1. Who We Are

365 Scheduler ("we", "us", "our") is a room display and booking management service operated by 365 Scheduler Ltd. Our service is accessible at 365scheduler.com and 365scheduler.co.uk.

For data protection enquiries, contact us at: support@365scheduler.com

2. What Data We Collect

Account data

Data	Why we collect it	Retention
Email address	Account login and communication	Until account deleted
Phone number	SMS verification at registration only	Not stored after verification
Organisation name	To group your screens and team	Until account deleted

Calendar data

When you connect a Microsoft 365 room mailbox, we access calendar events to display them on your room screen. This includes:

• Meeting subject, start time, end time
• Organiser name (first name only, displayed on screen)

We do not store calendar events. They are fetched in real time from Microsoft Graph API and displayed directly. Nothing is written to our database.

Screen configuration

To operate your room displays we store:

• Room email address and Microsoft tenant ID
• Display settings (room name, logo, colours, booking durations)
• LED controller settings (if enabled)
• Alert email addresses

Billing data

When you start a paid subscription, we pass your account email address and organisation name to Stripe, our payment processor, to create a Stripe customer record. Stripe handles your payment card information directly — we never see, store, or transmit your card details, CVV, or full card number. Card data is entered into Stripe-hosted Checkout / Customer Portal pages, which return only a non-sensitive Stripe customer ID to our system. We store that ID against your organisation so we can look up your subscription status and invoices.

What we hold on our side: Stripe customer ID, subscription status (active / trialing / past_due / cancelled), plan (monthly / annual), and period start/end dates received via webhook.

Usage data

We use Cloudflare Web Analytics on the public marketing site for aggregated, anonymous visitor counts and country-level statistics. It is cookieless, sets no identifiers in your browser, and collects no personal data. No data is shared with advertising networks. We do not use Google Analytics, tracking pixels, or advertising cookies.

3. Microsoft 365 Integration

Our service connects to Microsoft 365 via the Microsoft Graph API using application permissions. This requires a one-time admin consent from your Microsoft 365 administrator.

The permissions we request:

• Calendars.ReadWrite — to read meeting schedules and create room bookings

Your Microsoft credentials (passwords, personal tokens) are never accessed or stored by 365 Scheduler. Authentication uses Azure Active Directory application credentials stored securely server-side.

4. The 365 Scheduler Android App

The 365 Scheduler Android app is a kiosk-mode WebView application designed to run on dedicated tablet hardware mounted outside meeting rooms.

Data collected by the Android app

The Android app itself collects no personal data, no analytics, no telemetry, and no advertising identifiers. It contains no third-party SDKs other than Android system libraries.

Data stored locally on the tablet

• The display URL for the screen, including a screen-specific access token, stored in app-private SharedPreferences after pairing

This data never leaves the device and can be cleared by tapping the "Reset pairing" option three times in the app, or by uninstalling the app.

Network requests made by the app

The app makes HTTPS network requests to:

• 365scheduler.com — to fetch the room display, send heartbeat status, and exchange pairing codes
• api.qrserver.com — to fetch a QR code image during the initial pairing flow

The standard server access logs (IP address, timestamp, requested URL) apply to these requests as described in section 2.

Permissions requested by the Android app

• INTERNET & ACCESS_NETWORK_STATE — required to load the room display from our servers
• WAKE_LOCK — required to keep the display screen on while the app is running
• RECEIVE_BOOT_COMPLETED — required to automatically launch the kiosk display when the tablet powers on

The app does not request access to contacts, location, camera, microphone, storage, or any other sensitive permissions.

5. How We Use Your Data

• To operate the room display service
• To create and manage your account
• To send service notifications (offline alerts, invite emails)
• To respond to support requests

We do not use your data for advertising, profiling, or any purpose other than operating the service.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for commercial purposes.

We use the following trusted sub-processors to operate the service:

Provider	Purpose	Location
Google Firebase	Authentication, database, hosting	EU (europe-west1)
Microsoft Azure	Calendar API access	EU
Stripe	Subscription billing and payment processing (PCI-DSS Level 1 compliant)	EU/US
SendGrid / SMTP	Transactional email (invites, alerts)	EU/US

Stripe processes payment card information under their own privacy policy: stripe.com/privacy. We do not have access to your card number, CVV, or full card details at any time.

7. Data Security

We take security seriously. Measures we have in place:

• All data transmitted over HTTPS/TLS encryption
• Azure credentials stored server-side only — never exposed to browsers
• Firebase Authentication with brute-force protection
• Phone SMS verification required for new account registration
• Invite-only access — no public self-registration
• Role-based access control — team members only see screens they are assigned
• API endpoints protected with key-based authentication

8. Your Rights (UK GDPR)

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your account and associated data
• Portability — receive your data in a machine-readable format
• Objection — object to processing of your data
• Restriction — request we limit how we use your data

To exercise any of these rights, email support@365scheduler.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have mishandled your data.

Account & Data Deletion

You can request deletion of your account and all associated data at any time:

• Self-service: sign in at 365scheduler.com/room_admin.html, click your account name, then "Delete account & data". This permanently removes your organisation, screens, members, and all related records.
• By email: contact support@365scheduler.com from the email address associated with your account, and we will action your deletion request within 30 days.

When you delete your account, we remove: your account record, your organisation, all screens, all member invites, billing records (after legally-required retention period), and all configuration data. Calendar data accessed via Microsoft Graph is not stored on our servers, so there is nothing to delete on our side — it remains in your Microsoft 365 tenant under your control.

For the Android app specifically, all locally-stored data can be cleared by uninstalling the app or by tapping "Reset pairing" three times in the app.

9. Cookies

We use only essential cookies required to operate the service (authentication session). We do not use tracking or advertising cookies. We use Cloudflare Web Analytics for aggregated, anonymous visitor statistics on our marketing site, which is cookieless and does not set any identifiers in your browser. No cookie consent banner is required as we only use strictly necessary cookies.

10. Data Retention

Data type	Retention period
Account data	Until account is deleted
Screen configuration	Until screen is deleted by admin
Calendar events	Not stored — fetched live only
Invite tokens	48 hours (or until used)
Phone numbers	Not stored after verification
Stripe customer ID & subscription metadata	Until account is deleted; invoices retained by Stripe according to their policy
Payment card details	Never stored by us; held by Stripe under PCI-DSS
Billing / invoice records	7 years after end of subscription (UK tax law)

11. Children's Privacy

365 Scheduler is a business service not directed at children. We do not knowingly collect data from anyone under 18 years of age.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify account holders by email of any significant changes. The date at the top of this page indicates when it was last updated.