Age declarations for designated services

For services designated by the business for 18+ online booking, Skedful records the adult declaration with the appointment, including the server-recorded time, minimum age and declaration policy version. The record supports the business in administering its booking policy and reviewing the declaration. This flow does not collect a date of birth or an identity-document image and does not verify actual age. The record is handled with the associated appointment, subject to applicable retention requirements and rights requests.

Data rights requests — effective September 20, 2026

Booking clients can sign in from the business's booking page and use Your data and privacy to download their data, correct their verified email or phone number, or delete their client account. Account deletion removes the cross-business login and de-identifies the linked client record at every business while preserving business records that must remain intact.

For access, correction, objection or deletion involving information held by a specific business, contact that business or email privacy@skedful.com. We acknowledge direct requests within 7 business days, verify identity using the registered email or phone, and aim to complete verified requests within 30 days. Signed consent forms, issued tax documents and other records required by law may be retained for the applicable period and isolated from unrelated processing.

The full request and deletion process is published at skedful.com/data-deletion.

Google Calendar integration and Limited Use

When a business owner connects Google Calendar, Skedful receives the connected account's email address and reads events from the owner's primary calendar. For two-way sync, we use event times to block unavailable booking slots and store event identifiers, time ranges, and sync state. We also create, update, and delete Skedful appointment events on that calendar. Google Calendar event content is not automatically sent to Emma AI. Disconnecting requests revocation of the Google token and removes the local connection and busy blocks.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. We do not use this data to create, train, or improve foundational or generalized AI models. These restrictions apply to Workspace API data even where this notice describes broader uses or sharing of other data.

Client records supplied to businesses and Emma AI

Skedful does not use a studio's client contact details to send Skedful promotions or otherwise contact those clients for its own purposes, except when required by law. We can send authorized messages on the studio's behalf, including booking confirmations, reminders and verification codes, to provide the studio's services.

A business using Skedful decides which client information to request and how to use it. Skedful stores and handles that information to provide the business with forms, bookings, client records, and related features. Handling includes storage, display, export, and deletion; it does not require Skedful staff to read the content. Some records may contain sensitive information. The business has responsibilities for the information it asks clients to provide, and Skedful has separate responsibilities for protecting and handling information on its platform.

Emma AI is optional and requires the business owner's separate consent. When the owner chats with Emma, the message they type is sent to an external AI provider, OpenAI. Emma's tools minimize the client information returned to that provider: they do not automatically send client phone numbers, email addresses, or free-text notes, but may return a first name, limited client facts, and flags such as whether an allergy is recorded. A business owner can still type sensitive details into a chat message, so Skedful cannot promise that all AI inputs are free of sensitive information. Typed chat messages are not automatically masked or redacted before being sent to the AI provider. The business is responsible for the information it chooses to enter and for obtaining any required client permission. Owners should avoid entering personal or sensitive client details into Emma chats.

Emma conversation history stored in Skedful is retained until the business deletes it or the studio account is deleted under the inactivity policy below, subject to applicable legal obligations.

Skedful does not use Emma conversations or client records to train AI models or enroll that information in optional provider model-improvement programs. Emma uses the external AI service to generate responses and provide the assistant features described here.

Inactive studio accounts

A studio account without an active paid subscription may be permanently deleted after six calendar months of inactivity. Canceling a subscription does not itself delete the account or its data. Before permanent deletion, we send the account owner a warning email at least 30 days in advance that states the scheduled permanent-deletion date. Returning to use the account before that date resets the inactivity period. Accounts with an active paid subscription are excluded from this automatic deletion policy.

Issued tax documents and signed consent submissions, including the evidence needed to preserve their integrity, are retained separately after account deletion without automatic expiration. Access to those retained records is restricted to authorized purposes. Other information that must be retained to meet applicable legal obligations may also be retained separately and restricted to those purposes. The full deletion process is described on Delete your data.

• Visit our website at https://skedful.com or any website of ours that links to this Privacy Notice

Cookies and similar technologies

Skedful uses a small number of first-party cookies:

Optional categories set no cookies and store nothing about you until you opt in, and you can change your mind at any time via the "Cookie preferences" link in the footer of skedful.com, or the cookie button on booking pages and in the app's Settings.

Google Consent Mode: our Google Analytics tag loads on every page but starts in a fully denied state. Until you opt in, and if you decline or ignore the banner, it sets no cookies and collects no identifiers about you, but it may still send Google anonymous, cookieless signals (for example, that a page was viewed) so that aggregate traffic and advertising performance can be measured. This is a deliberate change from our previous approach, in which the tag did not load at all before consent. Opting in additionally enables the cookie-based Google Analytics described in the table above; you can withdraw your consent at any time using the same controls.

With marketing consent, the Meta Pixel measures visits to our public site and a subscription event after our server verifies activation of a paid checkout. We do not send form contents, client records, or payment-card details to Meta. Without marketing consent, the Meta Pixel does not load. You can withdraw consent using Cookie preferences.

Error reporting: our apps send crash and error reports to our own self-hosted error tracker (Bugsink). These reports are needed to keep the service reliable and secure, are not used for advertising or cross-site tracking, and set no cookies.