Privacy Policy

Last Updated: October 12, 2026 Effective Date: February 25, 2026

Reservita Inc. ("Caletan," "we," "us," or "our") operates the Caletan platform, a class management and student enrollment system available at caletan.com and related websites, applications, and services (collectively, the "Service"). In this Privacy Policy, "Service" refers to the same platform defined as "Platform" in our Terms of Service.

This Privacy Policy describes how we collect, use, disclose, and protect personal information when you interact with our Service. It applies to all visitors, subscribers (businesses that use Caletan to manage classes and enrollments), and end users (students, parents, guardians, and other individuals whose information is managed through the Service by subscribers).

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy should be read together with our Terms of Service, Cookie Policy, and Data Processing Agreement.

1. Scope and Controller/Processor Roles

Reservita as Controller

Reservita Inc. is the data controller for personal information we collect directly in connection with operating our business, including:

Managing our websites and marketing communications
Processing subscriber account registrations and billing
Providing customer support to subscribers
Conducting product analytics using aggregated or de-identified data
Managing corporate operations

Reservita as Processor

When subscribers use Caletan to manage their students, classes, and enrollments, the subscriber determines the purposes and means of processing that data. In this context, Reservita acts as a data processor on behalf of the subscriber, and the subscriber acts as the data controller.

If you are a student, parent, guardian, or other end user whose information is managed through Caletan by a subscriber, the subscriber's own privacy practices govern how your information is handled. We encourage you to review the privacy policy of the studio, school, or organization through which you interact with Caletan.

Our Data Processing Agreement sets out the terms under which we process subscriber data.

2. Information We Collect

Information Provided by Subscribers

When a subscriber registers for and uses Caletan, we collect:

Account information: Business name, contact name, email address, phone number, physical address
Billing information: Payment method details (processed and stored by Stripe; we do not store full payment card numbers)
Service configuration: Class schedules, pricing, policies, branding, and other settings

Information Managed by Subscribers (End User Data)

Subscribers may use Caletan to collect and manage information about their students, parents, and guardians, including:

Identity information: Name, date of birth, age, gender
Contact information: Email address, phone number, physical address
Emergency contacts: Names and phone numbers of emergency contacts
Health and safety information: Medical conditions, allergies, medications, and other health-related information relevant to safe participation in classes
Enrollment information: Class registrations, attendance records, skill levels, progress notes
Financial information: Payment history, invoices, account balances

This information is collected and controlled by the subscriber. Reservita processes it on the subscriber's behalf to provide the Service.

Signing In with Google

If you choose to sign up or sign in with your Google account, Google shares with us your name, your email address, and whether Google has verified that email address. We use this information only to create your Caletan account and to sign you in. We do not receive your Google password, we do not request access to any other data in your Google account, and we do not sell this information or share it with third parties except as described in this Privacy Policy. Caletan's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A subscriber may connect its Facebook Page, Instagram professional account, Google Business Profile or TikTok account to Caletan, so that posts it writes in Caletan are published there. Connecting an account is optional, and only staff who manage the subscriber's settings can do it. We handle this information on the subscriber's behalf, to provide the Service.

What we receive and keep. When you connect an account, the network asks you to approve Caletan's access, then lets you choose which Page or account Caletan may post to. We keep only the one you choose:

its name, its identifier on the network, and a link to it;
the access tokens the network issues so that Caletan can publish on your behalf, encrypted with keys held only by Caletan's servers, and when they expire;
which member of your team connected it, and when.

The other Pages or accounts offered to choose from are not saved.

For each post, we keep what you wrote and chose in Caletan: its text, its photos or video, its link, and when it should go out. Photos and videos are stored as public files on your business's Caletan site, where the network fetches them to publish. Once a post is published, we keep the network's identifier for it and a link to it, so you can see where it went.

How we use it. We use a network's access only to publish the posts you send from Caletan, at the time you choose, and to keep that access working by renewing it before it expires. We do not:

post anything you did not send from Caletan;
read your messages, comments, followers or insights;
use information from a network for advertising, or to build a profile of anyone;
sell it, or share it with anyone other than the network you post to and the service providers that host Caletan.

Caletan's use of information received from Google APIs, including the Google Business Profile, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it, and how to have it deleted. We keep a connected account's details and tokens while it stays connected. When you disconnect it in Caletan (Settings → Social, the account, then Disconnect), or turn Social off, we revoke Caletan's access with the network, so its tokens stop working, and delete the account's name, identifier, link and tokens. Posts scheduled for it are no longer published. Posts already published stay on the network until you delete them there, and remain in your post history in Caletan with their links. If you remove Caletan in the network's own settings instead, Caletan can no longer publish, and the details above remain until you disconnect the account in Caletan or ask us to delete them. When a subscriber's account is closed, its connected accounts are deleted with it. Our Data Deletion Instructions explain each way step by step, and you can email [email protected] at any time.

Information Collected Automatically

When you visit our websites or use the Service, we automatically collect:

Device and browser information: IP address, browser type and version, operating system, device type, screen resolution
Usage information: Pages visited, features used, links clicked, date and time of access, referring URLs
Cookies and similar technologies: See our Cookie Policy for details

3. How We Use Information

For Subscribers

We use subscriber information to:

Provide, maintain, and improve the Service
Process payments and manage billing
Communicate about the Service, including updates, security alerts, and support messages
Send marketing communications (with consent, where required)
Conduct analytics to understand usage patterns and improve the Service
Detect, prevent, and address fraud, abuse, and security issues
Comply with legal obligations

For End User Data (as Processor)

We process end user data solely on behalf of and under the instructions of the subscriber, for the purpose of providing the Service. We do not use end user data for our own marketing purposes.

For All Visitors

We use automatically collected information to:

Operate and maintain our websites
Analyze website traffic and usage patterns
Improve user experience
Ensure security and prevent abuse

4. CASL Compliance (Canada's Anti-Spam Legislation)

Caletan complies with Canada's Anti-Spam Legislation (S.C. 2010, c. 23) ("CASL") in all commercial electronic communications.

We obtain express consent before sending commercial electronic messages (CEMs), such as marketing emails, promotional offers, and newsletters. Express consent is obtained through clear opt-in mechanisms that identify the purpose of the messages and provide our contact information.

We may send CEMs based on implied consent where permitted under CASL, including:

To existing subscribers with whom we have an active business relationship (within two years of the last transaction or within six months of an inquiry)
To individuals who have conspicuously published their email address without indicating they do not wish to receive CEMs

Unsubscribe Mechanism

Every CEM we send includes:

A clear and prominently displayed unsubscribe mechanism
Our business name and contact information, including a physical mailing address
Identification of the person or entity sending the message on our behalf, if applicable

Unsubscribe requests are processed within 10 business days of receipt.

Subscriber Responsibilities

Subscribers who use Caletan to send messages to their end users are responsible for ensuring their own CASL compliance, including obtaining appropriate consent and providing unsubscribe mechanisms.

We do not sell personal information to third parties.

We may share personal information in the following circumstances:

Service providers: We share information with third-party service providers who assist us in operating the Service, including hosting, payment processing, email delivery, analytics, and customer support. These providers are contractually bound to use personal information only for the purposes of providing services to us and to maintain appropriate security measures.
Payment processing: Billing and payment information is shared with Stripe, our payment processor, which maintains PCI-DSS compliance. Stripe's use of your information is governed by Stripe's Privacy Policy.
Social networks: When a subscriber publishes a post through Caletan, we send the networks it chose (Facebook, Instagram, Google Business Profile or TikTok) the post's text, its photos or video and its link, using the access the subscriber granted. Each network's use of what it receives is governed by its own privacy policy. See "Connected Social Accounts" in Section 2.
Subscribers (their data): Subscriber data managed through Caletan is accessible to the subscriber and their authorized staff. We do not share one subscriber's data with another subscriber.
Legal requirements: We may disclose personal information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, the safety of any person, or to detect, prevent, or address fraud or security issues.
Business transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, personal information may be transferred as part of that transaction. We will notify affected parties of any change in ownership or use of personal information.
With consent: We may share personal information with third parties when we have obtained your consent to do so.

6. Children's Privacy (COPPA Compliance)

Caletan is a business-to-business platform. We do not directly collect personal information from children under the age of 13.

Subscribers may use Caletan to manage enrollment and class information for children, including children under 13. In this context:

Subscriber responsibility: The subscriber is responsible for obtaining verifiable parental consent before collecting and entering personal information about children under 13 into the Service, in compliance with the U.S. Children's Online Privacy Protection Act of 1998 (15 U.S.C. §§ 6501–6506) ("COPPA") and applicable laws.
Tools for compliance: Caletan provides tools to help subscribers manage parental consent and child data, including the ability to require parent or guardian accounts for minor enrollments.
Limited use: We process children's personal information solely as a data processor on behalf of the subscriber, for the purpose of providing the Service. We do not use children's personal information for marketing or advertising purposes.
Deletion: If we learn that we have collected personal information from a child under 13 without verified parental consent, we will take steps to delete that information promptly. If you believe a child's information has been collected without appropriate consent, please contact us at [email protected].
Parental rights: Parents and guardians may review, correct, or request deletion of their child's personal information by contacting the subscriber directly. Subscribers may also direct us to delete such information.

7. PIPEDA Compliance (Canada)

Reservita Inc. is a Canadian federal corporation and complies with the Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) ("PIPEDA") and applicable provincial privacy legislation. Our privacy practices are guided by PIPEDA's 10 fair information principles:

Accountability: We are responsible for personal information under our control and have designated a Privacy Officer to oversee compliance.
Identifying purposes: We identify the purposes for which personal information is collected at or before the time of collection.
Consent: We obtain meaningful consent for the collection, use, and disclosure of personal information, except where permitted or required by law to act without consent.
Limiting collection: We limit the collection of personal information to what is necessary for the identified purposes.
Limiting use, disclosure, and retention: Personal information is used and disclosed only for the purposes for which it was collected, and is retained only as long as necessary to fulfill those purposes.
Accuracy: We keep personal information as accurate, complete, and up-to-date as necessary for the purposes for which it is used.
Safeguards: We protect personal information with security safeguards appropriate to the sensitivity of the information.
Openness: We make information about our privacy policies and practices readily available.
Individual access: Upon request, we inform individuals of the existence, use, and disclosure of their personal information and provide access to that information.
Challenging compliance: Individuals may challenge our compliance with these principles by contacting our Privacy Officer.

Your Rights Under PIPEDA

You have the right to:

Request access to the personal information we hold about you
Request correction of inaccurate or incomplete personal information
Withdraw consent to the collection, use, or disclosure of your personal information (subject to legal or contractual restrictions)
File a complaint with our Privacy Officer or the Office of the Privacy Commissioner of Canada (www.priv.gc.ca)

8. CCPA/CPRA Compliance (California)

This section applies to California residents and supplements the rest of this Privacy Policy, as required by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

Category	Examples	Collected
Identifiers	Name, email, IP address, account name	Yes
Customer Records (Cal. Civ. Code 1798.80(e))	Name, address, phone number, financial information	Yes
Commercial Information	Products or services purchased, purchase history	Yes
Internet or Network Activity	Browsing history, interactions with the Service	Yes
Geolocation Data	Approximate location from IP address	Yes
Professional Information	Job title, company name	Yes
Inferences	Preferences and characteristics derived from the above	Yes

We do not collect biometric information, protected classification characteristics, sensory data, or non-public education information.

Sensitive Personal Information: Subscribers may use the Service to collect health and safety information about end users (such as medical conditions and allergies). We process this information solely as a service provider on behalf of the subscriber for the purpose of providing the Service. We do not use sensitive personal information for purposes other than providing the Service. You have the right to limit our use of sensitive personal information to what is necessary for the Service.

Categories of Third Parties

We may share personal information with the following categories of third parties, as described in Section 5 of this Privacy Policy:

Cloud hosting and infrastructure providers
Payment processors (Stripe)
Social networks a subscriber connects (Facebook, Instagram, Google Business Profile, TikTok), for the posts it publishes
Email delivery providers
Analytics providers
Advertising partners (for marketing site visitors only, not for end user data)

Sources of Personal Information

We collect personal information from:

Directly from you (registration forms, communications, purchases)
Automatically from your device (cookies, usage data)
From service providers (analytics, payment processing)

How We Use Personal Information

We use personal information for the business purposes described in Section 3 of this Privacy Policy.

Your Rights Under the CCPA/CPRA

As a California resident, you have the right to:

Know and access: Request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
Delete: Request that we delete personal information we have collected from you, subject to certain exceptions.
Correct: Request that we correct inaccurate personal information we maintain about you.
Opt out of sale or sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
Non-discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We may require verification of your identity and confirmation that you have authorized the agent.

Verification

When you submit a request, we may need to verify your identity before processing it. We will match the information you provide with information we already have on file.

How to Submit a Request

To exercise your CCPA/CPRA rights, contact us at [email protected]. We will respond to verifiable requests within 45 days.

9. Quebec Law 25 (Act Respecting the Protection of Personal Information in the Private Sector)

For residents of Quebec, the following additional provisions apply:

Privacy by Default

We configure our Service with privacy-protective default settings. Non-essential data collection features, including analytics cookies and marketing communications, are disabled by default and require your active consent to enable.

Consent for the collection, use, and disclosure of personal information is obtained separately from consent to our Terms of Service. We provide clear and simple information about the purposes of each type of data processing and allow you to consent to each purpose individually.

Incident Notification

In the event of a privacy incident involving personal information that presents a risk of serious injury, we will:

Notify the Commission d'acces a l'information du Quebec (CAI) promptly
Notify affected individuals promptly
Maintain a register of all privacy incidents

Right to Data Portability

You have the right to request a copy of the personal information we hold about you in a structured, commonly used, and machine-readable format (such as CSV or JSON), to the extent technically feasible.

Language

This Privacy Policy is drafted in English. A French-language version may be made available upon request or as required by law.

This section applies to individuals located in the European Economic Area (EEA) or the United Kingdom and supplements the rest of this Privacy Policy, as required by the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the United Kingdom Data Protection Act 2018 / UK GDPR.

Lawful Basis for Processing

We process personal data on the following lawful bases:

Processing Activity	Lawful Basis
Providing the Service to subscribers	Performance of a contract (GDPR Article 6(1)(b))
Processing end user data on behalf of subscribers	Legitimate interests of the subscriber (GDPR Article 6(1)(f)), as directed by the subscriber acting as controller
Billing and payment processing	Performance of a contract (GDPR Article 6(1)(b))
Sending marketing communications	Consent (GDPR Article 6(1)(a))
Analytics on our marketing website	Consent (GDPR Article 6(1)(a)) for non-essential cookies; legitimate interests (GDPR Article 6(1)(f)) for aggregated, anonymized analytics
Security monitoring and fraud prevention	Legitimate interests (GDPR Article 6(1)(f))
Compliance with legal obligations	Legal obligation (GDPR Article 6(1)(c))

If you are located in the EEA or the United Kingdom, you have the right to:

Access: Request a copy of the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete personal data.
Erasure: Request deletion of your personal data, subject to legal exceptions.
Restriction: Request that we restrict the processing of your personal data in certain circumstances.
Portability: Request your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
Objection: Object to the processing of your personal data based on legitimate interests.
Withdraw consent: Where processing is based on consent, withdraw your consent at any time without affecting the lawfulness of prior processing.
Automated decision-making: We do not engage in automated decision-making or profiling that produces legal effects concerning you.

To exercise these rights, contact us at [email protected]. We will respond within 30 days (or within the period required by applicable law).

International Transfers

Personal data transferred from the EEA or the United Kingdom to Canada benefits from the European Commission's adequacy decision for Canada. For transfers to jurisdictions without an adequacy decision, we rely on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) or other appropriate safeguards as described in our Data Processing Agreement.

Supervisory Authority

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. For the United Kingdom, you may contact the Information Commissioner's Office (ICO) at https://ico.org.uk.

11. Cookies and Tracking Technologies

We use cookies and similar technologies on our websites and in the Service. For detailed information about the types of cookies we use, how to manage your preferences, and how to opt out, please see our Cookie Policy.

12. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected and to comply with our legal obligations:

Subscriber account data: Retained for the duration of the subscription and for a reasonable period afterward (up to 2 years) to allow for account reactivation and to comply with legal, tax, and accounting requirements.
End user data (processor role): Retained as directed by the subscriber. When a subscriber terminates their account, we will delete or return end user data in accordance with our Data Processing Agreement.
Billing and transaction records: Retained as required by applicable tax and accounting laws.
Automatically collected data: Retained for up to 26 months for analytics purposes.
Aggregated or de-identified data: May be retained indefinitely, as it does not constitute personal information.

When personal information is no longer needed, we securely delete or anonymize it.

13. Data Security

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

Encryption: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
Access controls: Access to personal information is restricted to authorized personnel on a need-to-know basis.
Infrastructure security: We use reputable cloud hosting providers with SOC 2 compliance and employ firewalls, intrusion detection, and regular security assessments.
Payment security: All payment processing is handled by Stripe, which maintains PCI-DSS Level 1 compliance. We do not store full payment card numbers on our servers.
Incident response: We maintain procedures for detecting, reporting, and responding to security incidents.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect personal information, we cannot guarantee absolute security.

14. International Data Transfers

Reservita Inc. is based in Ontario, Canada. Our servers and service providers are located in Canada and the United States.

If you are located outside Canada, your personal information may be transferred to and processed in Canada or the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to Canada and the United States.

Where we transfer personal information across borders, we ensure appropriate safeguards are in place, including:

Contractual data protection obligations with service providers
Compliance with PIPEDA's cross-border transfer requirements
Standard contractual clauses or equivalent mechanisms where applicable

For Quebec residents: Your personal information may be transferred outside of Quebec for processing. Before any such transfer, we conduct a privacy impact assessment as required by Quebec Law 25.

15. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete personal information.
Deletion: Request deletion of your personal information, subject to legal exceptions.
Portability: Request your personal information in a structured, machine-readable format.
Withdrawal of consent: Withdraw your consent to the processing of your personal information at any time (this does not affect the lawfulness of processing based on consent before its withdrawal).
Objection: Object to the processing of your personal information in certain circumstances.
Complaint: File a complaint with the applicable data protection authority.

How to Exercise Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond to your request within the timeframe required by applicable law (generally 30 days).

End Users

If you are a student, parent, guardian, or other end user whose data is managed by a subscriber through Caletan, please contact the subscriber directly to exercise your privacy rights. We will assist subscribers in responding to such requests as required by law and our Data Processing Agreement.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

For material changes, we will:

Notify subscribers by email at the email address associated with their account
Post a prominent notice on our website
Update the "Last Updated" date at the top of this Privacy Policy

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

17. Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us:

Privacy Officer Reservita Inc. Email: [email protected]

For complaints about our handling of your personal information:

Canada: You may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca
Quebec: You may file a complaint with the Commission d'acces a l'information du Quebec at www.cai.gouv.qc.ca
California: You may contact the California Attorney General at oag.ca.gov
EEA: You may lodge a complaint with your local data protection supervisory authority (see https://edpb.europa.eu/about-edpb/about-edpb/members_en)
United Kingdom: You may contact the Information Commissioner's Office (ICO) at https://ico.org.uk