Privacy policy

Schedmo (“Schedmo”, “we”, “us” or “our”) provides online booking, scheduling and business-management software. This policy applies when you visit schedmo.com, create or use a Schedmo account, contact us, or interact with a booking page powered by Schedmo.

Schedmo is the service’s trading name. The responsible legal entity is identified on the relevant order form, checkout or invoice. You can request its legal name and service address at any time from privacy@schedmo.com.

It does not govern a business’s own privacy practices or third-party services you choose to connect. Those parties may provide separate privacy notices.

This policy is a transparency notice. It does not create a warranty, limit any right that cannot lawfully be limited, or expand Schedmo’s obligations beyond applicable law and our written agreements. If a customer agreement or data processing addendum applies to business-controlled data, that document governs to the extent of any conflict, subject always to mandatory law.

For account, website, sales and support information, Schedmo generally decides why and how information is handled and acts as the relevant controller or APP entity.

A business using Schedmo decides what client information it collects and how it uses that information. For that data, the business is generally the controller and Schedmo acts as its processor or service provider. Client privacy questions should usually be directed to the business first.

Each business is responsible for its own collection notices, consents and lawful basis; deciding what information is necessary; configuring access, retention and communications; responding to client requests; and complying with health, professional, employment, marketing and recordkeeping laws that apply to it. Businesses must only give Schedmo lawful instructions and must not upload information they are not authorised to collect or disclose.

Schedmo is booking and business-management software, not an emergency service, diagnostic system or substitute for any specialist clinical record a regulated provider is required to maintain. Businesses must assess whether Schedmo is suitable for their legal and professional obligations and should not use booking messages for urgent or emergency communications.

Depending on how you use Schedmo, we may handle:

• Account and identity details: name, email, phone number, login identifiers, roles and account settings.
• Business details: business profile, locations, team members, services, availability, branding and operational preferences.
• Booking and client records: contact details, appointments, service history, forms, notes, communications, packages and related files. These may include sensitive or health information when a business chooses to collect it.
• Billing and transaction details: plan, invoices, payment status and transaction references. Payment providers such as Stripe process card details; Schedmo does not ordinarily store complete payment-card numbers.
• Support and communications: messages, feedback, requests and records needed to resolve an issue.
• Device, security and usage data: IP address, browser and device type, timestamps, logs, approximate region and product interactions. Optional analytics are collected only according to your cookie choice.
• Campaign engagement data: campaign delivery, opens measured through a small image, link clicks, preference changes, and bookings or paid value attributed to a campaign. Open measurement can be incomplete or affected by email privacy features.

Do not place passwords, complete payment-card details, government identifiers or unrelated sensitive information in free-text fields unless the feature expressly requests it and you are legally authorised to provide it. We may remove, quarantine or restrict access to information where reasonably necessary to protect people, the service or our legal obligations.

We collect information directly from you, from the business that creates or manages a booking, automatically when you use the service, and from services you choose to connect. We may also receive information during an authorised data import or when someone invites you to a Schedmo account.

You may browse public pages without creating an account. Some details are necessary to provide bookings, secure accounts, process payments or meet legal obligations. If they are not supplied, the relevant feature may not be available.

We seek to collect only information reasonably necessary for a stated function or activity. Businesses should configure forms and free-text fields to avoid excessive or unrelated personal information, especially health or other sensitive information. Where consent is required for sensitive information, it must be informed, voluntary, current and specific to the collection and purpose.

We use information to:

• provide, personalise and support the Schedmo service;
• create bookings, send requested communications and maintain business records;
• deliver business-configured campaigns, enforce consent and suppression choices, measure campaign engagement, and report campaign-attributed bookings and value;
• authenticate users, prevent misuse and protect the platform;
• process subscriptions, payments and connected integrations;
• monitor reliability, troubleshoot and improve the product;
• communicate about the service and, where permitted, relevant Schedmo updates; and
• comply with law and enforce our agreements.

Where applicable law requires a legal basis, we rely on performance of a contract, legitimate interests, compliance with legal obligations, consent, or another basis available under that law. We do not use client health information for advertising.

We may create aggregated or de-identified information for security, service analysis, capacity planning, reporting and product improvement. We may retain and use information that is no longer personal information, provided we do not attempt to re-identify it except where permitted or required by law.

Some safeguards operate automatically. For example, account and payment risk signals may restrict a login or transaction; booking rules may determine available times; and consent, suppression, bounce or abuse signals may prevent a marketing message. These processes can use account, device, transaction, booking and communication-status information. They are intended to secure or deliver the requested service, not to diagnose a health condition. Contact us or the relevant business if you believe an automated outcome is wrong and want it reviewed by a person. We will keep this explanation current as required for automated decisions that could significantly affect a person.

We may disclose information:

• to the business, team members and clients involved in an authorised booking or workflow;
• to vendors that provide hosting, authentication, security, communications, support, payment processing and optional analytics;
• to services such as Stripe or Xero when an authorised user enables the integration;
• where required by law, to protect rights or safety, or to investigate misuse; and
• as part of a corporate transaction, subject to appropriate confidentiality and legal safeguards.

We require service providers to handle information only for the agreed purpose. Schedmo does not sell personal information.

We may preserve and disclose information in response to a valid subpoena, court order, regulatory request or other lawful process, or where we reasonably believe disclosure is necessary to prevent fraud, security threats, serious harm or unlawful activity. Where lawful and practicable, we may notify the affected customer before disclosing business-controlled data.

Schedmo is operated from Australia and uses cloud and technology providers with operations in Australia, the United States and other countries. Information may therefore be processed outside the country where it was collected.

Where required, we use contractual commitments, access controls and recognised transfer mechanisms and take reasonable steps to ensure overseas recipients protect the information. The exact location can vary with the feature, provider and customer configuration. Before enabling an optional integration, review that provider’s disclosed locations and terms. Contact us for current information relevant to a particular feature.

Cancelling a subscription does not delete workspace data. A workspace owner can export the workspace and separately request permanent erasure. Personal-account deletion is also a separate action. Workspace closure is placed in a restricted settlement state while invoices, processing payments, refunds, disputes, liabilities or payout balances remain. This prevents deletion from losing financial obligations; it does not authorise reuse of the data for unrelated purposes. When the settlement check is clear and erasure applies, we disable access and erase or de-identify production personal data without undue delay. Isolated encrypted database backups and recovery points expire on controlled schedules of up to 12 months and are unavailable for normal product use in the meantime. They are not used to reactivate a deleted personal account.

Our standard operational periods are: message content up to 7 days; notification delivery metadata up to 90 days; general security and product audit events up to 2 years; completed privacy-request evidence up to 3 years; and minimised billing, subscription, refund, ownership, export and erasure evidence up to 6 years. Australian tax records are generally retained for at least 5 years. Closed support records are normally retained for 2 years. A shorter or longer period may apply where law, an active dispute, a legal hold or the business controller’s documented instructions require it.

Businesses control retention of client appointments, forms and other workspace records while using Schedmo and must select periods appropriate to their industry and location, including any health-record requirements. When data is retained for legal evidence after erasure, access is restricted and unnecessary profile information is removed. Truly anonymised aggregate data may be retained because it no longer identifies a person.

We use administrative, technical and organisational safeguards designed to protect information, including access controls, encryption where appropriate, logging and tenant separation. No online service can guarantee absolute security.

If we become aware of a data incident, we will investigate, contain and remediate it as appropriate. We will notify affected customers, individuals and regulators where required by applicable law, including Australia’s Notifiable Data Breaches scheme where it applies. A business remains responsible for notifications relating to data it controls, with Schedmo providing reasonable information and assistance as required by our agreement and law.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, request a portable copy, withdraw consent, or complain to a regulator. You may also unsubscribe from marketing messages; service messages may still be sent when necessary.

Business marketing emails include unsubscribe and preference controls. We record the choice for the relevant business and channel. Necessary operational notices are separate from marketing and are limited to factual service, safety, legal or account information; delivery can still be restricted after a hard bounce or abuse complaint.

Unsubscribe requests are free, do not require account access or extra personal information beyond what is reasonably needed to action the request, and are applied within the period required by law. A business must not use sensitive or health information for direct marketing unless the person has given the consent required by applicable law.

Account holders can update many details in Schedmo. For other requests, email privacy@schedmo.com. We may verify your identity and may need to involve the relevant business when it controls the information. We may refuse or limit a request where an exception applies, another person’s rights would be affected, we cannot verify authority, or the law permits us to do so, and will give reasons where required.

An authorised representative may make a request where local law allows it, subject to evidence of authority. You may also have a right to appeal our response or contact a regulator. Privacy rights differ by location and are not absolute.

Schedmo business accounts are not intended for independent use by children. A business may use Schedmo to manage an appointment involving a minor where lawful and appropriate. The business is responsible for obtaining any consent required from a parent or guardian.

We may update this policy when our practices, technology or legal obligations change. We will publish the revised policy here, update the effective date and provide additional notice where a change is material and required by law.

Send privacy questions, requests or complaints to privacy@schedmo.com. Describe your concern and include enough information for us to identify the relevant account or interaction. We will acknowledge and investigate the complaint, explain our decision and available escalation options, and aim to respond within 30 days unless the issue is unusually complex. We will tell you if more time is needed. We may request further details, coordinate with the relevant business, and keep a record of the complaint and our response.

If you are not satisfied, you may contact the privacy or data protection authority where you live. In Australia, this is the Office of the Australian Information Commissioner.