Privacy Policy

ScheduleDrop provides software to service businesses. The information in our system falls into two categories, and our responsibilities differ for each.

Account information (we are the controller). For information about the businesses that subscribe (“Account Owners”) and their team members — such as registration details, billing contacts, and how they use the platform — we act as the controller and this Privacy Policy describes how we handle it.

Customer and Provider information (we are a processor). For information an Account Owner uploads or generates about its own customers (“End Users”) and Providers — such as names, contact details, addresses, job notes, photos, call recordings and transcripts, location data, and payment details — we act as a processor (or service provider) on the Account Owner's behalf and process it only to provide the platform and on the Account Owner's instructions.

If you are an End User or Provider. If a business uses ScheduleDrop to serve you or to manage your work, and you want to access, correct, or delete your information, please contact that business directly. We will help the business respond to your request.

Consents and lawful basis. Account Owners are responsible for having the rights, consents, and lawful bases needed for us to process the personal information they provide about their End Users and Providers as described in this Policy and our Data Processing Addendum. Account Owners represent that they have those rights and consents.

Your own privacy notice. Account Owners are responsible for maintaining their own privacy notice to their End Users and Providers, and for responding to their privacy requests, with our assistance.

Information you provide. Account and registration data (name, business name, email, phone), billing and payment details, and information you choose to add, including about your End Users and Providers.

Content you upload. Job notes, customer and provider records, profile photos and before/after images, documents, and similar Content.

Communications. The content and metadata of SMS, email, and calls made through the platform, including, where you enable them, call recordings and transcripts.

AI interactions. Content processed by, and outputs generated through, our AI features.

Location data. Where enabled, device and GPS location from the provider app, used for scheduling, routing, time tracking, and job verification.

Payment information. Payment and transaction details processed through our payment processor; we do not store full card numbers.

Device and usage data. Such as IP address, device and browser type, operating system, app and device identifiers, crash and diagnostic logs, pages and features used, and photo metadata.

Cookies and similar technologies. As described in Section 6.

We use information to: provide, operate, secure, and improve the platform; create and manage accounts and authenticate users; process subscriptions and facilitate your Customers' payments; schedule jobs and assign Providers; send messages, reminders, and service communications; provide AI features; provide support and respond to requests; detect, prevent, and address fraud, abuse, and security and technical issues; comply with law; and, with any required consent, send you product news and marketing. We also use aggregated, de-identified data that does not identify you or any individual to analyze and improve the platform.

Our AI features may send relevant Content (such as call recordings, transcripts, or messages) to third-party AI providers that act as our service providers to generate summaries, suggestions, and other outputs. These providers are contractually limited to using the information to provide the feature. We do not use your Content to train third-party foundation models, and our AI providers may not use your information to train or improve their own models. AI outputs may be inaccurate and are not professional advice; see the Terms of Service.

What we use. We use cookies, pixels, and similar technologies for sign-in and session management, security, analytics, and measuring and (with consent where required) personalizing advertising.

Your choices. You can manage cookies through our cookie-preferences control and your browser settings. Where required, we obtain consent before placing non-essential cookies.

Global Privacy Control. We honor recognized opt-out preference signals, such as Global Privacy Control, where required by law.

Do Not Track. We do not currently respond to browser “Do Not Track” signals, which are not yet standardized.

We do not sell for money. We do not sell your personal information for money.

“Sharing” for advertising. We use analytics and advertising technologies from providers such as Meta and Google. Under California and similar U.S. state laws, this may count as “sharing” personal information for cross-context behavioral advertising, which is treated separately from “selling.”

Your opt-out. You can opt out of this sharing using the “Do Not Sell or Share My Personal Information” link and the cookie-preferences control. We honor Global Privacy Control signals where required.

We share personal information only as needed to run the platform and as described here:

• •Service providers (subprocessors) that host and operate the platform and provide specific features, including, for example: Stripe (payments), Twilio (SMS and calling), Mailgun (email), our AI providers (AI features), our cloud hosting and infrastructure providers, and analytics providers. A current, dated list of these subprocessors is available on request.
• •Account Owners and their authorized users, for information related to their account.
• •Professional advisors, and authorities or others where we believe in good faith it is necessary to comply with law, enforce our terms, or protect rights, property, or safety.
• •A successor in the event of a merger, acquisition, financing, or sale of assets, subject to this Policy.

International recipients. Some service providers operate in countries other than yours, including the United States; see Section 13 on international transfers.

Subscription fees and your Customers' payments are processed by Stripe. When you accept payments through the platform, you and your Customers provide payment information directly to Stripe, and Stripe processes it under its own privacy policy and terms. If we use identity-verification or fraud-prevention providers, or bank-account-linking providers, in connection with payments, those providers process the relevant information under their own policies. We do not store full payment card numbers.

If you enable location features in the provider app, we collect device and GPS location to provide scheduling, routing, time-tracking, and job-verification features. Location data is available to the relevant Account Owner and authorized administrators and to us as needed to provide the platform. Providers can disable location access in their device settings, though this may limit features. Account Owners are responsible for notifying Providers and obtaining any required consent before using location features.

We keep personal information for as long as needed to provide the platform and for legitimate business and legal purposes. For account Content, after an account is canceled or terminated and amounts owed are paid, we retain it for thirty (30) days to allow export, then delete it in the ordinary course, except where we are permitted or required to keep certain information longer (for example, for tax, accounting, fraud-prevention, dispute, or legal-compliance purposes, or as de-identified data). When acting as a processor, we retain and delete information according to our agreement with the Account Owner.

We use administrative, technical, and physical measures designed to protect personal information, which may include encryption of data in transit and at rest, hashing of passwords, access controls and authenticated sessions, and optional two-factor authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials secure.

We operate the platform from the United States and use service providers in the United States and other countries. If you are located outside the United States — including in Canada, Australia, the EEA, the UK, or elsewhere — your information will be transferred to and processed in the United States and other countries whose data-protection laws may differ from yours. Where required, we use appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses and the UK Addendum, and we rely on your consent or the necessity of the transfer to provide the platform.

Everyone. You may contact us at support@scheduledrop.com to ask about the personal information we hold as a controller, and to access, correct, update, or delete it, or to withdraw consent, subject to applicable law. We may need to verify your identity, and some information may be exempt (for example, where we must keep it by law). If your request concerns information we process on behalf of an Account Owner, we will direct it to that Account Owner.

United States. Depending on your state (for example, California, Virginia, Colorado, Connecticut, Texas, and others), you may have rights to know, access, correct, delete, port, and opt out of sale/sharing and certain profiling, and a right to non-discrimination for exercising them. California residents may also request information about disclosures. To exercise these rights, contact us as above or use the “Do Not Sell or Share” link. You may appeal a decision by replying to our response; we will respond within the time the law requires.

Canada. Under PIPEDA and provincial laws (including Quebec's Law 25), you may access and correct your personal information and withdraw consent, subject to legal limits, and may contact the relevant privacy commissioner. Our Privacy Officer can be reached at support@scheduledrop.com.

Australia. Under the Privacy Act and the Australian Privacy Principles, you may access and correct your personal information and make a complaint, which we will handle, and you may escalate to the Office of the Australian Information Commissioner.

EEA and UK. If the GDPR or UK GDPR applies, our legal bases for processing as a controller include performing our contract with you, our legitimate interests in operating and securing the platform, your consent (which you may withdraw), and compliance with law. You have rights to access, rectification, erasure, restriction, portability, objection, and to withdraw consent, and you may lodge a complaint with your supervisory authority.

The platform is for businesses and is not directed to children. We do not knowingly collect personal information from children under 13 (or the minimum age in your jurisdiction, such as 16 in parts of the EEA) as a controller. If you believe a child has provided us personal information, contact us at support@scheduledrop.com and we will take appropriate steps to delete it. Information about End Users that an Account Owner uploads is the Account Owner's responsibility.

With any required consent, we may send you newsletters, offers, and product updates. You can opt out at any time using the unsubscribe link in the email or by contacting us. You may still receive non-marketing service and account messages.

We may update this Policy. For material changes, we will notify you by email or in-app notice and update the “Last updated” date above. Your continued use after changes take effect is your acceptance; if you do not agree, stop using the platform.

Schedule Drop LLC, Delray Beach, Florida, USA. General privacy questions and requests: support@scheduledrop.com. For information we process on behalf of an Account Owner, we will forward your request to that Account Owner.