Privacy Policy

Schedula is workforce scheduling software. This policy explains how Schedula (“we”, “us”) handles personal information when you visit our website, sign up for an account, or use the app.

There are two different relationships to keep straight, because they decide who you should ask about your own information:

• Your employer’s workspace. When your employer creates a workspace and adds you to it, they decide what staff information goes in, who can see it, and how long it stays. We hold and process that information on their instructions, as their service provider. Questions about your own schedule, pay rate, HR profile or attendance records go to your employer first.
• Your relationship with us. For your login credentials, your billing details if you are the account owner, and the diagnostics we collect to keep the service running, we decide the purposes ourselves and answer to you directly.

As required under Quebec law, we have designated a person responsible for the protection of personal information. You can reach them, and exercise any of the rights described in this policy, at support@schedula.app.

Put “Privacy request” in the subject line and tell us which workspace you belong to. We answer within 30 days.

We collect only what the features you or your employer actually use require. Nothing in the list below is gathered speculatively.

Account and sign-in

• Your name, email address, and whether that address has been verified.
• A one-way hash of your password. We never store, and cannot recover, the password itself.
• Session records, which include the IP address and browser user-agent of the device you signed in from, so you can review and revoke your own sessions and so we can detect credential-stuffing attempts.

Staff profile inside a workspace

• Work details your employer enters: first and last name, work email, phone number, job title, positions held, employee number, hire date, seniority, target hours and hourly pay rate.
• Optional HR profile fields, only if your employer fills them in: home address, date of birth, and an emergency contact’s name, phone number and relationship to you.
• HR documents your employer uploads against your profile — contracts, certifications, policies — together with a record of whether you have signed off on them.

Scheduling and attendance

• Shifts, availability, recurring availability, time-off and overtime requests, leave balances and the ledger of changes to them.
• Clock-in and clock-out timestamps, breaks, notes, and any attendance exception the system flags — late, early leave, missed punch, auto-closed shift.
• Pay-period and payroll figures derived from the above, including premiums and time banks.

Communication and engagement

• Direct and group messages, attachments, read receipts and reactions; announcements and their comments; recognition (kudos); survey responses.
• In-app notifications and, if you turn them on, the web-push subscription endpoint for your device.
• Support tickets you submit from inside the app.

Billing

• If you are the account owner: your subscription plan, billing cadence, status, renewal dates and any seat-overage charges, plus the customer and subscription identifiers our payment processor assigns you.
• We never see or store your card number. Card details are entereddirectly with Stripe and never reach our servers.

Diagnostics and audit

• Audit log entries recording security-relevant actions in a workspace, including the IP address and user-agent that performed them.
• Crash and error reports. Our error tracker is configured not to send personal information by default, and when it captures a session replay around an error, all text is masked and all media is blocked before it leaves your browser.

Two attendance features can collect information that locates or identifies you. Quebec law requires that functions allowing a person to be identified, located or profiled be deactivated by default, and in Schedula they are:

• Location at punch. Only when your employer explicitly enables location enforcement does the app request your device location as you clock in or out. It then records the latitude, longitude and accuracy of that single moment, plus an approximate street address derived from it, so the punch can be checked against the site’s geofence. Your browser still asks your permission first, and you can refuse. We do not track your location between punches, and never in the background.
• Photo verification. Only when your employer explicitly enables it does the app capture a photo at clock-in or clock-out, stored against that time entry so a manager can confirm who punched.

Both settings are visible to you in the app. If either is on, your employer is responsible for having told you why before you first used it. If you were not told, ask them — and tell us at support@schedula.app if you get no answer.

Kiosk PINs are stored only as a one-way hash. No manager, and no one at Schedula, can read a PIN back; a manager can only reset it.

• To run the service you or your employer signed up for — building schedules, recording attendance, calculating payroll figures, delivering messages.
• To keep accounts secure — authenticating you, rate-limiting abuse, maintaining an audit trail, and letting you review your own active sessions.
• To bill account owners and collect the amounts owed under their plan.
• To fix the product — diagnosing errors and understanding which pages are slow or broken.
• To reach you about the service — invitations, password resets, shift and time-off notifications, billing warnings, and material changes to these documents.

We do not sell personal information. We do not use the contents of your workspace — messages, schedules, staff records — to train machine-learning models.

• Strictly necessary storage. A session cookie or token keeps you signed in. The app also uses your browser’s local storage and a service worker to hold your theme, your last-known state, and any clock-ins made while offline, so the app works without a connection. None of that leaves your device except when it syncs your own data.
• Page analytics. We use a privacy-oriented analytics product that records page views and performance without cookies and without building a cross-site profile of you.
• Advertising measurement — public pages only. Our public marketing pages load the Meta pixel so we can measure whether our ads work. It is not loaded inside the signed-in application. You can block it with your browser’s tracking protection or an ad blocker with no effect on the product.

Inside your workspace, what other people can see is governed by their role. Owners and managers see the staff records, attendance and payroll figures they administer; colleagues see the schedule, announcements and any conversation they are part of. HR documents and HR profile fields are restricted more tightly than the rest.

Outside your workspace, we share personal information only with the service providers that make Schedula work, each bound by contract to use it solely on our instructions:

We will also disclose information where the law requires it, and to a buyer if the business is sold — in which case this policy travels with the data until you are told otherwise.

Schedula is hosted in the United States, and most of the providers listed above store and process information there. Your personal information is therefore communicated outside Quebec, and may be accessible to foreign authorities under the laws that apply where it is held.

Before relying on a provider we assess whether the information will receive adequate protection, weighing its sensitivity, the purposes it is used for, the safeguards in place and the legal regime it will fall under. Each provider is under a written agreement restricting their use of it.

• Active workspaces. We keep workspace data for as long as the workspace exists, because scheduling, attendance and payroll records only have value as history.
• Closed accounts. When a workspace is closed or an account deleted, we delete or irreversibly anonymize its personal information within 90 days, except where we must keep it longer to meet a legal, tax or accounting obligation.
• Sessions and rate-limit records. Purged automatically as they expire.
• Diagnostics. Error reports and analytics are retained by our providers on their own rolling schedules, typically 90 days or less.

Your employer may ask us to delete specific staff records sooner. Bear in mind that employment-standards law may require them to keep hours-worked and pay records for several years.

• All traffic between your device and our servers is encrypted in transit.
• Passwords and kiosk PINs are stored only as one-way hashes, never in a recoverable form.
• Every query and mutation is scoped to a single workspace and checked against your role before it returns anything.
• Sign-in, password reset and kiosk PIN entry are rate limited, and repeated failures lock the attempt out.
• Our infrastructure providers encrypt stored data at rest.

No system is perfectly secure. If a confidentiality incident presents a risk of serious injury, we will promptly notify the people affected and Commission d'accès à l'information du Québec, and we maintain a register of such incidents as the law requires.

Under Quebec law you may:

• Access the personal information we hold about you, and be told where we got it and who we have given it to.
• Correct anything inaccurate, incomplete or ambiguous.
• Withdraw consent to a collection or use that rests on consent — including turning off push notifications, or declining your browser’s location prompt.
• Receive a portable copy of the computerized personal information you gave us, in a structured, commonly used technical format, or have it sent to another organization.
• Ask us to stop disseminating information, or to de-index it, where the law allows.
• Complain to Commission d'accès à l'information du Québec if our answer does not satisfy you — see cai.gouv.qc.ca.

Send requests to support@schedula.app. We may need to verify your identity before answering. Where the information belongs to your employer’s workspace, we will normally refer you to them and help them respond.

We do not make decisions about you based exclusively on automated processing. The app suggests schedules, flags attendance exceptions, and can auto-close a forgotten shift once it passes a maximum length — but each of those is a proposal or a flag that a manager reviews, and every auto-closed entry is marked as such so it can be corrected.

The Help Center assistant answers questions about how Schedula works. It is given our public documentation and your question, not your workspace data.

Schedula is a workplace tool used by employers. We do not knowingly collect personal information from anyone under 14 without the consent of a person having parental authority. If you believe we have, contact support@schedula.app and we will delete it.

We update this policy when the product changes. The effective date at the top always tells you which version you are reading. If a change materially affects how we handle your personal information, we will email account owners and show a notice in the app before it takes effect.

Questions, requests and complaints all go to support@schedula.app. We answer within 30 days.