{
  "slug": "cal-ai",
  "category": "scheduling",
  "name": "Cal.ai",
  "description": "AI phone agent from Cal.com that makes scheduling calls to book meetings, confirm appointments, send reminders and follow up on no-shows, triggered from Cal.com workflows.",
  "website": "https://cal.com/ai",
  "license": null,
  "platforms": [
    "web"
  ],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 38,
  "coverage": 100,
  "summary": "Cal.ai scores 38 out of 100 (grade F) on the scheduling criteria. It meets 3 of 8 criteria: no ads or data sales, TLS configuration and security headers. It partly meets independent audit. It does not meet open source, no trackers or telemetry, transparency report and tells users about requests. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.",
  "url": "https://privacyratings.com/scheduling/cal-ai/",
  "markdown": "https://privacyratings.com/scheduling/cal-ai/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": "https://cal.com/blog/cal-com-goes-closed-source-why",
      "note": "Closed source. Cal.ai is part of the Cal.com production codebase, which moved to a private repository."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://cal.com/privacy",
      "note": "The marketing site runs analytics and ad measurement, loading Google Tag Manager, PostHog and LinkedIn scripts, and the product uses opt-out product analytics."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://cal.com/privacy",
      "note": "Funded by paid usage. The privacy policy states personal data is never sold and booking data is not used for advertising profiles."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://cal.com/security",
      "note": "Cal.com lists SOC 2 Type II and ISO 27001 certification and third-party penetration tests, but the reports are not public."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "no",
      "evidence": null,
      "note": "No transparency report or government request policy is published."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published policy on notifying users about data requests."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=app.cal.com&hideResults=on",
      "note": "Grade A+"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "yes",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=app.cal.com",
      "note": "Grade A+ (125/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    }
  },
  "tests": {
    "ssllabs": "A+",
    "observatory": "A+",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [
      {
        "name": "Google Fonts",
        "host": "fonts.gstatic.com",
        "effect": "none"
      },
      {
        "name": "Google Tag Manager",
        "host": "www.googletagmanager.com",
        "effect": "no"
      },
      {
        "name": "PostHog",
        "host": "inline code",
        "effect": "no"
      },
      {
        "name": "Trustpilot",
        "host": "trustpilot.com",
        "effect": "none"
      },
      {
        "name": "X (Twitter) Pixel",
        "host": "static.ads-twitter.com",
        "effect": "no"
      },
      {
        "name": "YouTube embed",
        "host": "www.youtube.com",
        "effect": "none"
      }
    ],
    "tested_at": "2026-10-01T07:23:20.585Z"
  },
  "last_modified": "2026-10-01T07:44:20Z"
}