Privacy Policy

1. Who handles your information

Schedulink is the operator of this website and app. Our privacy contact is the Schedulink Privacy Officer at support@schedulink.ca.

Your employer or workplace organization determines which employee and scheduling information it enters and who should have access. It is responsible for its employment decisions and required workplace notices. We handle workplace records to provide the Service and handle account, support, security, and any billing information for our service operations. An employee record or invitation may exist before the employee creates an account.

2. Information handled

• Account and access: name, email address, account identifiers, verification status, workplace memberships, roles, invitations, agreement and privacy-acknowledgment records (including the policy versions, checkbox statement, time, and app revision), and related timestamps. Firebase Authentication handles sign-in credentials.
• Workplace records: workplace and employee names, positions, shifts, assignments, recurring patterns, hours, absences, time off, workplace events, scheduling rules, and information entered into available fields.
• Personal settings: optional wage and deduction settings, pay-period selections, personally recorded work, and calendar preferences. Settings stored as private are separated from shared workplace schedule data.
• Technical information: IP addresses, browser/device information, identifiers, security attestations, request and error logs, and activity needed for authentication, hosting, abuse prevention, and service operation. Advertising providers may collect additional browser information as described below.
• Support and billing: messages, contact details, and attachments you send us; and, if a paid service is used, subscription status, billing identifiers, transaction records, and relevant contact information. Card details entered in a Stripe payment interface are handled by Stripe rather than stored as full card numbers in the scheduling database.

3. Why information is used

We use information to create and verify accounts; provide, save, sync, and display schedules; manage workplace access; send invitations and service communications; record your agreement to the Terms and acknowledgment of this policy; respond to requests; operate any agreed billing; prevent fraud and misuse; investigate problems; and meet legal obligations.

Where applicable law requires a legal basis, the relevant basis depends on the activity: providing a requested service or performing an agreement, legitimate interests in operating and securing the Service subject to applicable safeguards, consent where required, or legal obligations. Workplace organizations are responsible for identifying the lawful basis for their employment-related records.

4. Visibility and service providers

Shared workplace information is available to authorized workplace members according to their access and app features; it is not limited to the employee whose shift is shown. Managers and Primary Admins manage shared records and access. Private account settings are stored separately. Necessary operator access may occur for support, maintenance, security, or legal reasons. Public schedule examples use fictional data; real workplace schedules require authorized access.

Providers process information needed for their roles:

• Google/Firebase and reCAPTCHA Enterprise: authentication, database storage, hosting, backend processing, and security or abuse detection.
• Resend: delivery of workplace invitation emails and related delivery information.
• ImprovMX and Gmail/Google: forwarding, receiving, storing, and replying to support or privacy correspondence.
• Stripe: payment processing and subscription management when those services are used.
• Google advertising services and participating ad partners: advertising-related information when ads are enabled and loaded, as described below.

We may also disclose information when required by law, to address fraud or security threats, to protect lawful rights, with your direction, or as part of a business transfer subject to applicable law and notice. We do not sell workplace schedules or private wage settings.

5. Browser storage, advertising, and choices

The app uses browser storage and authentication persistence to retain sessions, selected workplaces, preferences, and local schedule copies. Signing out does not necessarily clear cached records. You can clear site data in your browser; doing so can remove unsynced information and sign you out, but does not by itself delete cloud records.

When Google ads load, third-party vendors, including Google, may use cookies and similar technologies to serve and measure ads based on visits to this and other websites. Google’s advertising cookies enable Google and its partners to show ads based on those visits. Ad services may receive the page URL, IP address, device/browser details, and advertising identifiers, including information used to infer approximate location. Their use depends on their policies, your choices, and applicable consent requirements.

You can manage or opt out of Google personalized advertising through Google Ads Settings. See how Google uses information from partner sites and Google’s ad technology provider information. Some participating vendors offer choices through the Digital Advertising Alliance’s opt-out tool. Browser settings can also limit cookies; restricting storage may affect functionality. Turning off personalized ads does not necessarily stop all ads or their security and measurement processing.

6. Retention, security, and location

Account and workplace records remain stored until removed through available controls or a verified request is fulfilled, subject to legitimate service needs and legal retention requirements. We limit retention to what is reasonably needed for the purpose, including support, security, disputes, and required business records. Removing a membership or signing out does not automatically erase historical workplace records. Provider logs, backups, or legally retained records can remain for additional periods under applicable retention rules.

We use access controls, authentication, and service-provider security measures. No system can guarantee complete security. Protect your account and devices, and review site data on shared devices. Providers may process information outside your province or country, including in the United States, where local laws may permit access by authorities. We do not promise that all data stays in Canada.

7. Access, correction, deletion, and complaints

Contact support@schedulink.ca to request access, correction, a copy or export, deletion or account closure, or withdrawal of consent. Depending on your location and applicable law, you may also have rights to restrict or object to processing, portability, or advertising-related opt-outs. We will verify identity as needed and respond within applicable legal time limits. Requests may be limited where law allows or requires it, and we will explain the response.

For employer-controlled records, contact your manager or Primary Admin as well; we may need to coordinate with the workplace. Closing your account may not erase records the workplace must lawfully retain. Withdrawal of consent may affect access to features that need the information. You may raise a complaint with us and with the appropriate privacy or data-protection regulator.

8. Children and updates

The Service is not directed to children under 13. Contact us if you believe a child’s information was provided improperly so we can investigate and take appropriate action.

We may update this policy as the Service changes. The updated date will appear here; material changes will receive additional notice or consent where required. Privacy questions can be sent to the Schedulink Privacy Officer at the address above.