YoteiAI Calendar Tools and the GDPR: A Checklist for EU Teams
A calendar tool that reads your screen sees more than one event. It can see names, messages and whatever else is in the capture. Before a team in the Netherlands or elsewhere in the EU uses one, it is worth asking a few plain questions about what is captured, where it goes and how long it stays.
This is a checklist for that. It is written by someone who builds one of these tools, so I have also said how Yotei answers each question, including where the answer is a limit.
This is not legal advice. I am not a lawyer. The GDPR articles linked below are the source for the legal points, and your own data protection officer or lawyer should decide what applies to your company. No tool is "compliant" on its own, because compliance depends on how you use it.
The short answer
Seven checks cover most of it. If a vendor cannot answer one in writing, treat that as an answer.
- What exactly is captured?
- Who processes it, and is there a contract?
- Does anything leave the EEA?
- How long is it kept?
- What are users told, and do they consent?
- Who is the company and where is it based?
- Do you need a data protection impact assessment?
Why screen-reading tools get extra attention
A normal calendar app handles event data you typed. A tool that reads an image handles whatever is in the image. The risk is not the event, it is everything next to it: a private chat, a colleague's name, a client's email. That is why the first question is about scope, and why a tool that reads only a selected area is easier to defend than one that captures the whole screen.
The seven checks
1. What is captured
Find out whether the tool captures the whole screen, a window or only an area you choose, and whether it ever captures in the background. Ask whether the user sees what was read before anything is saved.
2. Who processes it, and under what contract
If the vendor processes personal data for you, the GDPR expects a contract between you and the vendor that sets out what they may do with it. That is Article 28. Ask for the data processing agreement and a list of sub-processors, such as the AI service that reads the image.
3. Transfers outside the EEA
Sending personal data to a country outside the European Economic Area is regulated under Chapter V. Ask where the image is processed, including by any AI provider, and what safeguard is used if it leaves the EEA.
4. How long it is kept
Personal data should not be kept longer than needed (Article 5). For a tool that turns a screenshot into an event, the image has no use once the event is confirmed. Ask when it is deleted, whether backups keep it, and whether extracted event data is kept and for how long.
5. What users are told and whether they consent
People whose data is processed should be told in plain language. Check the vendor's privacy policy for what it says about screenshots, and check whether the tool asks for consent before sending an image to an AI service.
6. Who the company is
You want a named company, a registered address and a contact for privacy questions. A vendor that does not say where it is based makes every other answer harder to rely on.
7. Whether you need an impact assessment
For processing that is likely to carry a high risk, the GDPR requires an assessment before you start (Article 35). Whether a screen-reading calendar tool needs one depends on how you use it and what appears on screens. Ask your data protection officer, and keep a record of the decision either way.
The checklist at a glance
| Question | A good answer looks like | A red flag looks like |
|---|---|---|
| What is captured | Only the area the user selects, shown for review before saving | Whole screen, or capture in the background |
| Who processes it | A signed data processing agreement and a sub-processor list | No contract, or "we may share with partners" |
| Leaves the EEA | A stated location and a stated safeguard | "Processed in the cloud" with no location |
| How long it is kept | A specific period, deleted on confirmation | "As long as needed" or silence |
| Consent and notice | Asked before an image goes to an AI service | Buried in terms |
| Company | Named entity, address, privacy contact | No address or entity name |
| Impact assessment | A documented decision either way | Never discussed |
How Yotei answers these
Yotei
Windows and Mac desktop app, KD Digital
- Captured: only the area the user selects, on a shortcut. It does not watch the screen in the background, and nothing is added to a calendar until the user confirms.
- Retention: the screenshot is deleted as soon as the event is confirmed, or within 48 hours if it is not.
- Processing: an AI service reads the image. It may be outside the EEA, and it is only used after the user consents. The privacy policy names the providers.
- Servers and company: KD Digital is a Dutch company in Apeldoorn, with servers in Germany. Calendar connection tokens are stored encrypted.
- Position: I built Yotei to meet the GDPR. That is a statement about the design, not a certification or a promise that your use of it is compliant.
Limits: the AI service being outside the EEA is a real consideration for some teams, and only your own assessment can say whether it is acceptable for you. If you need a data processing agreement or a record of the providers, ask at support@yotei.win.
More on the practical side: is a calendar app safe to read your screen and the comparison of screenshot to calendar apps, which has a table of what each product says about its data.
Questions to send a vendor
Copy these into an email to any tool you are considering, not only ours:
- Does the tool capture the whole screen, a window or a selected area, and does it ever capture without a user action?
- Which companies process the data, in which countries, and can you send the data processing agreement and sub-processor list?
- If any processing happens outside the EEA, what safeguard applies?
- When are images deleted, including from backups, and how long is extracted event data kept?
- Is the user asked for consent before an image is sent to an AI service?
- Which legal entity runs the service, and what is its registered address and privacy contact?
FAQ
Does an AI calendar tool meet the GDPR on its own?
No tool can settle that on its own. Meeting the GDPR depends on how your company uses it, what you tell people and what contracts you have. A vendor can build its product to meet the GDPR and give you what you need to assess it.
Do I need a data processing agreement for a calendar app?
If the vendor processes personal data on your behalf, the GDPR expects a contract that sets out what they may do. Ask for it and read the sub-processor list.
Is it a problem if the AI provider is outside the EEA?
It can be allowed, but transfers outside the EEA need a legal safeguard and should be part of your assessment. Ask the vendor where processing happens and which safeguard applies.
How long should a screenshot be kept?
Only as long as it is needed. For a tool that creates an event from an image, that is until the event is confirmed. Look for a stated deletion period, not "as long as needed".
