Privacy policy (draft)
Who we are
SchedNext provides online booking software to businesses ("customers of SchedNext"). For bookings made through a business's page, that business decides why and how its clients' data is used, and SchedNext processes it on the business's behalf.
What we collect
Business accounts: name, email, password (stored only as a one-way hash) and business settings. If you choose "Continue with Google", Google tells us your name, your verified email address and an account ID; we don't receive your Google password or access to anything else in your Google account, and we don't keep Google's sign-in tokens. Bookings: the name, email, optional phone number and notes a client enters, and the appointment details. Technical: IP address and browser type for security and rate limiting.
Google Calendar
If a team member connects Google Calendar, SchedNext receives: the times they are busy in the calendars they choose (never event titles, places, guests or descriptions), the names of their calendars (so they can choose), and access to one calendar SchedNext creates in their account, called "SchedNext bookings", where we add, update and remove their bookings. We store the busy times and an encrypted access token, use them only to prevent double bookings and keep that calendar up to date, and delete them when they disconnect. We don't use Google data for advertising, don't sell it, don't let people read it except for security or legal reasons or with your permission, and don't use it to train AI models. SchedNext's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Cookies
We use one essential cookie to keep business users signed in, and a short-lived one (10 minutes) while you sign in with Google or connect Google Calendar, to make sure the request started in your browser. We do not use advertising or cross-site tracking cookies.
How we use data
To run bookings, send confirmations and reminders, keep the service secure, and provide support. We do not sell personal data and do not send client data to AI services.
Retention
Booking records are kept while the business account is active. Copies of sent emails are deleted after 30 days. Businesses can delete individual client records at any time.
Your rights
Clients can ask the business they booked with to access or delete their data; businesses can export or erase a client record from the dashboard. Business users can delete their business and their account in Settings. Contact us for anything else.
Sub-processors
Hosting, database, and email delivery providers. A current list will be published before launch.