Privacy Policy

• To provide, maintain, and improve the Service, including generating schedules, processing constraints, and managing assignments.
• To create and manage your Account, authenticate your identity, and process your requests.
• To communicate with you about the Service, including sending transactional emails (password resets, email verifications, invitations, schedule notifications).
• To detect, prevent, and respond to fraud, abuse, security incidents, and technical issues.
• To comply with legal obligations, enforce our Terms of Service, and protect our rights and the rights of others.
• To power AI-assisted features (schedule generation, constraint solving, natural language interface) using third-party AI services. Your scheduling data may be sent to AI service providers solely for processing your requests.
• To understand usage patterns and improve the Service. We use aggregated and anonymized data for analytics purposes.
• To provide customer support and respond to your inquiries.

We do not sell your personal information. We share information only in the following circumstances:

We retain your personal information for as long as your Account is active or as needed to provide the Service.

Upon Account deletion, we delete or anonymize your personal data within 30 days, except:

• Data required to be retained by law (e.g., billing records, tax information) — retained for the legally required period.
• Data needed for ongoing disputes or legal proceedings — retained until resolution.
• Anonymized audit logs — retained for up to 12 months for security analysis.
• Encrypted backups — purged within 90 days of Account deletion.

If you are a member of an Organization, your scheduling data (assignments, preferences) may persist within that Organization's data after you leave, as it is part of the Organization's operational records.

Depending on your location, you may have the following rights regarding your personal information:

• Access — Request a copy of the personal information we hold about you.
• Correction — Request that we correct inaccurate or incomplete information.
• Deletion — Request that we delete your personal information (subject to legal retention requirements).
• Data Portability — Request your data in a structured, commonly used, machine-readable format.
• Objection — Object to the processing of your personal information in certain circumstances.
• Restriction — Request that we restrict the processing of your personal information.
• Withdraw Consent — Where processing is based on consent, you may withdraw consent at any time.

To exercise any of these rights, please contact us at the email address provided below. We will respond to your request within 30 days.

We will not discriminate against you for exercising your privacy rights.

We implement appropriate technical and organizational security measures to protect your information, including:

• Encryption of data in transit (TLS/HTTPS) and at rest.
• Password hashing using industry-standard algorithms (bcrypt).
• Role-based access controls and principle of least privilege.
• Secure session management with automatic expiration (24-hour maximum session duration).
• Rate limiting on authentication endpoints to prevent brute-force attacks.
• Security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options).
• Audit logging of all data modifications.
• Multi-tenant data isolation — Organization data is strictly separated.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. When we transfer data internationally, we implement appropriate safeguards to protect your information, including standard contractual clauses where applicable.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child, please contact us.

For GDPR-related inquiries, please contact us at the email address provided below.

If you are in the European Economic Area, you have the right to lodge a complaint with your local supervisory authority.

We do not sell personal information as defined by the California Consumer Privacy Act (CCPA).

California residents have the right to: know what personal information we collect and how it is used; request deletion of personal information; opt out of the sale of personal information (not applicable as we do not sell data); and not be discriminated against for exercising privacy rights.

Under California's "Shine the Light" law, California residents may request information about the disclosure of personal information to third parties for direct marketing purposes. We do not disclose personal information for direct marketing.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice (such as an email notification). Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

Email: legal@schedulab.com

We will respond to all privacy-related inquiries within 30 days.