Privacy notice

This notice explains what personal data My Appointment On Time processes, why we use it, who we share it with and how you can exercise your rights.

Who processes your data

The operator of My Appointment On Time is the controller of business account data and of its own website. When you book an appointment with a business, that business is the controller of its schedule data and we process it on its behalf, as a processor, to provide the service (see the processing annex in the terms).

What data we process

• Account: name, email, password (stored only as an Argon2id hash, never readable), language, time zone, time format and, if you sign in with Google, that account's identifier. If you turn on two-step verification, its key is stored encrypted.
• Business: name, plan, boards, hours, services and team members with their role.
• Appointments: service, date and time, name, email, phone if you give it, notes you write and attendance.
• Notifications: the channels you turn on (email, Slack, Telegram) and your preferences.
• Connected calendars: the permissions you authorize in Google, Microsoft or Apple, stored encrypted, and the busy periods of those calendars (no titles or details).
• Connected AI apps: which app you connected, with which permissions and boards, and when it was last used.
• Technical use: IP address and access logs for security, for a limited time; addresses kept in the audit log are stored only as a hash. Site analytics use no cookies and don't identify people.

Why we use it

• To provide the scheduling and booking service the business or you requested (performance of a contract).
• To send you necessary emails: verification, codes, confirmations, reminders and account or security notices.
• To protect the service against abuse, detect fraud and comply with legal obligations (legitimate interest and legal obligation).
• To send you news only if you ask for it (consent); you can unsubscribe from any message.

We don't sell your data, we don't use it for advertising and we don't use it to train AI models.

AI apps you connect

You can connect a third-party AI app (for example, Claude, ChatGPT or Gemini) to your account through the MCP protocol. When you do, you choose which permissions and boards it gets. That app reads and, if you allow it, changes your schedule on your behalf, and the data it obtains is processed by its provider under its own terms and privacy notice. We never send your data to any AI provider on our own initiative. You can revoke access at any time in Dashboard → AI, and we email you whenever a new app connects.

Who we share it with

Only with the business you book with (each end customer sees only their own appointments) and with the providers we need to operate, acting as processors:

• Hosting and infrastructure for the service, and email delivery.
• Google (Sign in with Google, including when confirming a booking, and Google Calendar), Microsoft (Outlook) and Apple (iCloud), only if you connect those services.
• Slack and Telegram, only if you turn on notifications through those channels.

When card payments and WhatsApp notifications are turned on, we will add Stripe and Meta to this list before using them. Some providers may process data outside your country; in that case we require appropriate safeguards.

Cookies

We only use cookies needed to keep you signed in and to protect forms. There are no advertising or analytics cookies.

How long we keep it

While your account is active. If you delete it, we erase your data within 30 days, except what the law requires us to keep. Unconfirmed time holds expire after 10 minutes and technical logs are deleted periodically.

Security

Encryption in transit (HTTPS), Argon2id passwords, encrypted third-party credentials, role-based permissions on each board, optional two-step verification and backups managed by the hosting platform.

Your rights

You can access, correct and export your data or delete your account (and, if you're an owner, close your business) from Dashboard → Account, and object to or restrict certain processing. If you booked with a business, you can also contact it. For any request, write to us from the contact page; we reply within 30 days. If you're not satisfied, you can complain to the data protection authority in your country.

Minors

The service is not intended for children under 16 without their guardian's permission.

Changes

If we change this notice materially, we'll tell you by email or in the dashboard before it takes effect.