Privacy Policy

What we collect and why

Our guiding principle is to collect only what we need.

Identity and access

When you sign up for ScheduleLord, we ask for your email address so we can send you registration and passkey links and other essential account information. We will never sell your personal information to third parties.

Passkeys

ScheduleLord uses passkeys (WebAuthn credentials) for passwordless authentication. We store the public key and credential metadata associated with your passkeys. Your private key never leaves your device.

Billing information

If you sign up for a paid plan, payment information is submitted directly to Stripe and does not hit ScheduleLord servers. We store a record of the payment transaction for account history, invoicing, and billing support. We store your billing address to process charges and detect fraudulent transactions.

Product interactions

We store the content you create within ScheduleLord — organizations, locations, employees, roles, and shifts — on our servers so you can use the application as intended. We keep this content as long as your account is active. If you delete your account, we will delete the content within 60 days.

Website interactions and analytics

We use PostHog to collect analytics about how the application is used — such as which features are used most and where errors occur. This helps us improve the product. PostHog data is associated with your account while your account is active.

Square POS integration (optional)

If you choose to connect a Square account, we import data from Square on your behalf — including locations, job titles, and team member names and email addresses — and store it in your ScheduleLord organization. We also receive webhook notifications from Square to keep your data in sync. We only access Square data that your account has permission to read, and we store it solely to provide the scheduling features you requested. Disconnecting your Square integration does not automatically delete the imported data; you can remove it manually.

AI Assistant

ScheduleLord includes a built-in AI Assistant powered by Anthropic. When you use the AI Assistant, your messages and any schedule data retrieved to answer your request — such as shifts, employees, and locations — are sent to Anthropic's API for processing. Conversation history is not stored by ScheduleLord; it exists only in your browser for the duration of your session. Anthropic processes this data under their own privacy policy. The AI Assistant is only available to signed-in users.

AI agent integrations (MCP)

ScheduleLord supports the Model Context Protocol (MCP), which allows you to authorize AI agents and tools to access your schedule data on your behalf. When you grant an AI agent access, we issue an access token scoped to your account. The AI agent may then read and write schedule data — such as shifts, employees, and locations — as permitted by the scopes you approved. You can view and revoke these tokens at any time from your account settings. We do not share your data with AI agents without your explicit authorization.

Voluntary correspondence

When you email us with a question or to ask for help, we keep that correspondence, including your email address, so we have a history of past correspondence to reference if you reach out in the future.

When we access or disclose your information

To provide the Services. We use third-party subprocessors to run our application: Cloudflare (hosting and infrastructure), Stripe (payment processing), Resend (transactional email delivery), PostHog (analytics), and Anthropic (AI Assistant). If you connect a Square account, Square is an optional third-party integration — we only read data from your Square account and never write back to it. We do not share your data with any other third parties.

To AI agents you explicitly authorize. If you grant an AI agent or tool access to your account via MCP, that agent may read or modify your schedule data within the scopes you approved. You control which agents have access and can revoke that access at any time. We are not responsible for how third-party AI agents use the data they receive.

To help you troubleshoot, with your permission. If we need to access your content to help with a support case, we will ask for your consent before proceeding.

To investigate or prevent abuse. Accessing a customer's account when investigating potential abuse is a measure of last resort.

When required under applicable law. Our policy is to not respond to government requests for user data unless we are compelled by legal process. We will notify affected users before disclosing data unless we are legally prohibited from doing so.

Your rights with respect to your information

We strive to apply the same data rights to all customers, regardless of their location. These rights include:

• Right to Know. You have the right to know what personal information is collected, used, shared, or sold.
• Right of Access. You have the right to access the personal information we hold about you.
• Right to Correction. You have the right to request correction of your personal information. Most information can be updated directly from your account settings.
• Right to Erasure. You have the right to request that your personal information be erased from our systems. A data deletion request may result in closing your account.
• Right to Complain. You have the right to make a complaint regarding our handling of your personal information with the appropriate supervisory authority.
• Right to Restrict Processing. You have the right to request restriction of how and why your personal information is used or processed.
• Right to Object. You have the right, in certain situations, to object to how or why your personal information is processed.
• Right to Portability. You have the right to receive the personal information we hold about you in a portable format.
• Right to Non-Discrimination. We do not and will not treat you differently because you have exercised your data privacy rights.

To exercise any of these rights, please contact us at support@schedulelord.com.

How we secure your data

All data is encrypted via SSL/TLS when transmitted from our servers to your browser. Our infrastructure runs on Cloudflare Workers and Durable Objects, which provides encrypted storage at rest. Authentication is handled exclusively via passkeys (WebAuthn), which means there are no passwords to compromise.

Data retention

We keep your information for as long as your account is active or as needed to provide the Services. If you cancel your account, your content will become inaccessible immediately and will be permanently deleted within 60 days. We may retain certain information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

Location of site and data

Our Services are operated in the United States. If you are located outside of the United States, please be aware that any information you provide to us will be transferred to and stored in the United States. By using our Services and/or providing us with your personal information, you consent to this transfer.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect new practices. Whenever we make a significant change, we will refresh the date at the top of this page and notify users. Have questions, comments, or concerns about this privacy policy or your data? Please get in touch at support@schedulelord.com.