Privacy Policy | myschedule.uk

1. Who we are

myschedule.uk ("we", "our", "us") is an online appointment scheduling platform designed for UK small businesses. We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

We collect the following personal data:

Business owners: Name, email address, business name, contact details, and working hours preferences.
Customers booking appointments: Name, email address, phone number (optional), and any notes provided during booking.
Website analytics: the pages you visit, the page that referred you, your browser and device type, your browser language and your approximate country (worked out from your device's time zone), linked by a random session identifier. We do not use this to identify you.
Booking protection: when a booking is made, a one-way cryptographic hash of the connecting IP address, used only to stop automated mass bookings. The IP address itself is not stored.

3. How we use your data

To provide and maintain the scheduling service
To process and manage appointment bookings
To send booking confirmations
To communicate important service updates
To understand how visitors use the website, so we can improve it
To protect booking pages from abuse, such as automated mass bookings

4. Legal basis for processing

We process your personal data on the following legal bases: performance of a contract (providing the booking service), legitimate interests (understanding how the website is used, and keeping booking pages secure and free from abuse), and consent (where applicable, such as marketing communications).

5. Data sharing

We do not sell your personal data. Customer booking information is shared only with the relevant business owner to fulfil the appointment. We use the following service providers, who process data on our behalf:

Lovable — website hosting, delivered through Cloudflare.
Supabase — our database and account sign-in.
Lovable Analytics — website analytics, with the analytics data processed by Tinybird.
Resend — delivery of booking emails, once email sending is enabled.

Some of these providers may process data outside the UK. Where they do, they are required to protect it with appropriate safeguards.

6. Data retention

We retain your data for as long as your account is active or as needed to provide you services. Appointment data is retained for up to 24 months after the appointment date. The hashed IP addresses used for booking protection are deleted after 24 hours. The analytics session cookie expires after 30 minutes; analytics records are kept by our analytics provider. You may request deletion of your data at any time.

7. Your rights

Under UK GDPR, you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data ("right to be forgotten")
Restrict processing of your data
Data portability
Object to processing

8. Cookies

We use a small number of cookies and similar browser storage:

Security (essential): __cf_bm, set by Cloudflare for our hosting to tell people apart from automated bots. It expires after 30 minutes.
Sign-in (essential): if you log in as a business owner, your session is kept in your browser's local storage so you stay signed in.
Analytics: session-id, set by Lovable Analytics to count visits and see which pages are used. It holds a random identifier, expires after 30 minutes, and is not used for advertising or to follow you across other websites.

We do not use advertising cookies. You can block or delete cookies in your browser settings; the booking pages keep working without the analytics cookie.

9. Contact us

If you have any questions about this privacy policy or wish to exercise your rights, please contact us at hello@myschedule.uk.