Reclaim.ai

GDPR overview

GDPR compliance is claimed in writing. The security page states that Reclaim complies with GDPR, SOC 2, CCPA and the Data Privacy Framework, and the mechanisms behind that claim are published rather than asserted. Transfers rely on the European Commission's Standard Contractual Clauses, backed by certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Framework. A Data Processing Addendum sits online, with a signed copy on request. An Article 27 representative is named for the EU, Osano International Compliance Services Limited in Dublin, alongside a UK equivalent in Belfast. Data subject rights are listed in full and exercised through a dedicated DSAR form, reinforced by in-product self-service deletion. Complaints are answered within 45 days, with JAMS as independent recourse. Privacy questions go to privacy@reclaim.ai.

Who owns the data?

Reclaim states plainly that your data is yours. The security page commits to never selling or sharing calendar data for profit or co-marketing, and staff only look at calendar content if you ask them to during a support case, or in a rare critical emergency. Only the calendar attached to your account is stored; calendars connected for Calendar Sync are held in memory just long enough to copy an event. Deletion is self-service and wipes calendar data within an hour. Where an employer pays for your access, Reclaim acts as a processor on that employer's behalf, so the employer, not you, sets the terms.

Reuse rights

The published documents describe what Reclaim does with your data rather than granting you a licence over anything it holds. Personal and calendar data serve a listed set of purposes: running the service, blocking time, producing your analytics, answering support requests, sending administrative and marketing email, preventing fraud, improving the product and meeting legal obligations. Logs are anonymised before they reach subprocessors, and calendar data is encrypted in transit and at rest. The privacy policy is explicit about generative AI: personal, calendar and app data will not train a large language or other generative model unless you have given prior explicit consent or opted in through the product. OpenAI is the only AI subprocessor listed, and it is opt-in only. Content you create inside the tool, such as tasks, habits and scheduling links, stays yours to export, edit or delete at any time, and account deletion removes it.

Data retention & training

Hosting summary

Reclaim runs its infrastructure on Amazon Web Services and states that all data is hosted in the USA, with redundancy between the us-east-1 and us-east-2 regions. Every one of the nineteen subprocessors on the published list sits in the United States, among them AWS, Google Cloud, Microsoft, Cloudflare, Stripe, Intercom and Datadog; OpenAI appears separately, in an opt-in AI section. Calendar data is encrypted in transit and at rest, access is role-based, and Reclaim says it follows the AWS CIS Benchmark. The AWS facilities themselves carry SOC 1, SOC 2, PCI Level 1, HITRUST and ISO 27001 audits. For users outside the United States, transfers are covered by the European Commission's Standard Contractual Clauses and by certification under the EU-U.S., UK and Swiss-U.S. Data Privacy Frameworks. No European or other regional hosting option is offered, so a European customer should assume its calendar data physically leaves the EU. Availability is claimed at 99.9%, with a public status page.