Scheduling software and EU data residency: where ten tools store booking data

How to read this comparison

Every statement about another vendor comes from that vendor's public pages: terms, privacy policy, data processing agreement, sub-processor list or help centre. We read them on 12 November 2026 and link each one. Where the documents do not mention something, we say that we did not find it. That is not proof that it does not exist.

None of this is a verdict on GDPR compliance. The GDPR applies to how you use a tool: which data you collect, on what lawful basis, and for how long. Data location is one input to that assessment.

Tools that describe US hosting: Calendly and Acuity Scheduling

Calendly's help centre says user and invitee data is stored in US data centres run by Google Cloud and AWS. Its data processing addendum, effective 1 June 2026, relies on the EU-US Data Privacy Framework for transfers, with Standard Contractual Clauses as the fallback. We found no EU hosting option in Calendly's documentation. More detail is in Is Calendly GDPR compliant?.

Acuity Scheduling belongs to Squarespace. Under the Squarespace terms, which name acuityscheduling.com, users outside the US contract with Squarespace Ireland Limited. The privacy policy, effective 15 July 2026, says personal information may be transferred to Squarespace's servers in the US. The data processing addendum names the EU-US Data Privacy Framework and Standard Contractual Clauses, and says the list of sub-processors is available on request by email. We found no EU hosting option in these documents.

US hosting with an EU option: Cal.com

Cal.com, Inc. is a Delaware company. Its privacy policy says data is processed in the United States and names the Data Privacy Framework and Standard Contractual Clauses for transfers. Its Europe page describes hosting where all data is stored and processed inside the EU. According to that page, Europe hosting comes with the Organizations plan and up, and past Individual accounts move to Cal.com, hosted in the USA. The data processing addendum applies to every plan, and the sub-processor list is public.

Location set by your account: Microsoft Bookings, Google Calendar and Zoho Bookings

Microsoft says all Bookings data is stored in Microsoft 365, in Exchange Online (Bookings overview). For Microsoft 365 customers whose sign-up location is in the EU or EFTA, the EU Data Boundary commitment applies, with limited exceptions that Microsoft documents on the same pages. Bookings is part of many Microsoft 365 plans and is not sold on its own. See also Microsoft 365 scheduling.

Appointment schedules in Google Calendar come with Google Workspace and with personal Google accounts. Google's Cloud Data Processing Addendum allows customer data to be processed in any country where Google or its sub-processors have facilities. Admins on supported Workspace editions can choose the European Union as the data region. That list includes Business Standard and Business Plus; Business Starter and personal accounts are not on it. Google lists Calendar event data among the data covered at rest; processing is covered only in its Enterprise and Assured Controls tiers.

Zoho assigns each account to a data centre based on the country chosen at sign-up (Know your data centre); its EU data centres are in Amsterdam and Dublin. Zoho's privacy FAQ says service data of accounts in the EU data centre is stored within the EU, and that it may be accessed from India for technical support under Standard Contractual Clauses. Per Zoho's list of contracting entities, customers in the EEA contract with Zoho Corporation B.V. in the Netherlands, and customers in Germany, Austria and Switzerland with Zoho Corporation GmbH. These are Zoho-wide documents; we found nothing specific to Zoho Bookings.

Tools that describe EU hosting by default: Doodle, Zeeg and meetergo

Doodle AG is based in Zurich. Its privacy policy says production data is stored in Ireland and pre-production data in Germany, and that transfers abroad are covered by EU model clauses or binding corporate rules. Its sub-processor list, current as of 5 November 2026, is public and includes US companies for payment processing, email delivery, analytics and error monitoring.

Zeeg GmbH is based in Berlin. Its privacy policy, updated 2 November 2026, says servers and databases are in Deutsche Telekom data centres in Germany, with a Telekom data centre in the Netherlands as the backup site. Its pricing page says a data processing agreement is included in every plan. For sub-processors that are US companies, Zeeg's help centre names Standard Contractual Clauses and, where applicable, the Data Privacy Framework.

meetergo GmbH is based in Monheim am Rhein, Germany. Its sub-processor list, updated 6 October 2026, names Hetzner in Germany (Falkenstein and Nuremberg) for cloud infrastructure and hosting. The same list shows that data passes to US companies for some functions, such as Stripe and Twilio. Its privacy policy names the EU-US Data Privacy Framework and Standard Contractual Clauses for those transfers, and says customers can download a data processing agreement in their admin area.

Kalendarius, for comparison

Kalendarius is operated by Ugur Akcelik in Turin, Italy. The application and database run on Hetzner servers in Germany (Nuremberg and Falkenstein). Not everything stays there: error reports go to Sentry, a US company that stores them in its EU region, Paddle handles payments, and an email delivery provider sends confirmations and reminders. If you connect a Google, Microsoft or Zoho calendar, that provider processes the events under its own terms.

A Data Processing Agreement (DPA) for the Business and Enterprise plans is in legal review; contact info@kalendarius.com. Several tools on this page publish a DPA today, and Zeeg says it includes one in every plan. The details are in our privacy policy and on the about page. To test the product, start free on the Personale plan.

What the hosting location does not tell you

A data centre in the EU says where the main database sits. It does not say who else receives data. Check the sub-processor list for email delivery, payments, support tools, analytics and error monitoring, and check whether staff outside the EU can access data for support.

Integrations add their own recipients. A booking that lands in Google Calendar or Outlook, or that creates a Zoom, Meet or Teams link, is processed by that provider too. Your booking form matters as well: every extra field is data you have to protect and delete. The GDPR scheduling software checklist goes through these points.

Sources and corrections

The linked vendor pages are the sources; we read them on 12 November 2026. Plans, documents and hosting set-ups change, so open the links before you decide. If something here is wrong or out of date, write to info@kalendarius.com and we will correct it.