Mentorloop Calendar Connect lets mentoring partners find times that suit everyone and have meetings added to their calendars automatically. This article explains what it accesses, what it stores, and how that data is protected. Connecting a calendar is optional, and can be undone at any time.
How does calendar access work?
Mentorloop reads a calendar only where there's a specific, revocable permission to do so. There are two ways that permission can exist.
An individual connection. A participant connects their own calendar, once, through their calendar provider's standard sign-in. Mentorloop never sees their password. This works with Google Workspace, personal Google accounts, Microsoft 365, and personal Outlook.
Calendar Connect for Organizations. An administrator authorizes Mentorloop once for the whole organization, so participants have nothing to set up. This works with Google Workspace and Microsoft 365. See Calendar Connect for Organizations.
If a participant has connected their own calendar, that always takes precedence over their organization's authorization. Someone's own choice about their own calendar outweighs a default applied on their behalf.
A participant covered by neither is simply never read.
What can Mentorloop see?
When someone is busy. Not what they are doing.
The permission Mentorloop requests returns periods of time and nothing else. It does not return event titles, descriptions, locations, attendees, organizers, or attachments. Mentorloop cannot retrieve them, because it never asks for the permission that would allow it.
So when your mentoring partner sees that you're free at 2pm on Thursday, that's all they see. They can't see what you're doing at 3pm, who you're doing it with, or where.
Can participants choose to share less?
Yes. When a participant connects their own calendar, they choose between two options:
Add meetings to my calendar — Mentorloop can see when they're busy and can put the mentoring meetings they organize straight into their calendar.
See my availability only — Mentorloop can see when they're busy and can never change their calendar. They receive ordinary calendar invitations by email instead.
Both options allow full use of Mentorloop. Nobody is shut out of the product for choosing the more private one.
What does Mentorloop store?
Almost nothing, and no calendar data at all.
| Busy and free times | Not stored. Read at the moment someone is scheduling, used to work out which times suit everyone, then discarded |
| Times Mentorloop suggests | Not stored. Worked out fresh each time |
| Event titles, attendees, descriptions, locations, attachments | Never accessed, so never stored |
| A participant's availability rules — the weekly hours they're happy to be booked | Stored as their own setting, until they change it |
Mentorloop doesn't keep a copy of anyone's calendar. Availability is read when it's needed and then discarded.
Who can see this data?
No one, because it isn't collected. Mentorloop staff cannot look up what's in a participant's calendar, because Mentorloop doesn't hold it and doesn't have permission to ask for it.
Access to the Mentorloop platform itself is governed by the roles described in the Mentorloop Security Policy, and Program Coordinators see meeting details in their program exactly as they always have — that's Mentorloop data, not calendar data.
Where is it processed?
Inside Mentorloop's own cloud environment, in the same region as the rest of your Mentorloop data — Sydney, London, or Ohio.
No third party is involved. The only parties in the calendar data path are your own calendar provider — Google or Microsoft — and Mentorloop.
How is it secured?
- All communication is encrypted in transit.
- Where a participant connects their own calendar, the credential their provider issues is encrypted before it's stored and is never held in plain text.
- Before Mentorloop reads or changes a calendar, it checks that it has permission to. If it can't confirm that, it doesn't go ahead.
- Every request is logged — including refused ones — so any attempt to reach a calendar without permission is visible.
The full technical detail is in Mentorloop Calendar Connect — Security and Data Handling. Ask your Customer Success Manager for a copy to share with your security team.
What happens if calendars aren't connected?
Mentorloop still works. Participants can schedule meetings, and they'll receive ordinary calendar invitations by email. What they lose is the convenience: availability isn't shown when picking a time, and meetings aren't added to calendars automatically.
How does someone disconnect?
A participant can disconnect at any time from Account settings → Integrations. Their stored credential is destroyed immediately, their availability stops being read, and no further meetings are added to their calendar.
An administrator can withdraw the organization's authorization at any time in their own console, which stops organization-wide access immediately.
In both cases, meetings already in people's calendars stay there. They belong to the people in them.
One thing to know about Microsoft accounts: Microsoft doesn't allow an application to withdraw its own permission. When a participant with a Microsoft calendar disconnects, Mentorloop destroys its credential and can no longer access anything — but the Mentorloop entry stays listed in their own Microsoft permissions until they remove it. They can do that at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts). Google accounts don't have this limitation; the permission is withdrawn at the provider straight away.
Have a question that isn't answered here? Reach out to your Customer Success Manager or support@mentorloop.com.