Last updated: October 3, 2026
This Privacy Policy describes how LemCall, a LemStudio scheduling service, collects, uses, shares, and protects personal information when you use our website, booking service, integrations, API, or MCP plugin.
We collect information that you provide directly to us, including:
We use the information we collect to:
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. All data is encrypted in transit and at rest using industry-standard protocols.
We do not sell your personal information. We may share your information with:
The LemCall MCP plugin lets an AI assistant act through the permissions of your signed-in LemCall account. The assistant can receive only the workspace, booking, availability, coverage, and team data returned by the tools you ask it to use. Depending on your request and permissions, this can include names, email addresses, phone numbers, booking notes, meeting times, calendar-health signals, and internal LemCall record identifiers needed to complete the task.
We process your OAuth identity, the connected client identifier, requested tool arguments, permission checks, and tool results to authenticate the request and provide the requested action. LemCall does not give an AI assistant a service-role bypass: the same workspace isolation and permission checks continue to apply. Administrative writes use server-created previews and confirmation safeguards where supported.
Results sent to a connected AI assistant are also handled by that provider under its own terms and privacy controls. You choose whether to connect an assistant and what to ask it to do. Do not include sensitive information that is unnecessary for the scheduling task.
LemCall records limited operational audit metadata for MCP activity, such as the actor, OAuth client, tool, target, outcome, and timing. We avoid storing unrestricted prompts, bearer tokens, attendee notes, or full tool payloads in those audit records. You can disconnect LemCall in the AI client's connector settings. Contact support if you also want help revoking access or deleting your LemCall account data.
When you connect a Google Calendar, LemCall requests the minimum scopes required to provide scheduling:calendar.readonly(to read busy times and avoid double-booking) andcalendar.events(to create, update, and cancel events for bookings you make through LemCall).
LemCall's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell, transfer, or use Google user data for advertising, and we do not allow humans to read it except with your explicit consent, for security/abuse investigations, or where required by law.
If you connect a Zoom account, LemCall requests only the scopes needed to manage the meetings it creates for your bookings: meeting:write:meeting, meeting:update:meeting, meeting:delete:meeting, and user:read:user.
We store your Zoom access and refresh tokens, your Zoom user ID and account email, and the meeting ID and join URL of each meeting LemCall creates. Tokens are stored encrypted, are never exposed to booking visitors, and are used only to create, update, and delete meetings for your own bookings. We do not access recordings, chat, contacts, or meetings LemCall did not create, and we never sell Zoom data or use it for advertising.
You can revoke access at any time by disconnecting Zoom in LemCall, or by removing LemCall from the Zoom App Marketplace under Manage, then Added Apps. In either case we delete the stored Zoom tokens for that account immediately; when you remove the app from Zoom, Zoom notifies LemCall and the same deletion runs automatically. Meetings already created remain in your Zoom account.
You have the right to:
We use cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and personalize content. You can control cookie preferences through your browser settings.
We retain personal data only for as long as needed to provide the service, maintain security and auditability, resolve disputes, and meet legal obligations. Booking data is typically retained for 7 years for record-keeping purposes. OAuth tokens are retained while the relevant integration remains connected and are deleted or revoked when the integration is disconnected where the provider supports that action. Limited MCP audit metadata is retained while needed for account security, troubleshooting, and compliance, then deleted or anonymized when it is no longer required.
Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our service after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or our data practices, please contact us at:
Privacy Team
Email: support@lemcall.co
We typically respond within 48 hours
