Privacy Policy
Last updated: April 13, 2026
1. Data Controller
The Service is operated by SMTM Lab, located at 9826 Introduction Way, Orlando, FL 32832, United States. The controller of personal data collected from end clients through Skedully (hereinafter, «the Service») is the business account holder using the platform. Skedully acts as data processor on behalf of those businesses for the management of client bookings.
For privacy inquiries, you can contact us through our contact form.
2. Data we collect
Registered users (businesses)
- Full name
- Email address
- Password (stored as a bcrypt hash, never in plain text)
- Business information: name, description, phone number, custom URL
Clients booking an appointment
- Full name
- Email address
- Phone number (optional)
- Additional notes about the booking (optional)
- Date, time and service selected
Technical data
- Session cookies (required for the service to function)
- Visual theme preference (light/dark), stored locally on your device
3. Purpose and legal basis for processing
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Business account management | Performance of contract (Art. 6.1.b) | Until account deletion |
| Client booking management | Performance of contract (Art. 6.1.b) | 3 years from the booking |
| Sending confirmation emails | Performance of contract (Art. 6.1.b) | Immediate (not stored) |
| Strictly necessary cookies | Legitimate interest (Art. 6.1.f) | Session duration |
4. Cookies
Skedully uses only strictly necessary cookies for the service to function. We do not use advertising, tracking, third-party analytics (such as Google Analytics) or social media pixel cookies.
| Cookie | Type | Purpose |
|---|---|---|
| authjs.session-token | Necessary | Keep the business session active |
| theme (localStorage) | Necessary | Remember light/dark theme preference |
5. Sharing data with third parties
Skedully shares minimal data with the following trusted providers:
- Render.com — Infrastructure provider (servers and database). Data is stored on EU servers or with appropriate transfer safeguards.
- Resend — Transactional email service (appointment confirmations). Receives only the name, email and appointment details needed to send the message.
We do not sell or transfer personal data to third parties for commercial purposes.
6. Your rights (GDPR)
If you are a resident of the European Economic Area, you have the following rights regarding your data:
Access
Request a copy of the data we hold about you.
Rectification
Correct inaccurate or incomplete data.
Erasure
Ask us to delete your personal data.
Portability
Receive your data in a structured, machine-readable format.
Objection
Object to processing based on legitimate interest.
Restriction
Ask us to restrict the use of your data.
To exercise any of these rights, contact us through our contact form. We respond within a maximum of 30 days. You also have the right to lodge a complaint with your country's supervisory authority (in Spain: AEPD; in Argentina: AAIP).
7. Security
We apply technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), bcrypt password storage, restricted database access and automatic backups. No system is 100% secure; in the event of a security breach affecting your data, we will notify you within the legally required timeframe.
8. Changes to this policy
We may update this policy to reflect changes to the service or legal requirements. We will notify you of significant changes by email (if you are a registered user) or through a prominent notice on the platform. The «last updated» date will always be visible at the top.
9. Contact
For any questions about this policy or the processing of your data:
SMTM Lab — Skedully