Privacy Policy
Draft for review. Not yet in effect.
This policy explains what personal data OnlineScheduling.com, LLC ("we") collects, why, who we share it with, how long we keep it and what rights you have. It covers our website, the sign-in screens and the OnlineScheduling service.
1. Who is responsible for your data
We play two roles:
- Your employer or organization is in charge of schedule data. When an organization (our "Customer") uses OnlineScheduling, it decides what goes into its schedule: worker records, notes, availability, rules, files and schedules. For that data the Customer is the controller and we are its processor: we handle the data only on its instructions, under our Data Processing Addendum. If you are a worker, questions or requests about your schedule data should go to your manager first. If you contact us, we will pass your request to them.
- We are in charge of account and service data. For sign-in, sign-up, security records, website visits and measuring how the service is used, we are the controller.
Contact: privacy@onlinescheduling.com, OnlineScheduling.com, LLC. EU representative: [EU representative]. UK representative: [UK representative].
2. What we collect
| Data | Whose | Where it comes from | Our role |
|---|---|---|---|
| Name and email address from Google sign-in (we don't keep your profile photo) | Managers, workers | Google, when you sign in | Controller |
| Email address and a one-time sign-in code (we store only a hashed form of the code) | Managers, workers | You | Controller |
| Sign-in security records: email address, IP address and time of each code request | Anyone who requests a code | You, your browser | Controller |
| Sign-up records: email address, sign-in method, dates | People who sign up before a manager adds them | You | Controller |
| Worker record: name, email, positions, tags, seniority date, weekly hour limits, notes | Workers | Your manager | Processor |
| Facts managers record about people (for example skills, preferences, who works well together), and who recorded them | Workers | Your manager | Processor |
| Shifts, time off, availability, trade and drop requests and their reasons | Workers | You, your manager | Processor |
| Google Calendar data: free/busy times from your main calendar (never event titles, details or guests there); the titles you give to blocks in the "Can't work" calendar | Workers who connect a calendar | Google, with your permission | Processor |
| Files managers upload (schedules, rosters, policies), messages to the AI assistant and its replies | Managers, and workers named in them | Managers | Processor |
| Feedback on assistant answers (we remove worker names and emails before storing it) | Managers | Managers | Controller |
| Usage events: which feature was used, when, by which account (a manager's email or a worker's internal id), with counts and durations. No IP address or browser details. | Managers, workers | The service | Controller |
| Server logs: IP address, page address requested, time | Anyone who visits | Your browser | Controller |
| Email we send you (invites, shift notices, sign-in codes) | Managers, workers | The service | Processor (schedule notices), controller (sign-in codes) |
We don't collect phone numbers, payment card details, location or precise device information. We don't use advertising or analytics trackers.
3. Why we use it, and our legal bases (EU/UK)
| Purpose | Legal basis where we are controller |
|---|---|
| Sign you in and keep your session secure | Contract (to provide the service you or your organization asked for) |
| Stop abuse, for example by limiting how often sign-in codes can be requested | Legitimate interests (security) |
| Measure and improve the service, plan capacity and costs, bill Customers for usage | Legitimate interests (running the business) |
| Answer support and privacy requests | Legal obligation; legitimate interests |
| Comply with law and defend legal claims | Legal obligation; legitimate interests |
Where we are a processor, the Customer is responsible for having a legal basis for its schedule data.
4. Google user data
When a worker connects Google Calendar, we ask for two permissions:
calendar.freebusy: see when you are busy, but not what your events are;calendar.app.created: create and manage the two calendars this app makes, "Work shifts" and "Can't work". We can't see your other calendars through this permission.
We use this access only to put your shifts in your calendar, keep shifts off times you are busy, and read the time-off blocks you add to "Can't work". Shift events we write include the names of colleagues on the same shift. Sign-in with Google gives us only your name, email address and whether Google has verified it.
OnlineScheduling's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, don't sell it, and don't use it to train AI models. People don't read it except with your permission, for security, or to comply with law.
You can disconnect at any time in the app. This deletes our copy of your Google access. You can also remove our access at myaccount.google.com/permissions. The two calendars stay in your Google account until you delete them.
5. AI processing
Managers can ask an AI assistant to build or change schedules and read uploaded files. To answer, the assistant receives the manager's message and the schedule data it needs, which can include workers' names, email addresses, positions, availability and time-off reasons. When the service checks rules against facts about people, it replaces names with codes first.
The models (made by Anthropic) run on Amazon Bedrock inside AWS, in the same geography as your organization's data: US regions for US customers, EU regions for EU and UK customers. Amazon doesn't share these inputs with the model maker and doesn't use them to train models. We don't use them to train models either. The assistant's suggestions are reviewed by a manager before they take effect.
6. Who we share it with
We don't sell or "share" personal data for cross-context advertising, as those terms are used in US state privacy laws. We disclose it only to:
| Recipient | What for | Location |
|---|---|---|
| Amazon Web Services (hosting, database, backups, email delivery via Amazon SES, logs, AI models via Amazon Bedrock) | Running the service | United States (us-east-1) for US customers; Ireland (eu-west-1) for EU and UK customers, with their AI requests processed only in EU regions |
| Sign-in and Calendar, when you choose to use them | United States and Google's other locations | |
| Your organization's managers | Running your schedule. Managers can see and act on worker records and schedules. | Wherever your organization is |
| Authorities or others when law requires, or to protect rights and safety | Legal compliance | As required |
| A buyer or successor, if the business is sold or merged | Continuity of the service | As applicable |
We will list any new subprocessor at [subprocessor page] at least 30 days before it starts.
7. International transfers
We are based in the United States. EU and UK customers' schedule data is stored and processed in the EU (AWS Ireland), and AI requests about it stay in EU regions. Data of other customers is stored in the US. Some personal data about EU and UK users still reaches the US: pseudonymous usage counts sent to our internal management tool, access by our US-based staff when a customer asks for support, and Google's processing for workers who connect a calendar. For these transfers we rely on [the EU-U.S. Data Privacy Framework and its UK Extension / the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum].
8. How long we keep it
| Data | How long |
|---|---|
| Session sign-in tokens | Up to 30 days, removed a day after they expire |
| Sign-in codes and code-request records | Deleted a day after they expire (codes last 10 minutes) |
| Sign-up records with no organization | 12 months after the last sign-in |
| Schedule data, including the Ledger | For as long as the Customer's account is open, then deleted as set out in the Terms (section 10) |
| Uploaded files | 90 days by default (the Customer can change this); a record of the file's name and fingerprint stays in the Ledger |
| Google Calendar access | Until you disconnect, or the Customer removes you |
| Usage events | 24 months |
| Copies of emails we send | 90 days |
| Server logs | 30 days |
| Backups | 30 days |
Records in the Ledger are permanent while the account is open. The Ledger is how anyone can check what changed and when, so its records can't be edited or removed one at a time. If a worker is removed from a schedule, their past records stay until the Customer's account is closed.
9. Security
We encrypt data in transit (HTTPS) and at rest (AWS KMS). Each Customer's schedule data is kept in its own database. Sign-in codes and session tokens are stored only in hashed form, and session cookies can't be read by page scripts. Access to production systems is limited to the people who need it. No system is perfectly secure. If a breach affects your data, we will notify the Customer, and you or regulators where law requires.
10. Your rights
Everyone: you can ask us what data we hold about you, to correct it, or to delete it. Email privacy@onlinescheduling.com. For schedule data we will pass your request to your organization, which decides.
EU, EEA and UK: you also have the rights to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office.
California and other US states with privacy laws: you have the right to know, access, correct and delete personal data, and to opt out of sale, sharing and targeted advertising (we do none of these). We don't use sensitive personal data to infer characteristics about you. We will not treat you differently for using these rights. An authorised agent may make a request for you. We will verify requests by confirming control of the email address on the account.
We answer within 30 days (45 days where US state law allows, with notice of any extension).
Exceptions: we may keep data we need to comply with law, keep the service secure, or protect the integrity of the Ledger while the Customer's account is open (section 8).
11. Children
The service is not for anyone under 16, and we don't knowingly collect their data. If you think we have, contact us and we will delete it.
12. Changes
If we change this policy materially, we will post the new version here with a new effective date and tell Customers' managers at least 30 days before it applies.
13. Contact
- Privacy requests: privacy@onlinescheduling.com
- Help with the service: support@onlinescheduling.com