What we collect, and what we don't

Meetrao needs your calendar to do its job. That is a lot of trust, so this page is specific about what we take, what we leave alone, and who else touches it. No vague language about “improving your experience”.

Last updated 20 September 2026Data controller: Meetrao, Cumilla, Bangladesh

The short version

We read whether you are busy: never what your meetings are about.

We do not sell your data, or your guests' data, to anyone.

We never use your data or your guests' data to train machine-learning models.

Delete your account and it goes immediately. There is no grace-period copy.

1. Who we are

Meetrao is a scheduling service operated by a sole proprietor trading as Meetrao, at 44/A Judge Court Road, Cumilla 3500, Bangladesh. In this policy, “we”, “us” and “Meetrao” mean that operator, and “you” means the person using the service.

We are the data controller for the personal data described here, except for the data your guests give you when they book, see section 10. The one address to reach us at is hello@meetrao.com.

2. What we collect

Everything below is either something you typed, or something the product cannot work without.

From you, the host

Account details, your name, email address, password (stored hashed, never in readable form), and whether your email is confirmed.
Profile, job title, username and profile photo if you add one. Your name, title and photo are shown publicly on your booking page.
Your setup, meeting names and descriptions, durations, booking rules, weekly availability and your timezone. We detect your timezone from your browser and you can change it.
Notification preferences, the switches in Settings that decide which emails we send you.

From your guests

Name and email, required to confirm a booking and send the invitation.
An optional note, whatever they choose to type. It is passed to you and included in your notification email.
Their timezone, detected in the browser so times display correctly for them.

Guests do not create accounts and do not get passwords. For guest data, the host is the one who decides how it is used. We handle it on their instructions.

Because Meetrao invites the guest to the host’s calendar event, the guest’s name and email are passed to Google Calendar as an attendee, and host and guest can each see the other’s address on the event. That exchange is how the meeting reaches both calendars.

Automatically, when you visit the website

We count page views on the public pages, the home page, this one, the Terms, Help, Support, the sign-in pages and public booking pages. It works without cookies and without storing anything on your device. For each page view we record:

the path of the page, with the query string removed before it is stored;
the host of the site you arrived from, if any, “google.com”, never the full address;
a country, and sometimes a region and city, derived by our host from your IP address;
whether you are on a phone, a tablet or a desktop, and which browser and operating system family;
a one-way hash of your IP address, your browser’s user-agent string and a secret, which lets us count the same person’s two page views as one visit.

We do not store your IP address. It is used to compute that hash and to look up a country, and is not written anywhere. The hash includes today’s date, so it changes at midnight UTC: we can tell how many people visited today, and we cannot tell whether any of them came back next week. The signed-in product (your dashboard, bookings, meetings, contacts and settings) is not counted at all.

Separately, our email provider tells us whether a message we sent was delivered and opened, so we can tell when a booking confirmation has failed to arrive.

Google Analytics is also available on this site, and it is off unless you turn it on. See section 12.

3. Google user data

Connecting Google Calendar is optional. Meetrao works without it, it just cannot then see your conflicts. If you do connect it, here is exactly what we ask Google for and what each permission is used for.

calendar.freebusySee when you are busy or freeEvery time somebody opens your booking page, so a slot you already have something in is never offered.

calendar.eventsSee, edit and delete events on your calendarCreating the event for each confirmed booking with its Google Meet link, inviting your guest so it reaches their calendar too, updating or deleting that event when the booking changes or is cancelled, and reading whether your guest accepted or declined THAT event, by its own identifier, never by listing or searching your calendar.

userinfo.emailYour Google account's email addressShowing you which Google account is connected, on the Settings page, so you can tell a work account from a personal one.

openid · email · profileYour name, email address and profile pictureOnly if you choose Sign in with Google instead of a password. Used to create your Meetrao account and sign you in.

What we actually read. To find your conflicts, Meetrao asks Google one question: which intervals in the next few weeks are busy. It never requests the contents of your events, and no part of the service reads an event title, guest list, description, location or attachment.

What the permission would allow. We want to be straight about this, because Google’s consent screen is. Creating an event with your guest as an attendee requires the calendar.events permission, and that permission is read as well as write. There is no narrower permission that can add an attendee. So the access you grant is broader than the use we make of it. Google’s screen will tell you it lets us “see, edit and delete” your events; the limit on what we do with it is the commitment below, and our code.

What we store. A refresh token and a short-lived access token, so we do not have to ask you again; the email address of the connected Google account; and the identifier of the calendar to use. Busy times are read when they are needed and are not stored. The events Meetrao creates live on your calendar, not in our database. We keep only the booking record.

How to take it back. Disconnect at any time in Settings → Calendar. Two things happen, in this order: we ask Google to revoke the grant, which ends it on Google’s side and removes Meetrao from your account’s permissions, and then we delete both tokens from our database. Deleting your account does the same thing before it deletes everything else. Throwing our own key away is not the same as ending the grant, so we do both.

If Google cannot be reached at that moment, the disconnect still happens on our side and you can finish it yourself at myaccount.google.com/permissions, which is also where you can confirm at any time that Meetrao is gone. Events Meetrao already put on your calendar stay there for you to keep or delete; disconnecting does not cancel your existing bookings, but it does stop us checking for conflicts, so guests may be offered times you are not actually free.

Only the providers below, and only for the purpose named. Each is bound by contract to use it solely to provide that service to us, and none may use it for their own purposes.

Convex (database and authentication, N. Virginia)Stores the Google refresh and access tokens, the connected account's email address, and the calendar identifier. Also stores the booking records that produce calendar events, and runs the code that calls Google. The tokens are used where they are stored and are never returned to the website. The only provider that holds Google user data at rest.

Vercel (hosting, functions in Tokyo)Processes it in memory while a request is being served, for example while creating an event. Stores none of it.

Resend (email, United States)Receives what appears in a confirmation email: the meeting name, the time, the guest's name and email address, and the Google Meet link. Never receives your tokens, and never the contents of your calendar.

GoogleThe source, and the destination. Events Meetrao creates are written back to your own Google Calendar, and Google notifies your guest.

Nobody else. Google user data is not sold, rented or traded. It is not shared with advertisers, ad networks, data brokers or analytics providers, Google Analytics receives none of it. It is not used to develop, improve or train generalised or general-purpose artificial intelligence or machine-learning models, by us or by any provider above. The only disclosures outside this list are where the law compels us, or where it is strictly necessary to protect the service or someone’s safety; if Meetrao is ever sold or merged we will tell you before your data transfers.

How we protect Google user data

Calendar access is a sensitive scope, and these are the specific mechanisms that protect the data it gives us:

Encrypted in transit. Every connection, browser to Meetrao, Meetrao to Google, Meetrao to its database, uses TLS. The site is served over HTTPS only.
Encrypted at rest. Our database provider encrypts stored data at rest with AES-256.
Tokens are unreachable from any browser, and from our own website. Google refresh and access tokens are readable only by internal database functions, which no client can call at all, not a signed-in session, not our website, not a request carrying any key we publish. Nothing anywhere returns a token. The code that talks to Google runs inside the database alongside the tokens, so the credential is used where it is stored and never travels.
The least data we can hold. Busy and free intervals are fetched when a booking page is opened and are never written to our database. Event titles, guests, descriptions, locations and attachments are never requested at all, so there is nothing of that kind to protect.
Revoked, then deleted. Disconnecting calls Google’s revocation endpoint first and deletes both tokens afterwards, so the grant ends on Google’s side rather than merely becoming unusable on ours. Deleting your account does the same before deleting everything else. There is no grace-period copy and no backup that outlives it.
Human access. Production data can be reached only by the one person who operates Meetrao, using individually authenticated accounts with two-factor authentication, and only to fix a fault. No human reads your Google user data otherwise.
If something goes wrong. We will notify affected users and the relevant regulator as quickly as the law requires.

4. Google Limited Use

Meetrao’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, and specifically:

we use Google user data only to provide and improve the scheduling features you can see in the product;
we do not transfer it to anyone except as needed to provide those features, for security, or where the law requires it;
we do not use it for advertising, and we do not sell it;
we do not use it to develop, improve or train generalised or general-purpose artificial intelligence or machine-learning models;
no human at Meetrao reads your Google user data, except with your explicit permission for a support request you have raised, for security, or where the law requires it.

5. What we don’t do

We do not sell your data, or your guests’ data, to anyone.
We do not read the contents of your calendar events.
We do not use your data or your guests’ data to train machine-learning models.
We do not run advertising or share data with ad networks.
We do not email your guests marketing. They hear from us only about the booking they made.

6. Why we use it

Account detailsSigning you in, and keeping your booking link yours.

Calendar busy timesNever offering a time you already have something in.

Permission to create eventsWriting each confirmed booking to your calendar with its Meet link.

Guest name, email and noteConfirming the booking, inviting them to the event, and telling you who is coming.

Notification preferencesSending only the messages you asked for.

Page viewsKnowing which pages are read and whether the site works on real phones.

If you are in the EU or UK, our legal bases are: performing our contract with you (running the service, sending booking emails); legitimate interests (keeping the service secure, and counting page views in a way that cannot identify anyone); your consent (connecting Google Calendar, Google Analytics, marketing email); and legal obligation where one applies. You can withdraw a consent at any time without affecting what was done before you did.

We use a small number of companies to run Meetrao. Each is contractually limited to what we hire them for, and none may use your data for their own purposes.

VercelHosting and content deliveryUnited States

ConvexDatabase, authentication and file storageUnited States (N. Virginia)

GoogleCalendar, Meet, Sign in with Google, and Google AnalyticsUnited States

ResendTransactional email deliveryUnited States

Google Analytics is the one item on that list that does not run unless you allow it, and it is the only one that receives anything about you before you have an account. It receives no Google user data at all, who receives that, and what each one gets, is set out in section 3.

The people you meet with also see things: your guest sees your name, title, photo, meeting details and the times you are free, and you see your guest’s name, email and note. That exchange is the point of the product.

We will disclose data if the law requires it, and to protect the service or someone’s safety. If Meetrao is ever sold or merged, your data may transfer with it. We will tell you first.

8. Where it is stored

Meetrao is operated from Bangladesh. Your account data and bookings are stored by Convex in the United States, in the US East (N. Virginia) region. The website is served by Vercel’s global network, and email, calendar and analytics are handled by providers in the United States. Your data will therefore be transferred and stored outside your own country.

Where we move personal data out of the EU or UK, we rely on the European Commission’s Standard Contractual Clauses, or the UK Addendum, as incorporated into our agreements with the providers named above. Bangladesh has no EU adequacy decision, so the same clauses cover the data reaching us. You can ask us for a copy of the mechanism that applies to you.

9. How long we keep it

While your account is open, we keep your data so the service works. When your account is deleted (by you, or by us for a breach of the terms), we delete it immediately. Profile, booking link, meetings, availability, booking history and calendar tokens all go. We do not keep a grace-period copy, so export anything you want to keep first.

Google tokens are revoked with Google and then deleted the moment you disconnect the calendar, which does not require deleting your account. Page-view records are deleted automatically after 400 days.

Two caveats, both narrow. Encrypted backups may hold deleted data for a short window before they rotate out. And where the law requires us to retain a record, we keep only that record and only for as long as required.

10. Your rights

Wherever you are, you can ask us to show you what we hold, correct it, delete it, or send you a copy. Email hello@meetrao.com and we will reply within 30 days. We will not charge you or treat you differently for asking.

Some of it you can do yourself: edit your profile in Settings, change your notification preferences, disconnect Google Calendar, or delete your account outright.

If you are in the EU or UK, you also have the right to object to processing, to restrict it, to data portability, and to withdraw consent at any time. You can complain to your national data protection authority, for the UK, the ICO.

If you are in California, you have the right to know what we collect, to delete it, to correct it, and to opt out of sale or sharing, although we do not sell or share personal information as those terms are defined, so there is nothing to opt out of.

If you are a guest, not a host: the person you booked with controls your booking data, and we handle it on their instructions. Ask them, or ask us and we will pass it on.

11. Security

Traffic is encrypted in transit with TLS, and our database provider encrypts its storage at rest. Passwords are hashed and never stored readably. Google tokens are readable only by internal database functions that no client can call, and nothing returns one. The code that uses them runs inside the database beside them. Every request is authorised against the signed-in account before it reads a single row, so one person’s bookings are not reachable from another’s session. Email addresses have to be confirmed before an account works, which keeps someone from signing up as you.

Access to production data is limited to the one person who operates Meetrao, and is used to fix faults, not to read your bookings.

The mechanisms protecting Google user data in particular (a sensitive scope) are listed in full under how we protect Google user data.

No system is perfectly secure. If a breach affects your data, we will tell you and the relevant regulator as quickly as the law requires.

12. Cookies and analytics

Necessary cookies. Signing in sets a cookie that keeps you signed in. It is required for the product to work at all and cannot be turned off without breaking it. If you never sign in, we set no cookie.

Our own page counting. Described in section 2. It sets no cookie, stores nothing on your device, and cannot follow you from one day to the next. Because it does not touch your device and cannot identify you, we do not ask permission for it.

Google Analytics. We may run Google Analytics to understand which pages get read. Google Analytics does set cookies, so it loads only if you press Accept on the banner, before that, no script from Google is on the page and no request reaches Google at all. Pressing “No thanks” keeps it off, and costs you nothing: the site behaves identically. If Google Analytics is not switched on for this site, no banner appears, because there is nothing to consent to.

You can change your mind whenever you like:

Clearing your browser’s storage for this site also clears the answer, and the banner will ask again.

13. Children

Meetrao is not for children. We do not knowingly collect data from anyone under 16. If you believe a child has given us their information, email us and we will delete it.

14. Changes to this policy

If we change how we use your data in a way that matters, we will email you before it takes effect and update the date at the top. Minor wording fixes we will just make. The date at the top of this page is the date of the current version.

15. Contact us

Email hello@meetrao.com for anything in this policy, including a request to see, correct, export or delete your data. You can also use the contact form. By post: 44/A Judge Court Road, Cumilla 3500, Bangladesh.

Privacy questions or requestsEmail hello@meetrao.com, or write to 44/A Judge Court Road, Cumilla 3500, Bangladesh. A person reads it.