← Back to app

This Privacy Policy informs you of our practices on Personal Data management. You should read this Privacy Policy to understand the purposes for which we collect, use, and disclose your Personal Data. By accessing or using the Service, you agree to the collection, use, and disclosure of your Personal Data as described in this Policy. We may update this Privacy Policy from time to time — the current version will always be available at this URL with a revised date at the top.

1. Organisation and Data Protection Officer

ScheduleScan is operated by Keith Lee ("we", "us", "our"), based in Singapore. In accordance with the Personal Data Protection Act 2012 (PDPA) of Singapore, we have designated a Data Protection Officer (DPO) responsible for ensuring compliance with our data protection obligations.

For all data protection queries, access requests, correction requests, or complaints, please contact the DPO directly. We will respond within 30 calendar days as required under the PDPA.

2. Scope and Applicability

This Privacy Policy applies to all users of ScheduleScan, including individuals accessing the Service via web browser. It governs the collection, use, disclosure, and storage of personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA) and its 2020 amendments.

The PDPA applies to all organisations that collect, use, or disclose personal data of individuals in Singapore, regardless of the organisation's size or stage of operation. ScheduleScan complies with all applicable PDPA obligations.

3. Personal Data We Collect

We collect only what is strictly necessary to provide the Service. The personal data we collect includes:

• Google account information — When you sign in with Google, we receive your name, email address, and profile picture via Google's OAuth 2.0 protocol. This data is used solely to authenticate your identity and connect to your Google Calendar during your active session. We do not store this data on our servers beyond the duration of your browser session.
• Google Calendar access — With your explicit consent, we are authorised to create calendar events in your Google Calendar on your behalf. We request the minimum necessary scope: we can only create events. We cannot read, modify, or delete your existing calendar events or any other calendar data.
• Uploaded file contents — When you upload a file (PDF, Excel, Word, CSV, or image), its text content is transmitted to Anthropic's API for AI processing to extract calendar event information. This content is processed in real time and is not stored on our servers at any point. Anthropic retains API inputs and outputs for up to 7 days for trust and safety monitoring, after which they are permanently deleted. Anthropic does not use API data to train its AI models.
• Technical and usage data — We collect IP addresses and browser type for security purposes, specifically to enforce rate limiting and protect against abuse. This data is held in server memory only, is not linked to your identity, and is reset hourly.

4. Purposes for Which We Use Personal Data

Under the PDPA's Purpose Limitation Obligation, personal data may only be collected, used, or disclosed for purposes that are reasonable and that the individual has been informed of. We use your personal data exclusively for the following purposes:

• To authenticate you via Google Sign-In and maintain your session
• To process your uploaded files and extract calendar event information using AI
• To create calendar events in your Google Calendar upon your explicit instruction
• To enforce rate limits and protect the Service against automated abuse

We do not use your personal data for any other purpose, including marketing, profiling, advertising, or sale to third parties.

5. Consent

Through your use of the Service — including signing in with Google, uploading files, and pushing events to your calendar — you agree and consent to us:

• Collecting, using, disclosing, and processing your Personal Data for the purposes described in this Policy
• Transmitting the text content of your uploaded files to Anthropic's API for the purpose of extracting calendar event information
• Creating calendar events in your Google Calendar on your behalf, following your explicit instruction to do so
• Disclosing your Personal Data to our third-party service providers — Anthropic, Google, and Vercel — solely to operate the Service as described in this Policy

Consent is obtained at the point of use. You do not need to provide personal data beyond what is necessary to use the Service. Where you choose to provide additional personal data voluntarily, such data will be handled in accordance with this Policy.

6. Third Parties We Share Data With

We share data with the following third parties solely to operate the Service. We do not sell, rent, or share personal data with any other parties.

Anthropic (AI Processing)
The text content of your uploaded files is transmitted to Anthropic's API to extract calendar event information. Key facts verified from Anthropic's official documentation:

• API inputs and outputs are retained for up to 7 days for trust and safety monitoring
• API data is never used to train Anthropic's AI models
• After 7 days, API data is permanently deleted
• Your name, email address, and Google account information are never transmitted to Anthropic

See Anthropic's Privacy Policy at anthropic.com/privacy.

Google LLC (Authentication and Calendar)
Your Google account sign-in and Google Calendar access are governed by Google's Privacy Policy. Google receives only the calendar event data that ScheduleScan creates on your behalf, following your explicit instruction to push events. See policies.google.com/privacy.

Vercel Inc. (Hosting Infrastructure)
ScheduleScan is hosted on Vercel's infrastructure. Vercel collects technical data including IP addresses, browser information, and anonymised usage statistics as part of its hosting services. Vercel's privacy policy states that for Hobby and Pro plan users, Vercel may share de-identified, aggregated technical information with AI business partners for service improvement purposes. Vercel does not receive your uploaded file contents or Google account information. See vercel.com/legal/privacy-policy.

7. Cross-Border Data Transfers

Your data is processed by Anthropic (United States) and Vercel (United States). Under the PDPA's Transfer Limitation Obligation, we are required to ensure that overseas recipients of personal data provide a standard of protection comparable to the PDPA.

Both Anthropic and Vercel operate under robust data protection frameworks including compliance with applicable US federal and state privacy laws. We have assessed these transfers to be reasonable given the minimal nature of the personal data transmitted and the protections in place.

8. Data Retention

We adhere strictly to the PDPA's Retention Limitation Obligation — personal data shall not be retained longer than is necessary for the purposes for which it was collected:

• Uploaded file contents — Never stored on our servers. Processed in real time and immediately discarded. Anthropic deletes API data within 7 days.
• Google account information — Held in browser session memory only. Permanently cleared when you sign out or close your browser.
• IP addresses — Held in server memory for rate limiting. Reset automatically every hour. Never written to persistent storage.
• Account data (if applicable) — Retained for the duration of your account and deleted within 30 days of an account deletion request.

9. Your Rights Under the PDPA

Under Singapore's Personal Data Protection Act 2012, you have the following rights:

• Right of Access — You may request information about the personal data we hold about you and how it has been used or disclosed in the past 12 months. We may charge a reasonable administrative fee for processing access requests.
• Right of Correction — You may request correction of any inaccurate or incomplete personal data we hold about you. We may require supporting documents to verify the accuracy of the requested correction.
• Right to Withdraw Consent — You may withdraw consent for the collection, use, or disclosure of your personal data at any time. Note that withdrawal of consent may affect our ability to provide the Service to you.
• Right to Data Portability — Where technically feasible, you may request a copy of your personal data in a commonly used electronic format.

To exercise any of these rights, contact our DPO at keithleemh@gmail.com. We will respond within 30 calendar days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

10a. Cookies

Cookies are small pieces of information stored in your web browser to record information about your visit. ScheduleScan may use session cookies to maintain your authentication state while you are signed in. These cookies are strictly necessary for the Service to function and do not track you across other websites. You may configure your browser to refuse cookies, however doing so may prevent the Service from functioning correctly.

We do not use cookies for advertising, behavioural tracking, or any purpose other than session authentication.

10b. Anonymised Data for Research

We may use or disclose anonymised or aggregated data — data that cannot reasonably be used to identify any individual — for internal research, service improvement, or statistical analysis. Such data does not constitute Personal Data under the PDPA.

10. Revoking Google Calendar Access and Withdrawal of Consent

You may revoke ScheduleScan's access to your Google Calendar at any time without contacting us. Go to myaccount.google.com/permissions, find ScheduleScan in the list of connected apps, and click Remove Access. Revocation takes effect immediately.

If you withdraw your consent to any or all collection, use, or disclosure of your Personal Data, please note that depending on the nature of your request, we may be unable to continue providing the Service to you. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal. Our legal rights and remedies in such events are expressly reserved.

11. Data Security

We implement reasonable security arrangements as required under the PDPA's Protection Obligation:

• All data is transmitted over HTTPS/TLS encryption
• API keys and credentials are stored in secure server-side environment variables and are never exposed in client-side code
• Google OAuth access tokens are held in browser memory only and are never written to persistent storage or transmitted to our servers beyond what is necessary to relay API calls
• Administrative access to our systems is protected by two-factor authentication
• Our source code repository is set to private access
• Rate limiting is implemented to prevent abuse of the Service

No method of data transmission over the internet is completely secure. While we implement commercially reasonable security measures, we cannot guarantee absolute security. In the event of a data breach that is likely to result in significant harm or affects 500 or more individuals, we will notify the PDPC within 3 calendar days of making that assessment, and notify affected individuals as required under the PDPA.

12. Children's Personal Data

ScheduleScan is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. In accordance with the PDPC's Advisory Guidelines on Children's Personal Data (March 2024), individuals aged 13 to 17 may use the Service with awareness of this Privacy Policy. If you believe a child under 13 has submitted personal data, please contact our DPO immediately and we will delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. We will update the "Last updated" date at the top of this page when changes are made. For material changes, we will notify users by email where contact information is available. Continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

14. Governing Law and Complaints

This Privacy Policy is governed by the laws of Singapore. If you have a complaint about how we handle your personal data, please contact our DPO in the first instance. If you remain unsatisfied, you may lodge a formal complaint with the Personal Data Protection Commission of Singapore:

• Website: pdpc.gov.sg
• Hotline: 6377 3131

15. Contact

• Data Protection Officer: Keith Lee
• Email: keithleemh@gmail.com
• Location: Singapore