1. Overview
The Calendly integration polls authorized organization members, event types, scheduled events, and invitees through a workspace-managed personal access token.
Webhooks are not required by the released setup. Subscription records are staged only as operational diagnostics for future live synchronization.
2. Connection and scope
Seedling verifies the provider account before storing the workspace connection. A current Seedling workspace administrator controls installation and disconnect; account identity is never inferred from an email address or display name.
- Calendly personal access token
- Create the token from an owner or administrator account when organization-wide members and scheduled events should be read.
- Connection ownership
- This connector is workspace-only. A current Seedling workspace administrator controls installation, credential replacement, disconnect, and purge for the exact connection.
3. Calendly data Seedling accesses
Seedling uses synchronized information for source-backed search, operating context, verification, and customer-approved workflows. Availability depends on the connected account, selected resources, provider plan, and native permissions.
- Scheduling structure
- Organization members, profiles, event types, scheduling links, and availability-related metadata returned by the API.
- Scheduled events
- Event identity, status, timing, location, host, cancellation, and rescheduling context.
- Invitees
- Invitee names, emails, answers, external guests, and calendar links returned to the authorized account.
4. Read-only permission contract
Use only the Calendly read scopes required for the implemented polling path and its bounded diagnostics.
- users:read and organizations:read — identity, membership, and organization verification.
- event_types:read — event-type and scheduling-link configuration.
- scheduled_events:read — scheduled events and invitees.
- webhooks:read — optional subscription diagnostics only; Seedling does not require webhook writes for this setup.
- No scheduling, invitee, event-type, or webhook mutation is implemented.
5. Security and access
- Provider credentials and other connection secrets are encrypted in the workspace tenant data plane, never returned to the browser, and excluded from logs and queue payloads.
- Every source, synchronization, secret lookup, audience contribution, disconnect, and purge remains bound to the exact connection that created it.
- The provider does not expose enough complete object-level audience evidence for Seedling to reproduce native permissions safely. Workspace content therefore uses the connection's restricted-by-default workspace-or-no-human-access policy; administrator and steward status grant no raw-content bypass.
- Invitee identities, answers, external guests, locations, and calendar links are sensitive and remain under the exact connection's restricted human-access policy.
- Generated output cannot bypass Seedling's human review, verification, and approval gates.
6. Retention and deletion
- Connected data
- Synchronized Calendly records remain while the connection is active and are removed through a durable integration purge after disconnect.
- Credentials
- Stored Calendly credentials or connection secrets and connection-owned synchronization state are deleted from active Seedling systems as part of the purge.
- Backups
- Deleted information may remain in encrypted, access-restricted backups until expiry, ordinarily within 35 days after active-system deletion.