin can disconnect Google Calendar from the Google Calendar panel in Vayrk's settings. There is a confirmation step, and it takes effect immediately: Vayrk stops reading your availability and stops writing appointments to your calendar.

What Vayrk deletes. Everything Vayrk stored about the connection, for your business: the connection record — which is where the encrypted refresh token lives, and that token is the only Google credential Vayrk holds — along with any queued calendar work, the busy snapshot, and the link rows that matched Vayrk appointments to Google events. Short-lived access tokens were never written down, so there is nothing further to delete. Your Vayrk appointments, contacts and opportunities are not touched: disconnecting ends an integration, it does not remove your CRM.

What Vayrk cannot undo. Events Vayrk already wrote into your Google Calendar stay in your Google Calendar. Disconnecting stops future changes; it does not retract past ones. Those events are yours to keep or to delete in Google Calendar — and once you disconnect, Vayrk no longer has the access to delete them for you.

What you still need to do at Google. Vayrk does not call Google's token revocation endpoint, so the permission you granted may still be listed in your Google Account after you disconnect. To withdraw the grant itself, remove Vayrk at myaccount.google.com/permissions. Vayrk has already destroyed its copy of the refresh token, so Vayrk cannot use that grant either way — but removing it is the one step Vayrk cannot take for you.

If you would rather we did the deletion for you, or you want it confirmed in writing, email privacy@vayrk.com and say which business it is for. We will confirm when it is done.

Vercel Web Analytics counts page views on this website and inside the Vayrk platform. According to Vercel it does this without cookies and without following you to other sites: it records the page, the site that referred you, and your browser, device type and country. Vayrk uses the totals to see which pages are read.

The public marketing pages do not set advertising or tracking cookies. Signing in to the Vayrk platform sets a session cookie, which is what keeps you signed in; it is required for the product to work and is not used for advertising.

Apart from the 48-hour rows described at the top of this page, Vayrk does not delete this data on a timer. A demo request and an SMS consent event stay until someone asks for them to be removed. A Google Calendar connection stays until it is disconnected in Vayrk, or someone asks for it to be removed, or the business it belongs to is removed — disconnecting deletes the connection, the queued work, the busy snapshot and the event links, and deleting an organisation deletes them too. The one exception is the busy snapshot, which is replaced in full every time availability syncs, so it only ever holds the current window.

Email privacy@vayrk.com and ask. Tell us the email address or phone number you used, or the business name for a calendar connection, so we can find the record. We will confirm when it is done.

If what the software does changes, this page changes with it. It is not a summary of intentions — it is a description of behaviour, and an inaccurate one is a defect.