Privacy Policy

This Privacy Policy forms an integral part of the Terms and Conditions of Use. Terms defined in the Terms and Conditions have the same meaning in this Privacy Policy. In addition:

1. “Personal Data” means data about an individual who is identified or identifiable, alone or combined with other information, directly or indirectly.
2. “Specific Personal Data” means personal data referred to in Article 4(2) of the PDP Law, including health data and information, data of children and personal financial data.
3. “Data Subject” means the individual whose Personal Data is processed.
4. “Processing” means any operation on Personal Data, including acquisition, collection, analysis, storage, correction, updating, display, announcement, transfer, dissemination, disclosure and deletion.

1. For Account data and all Scheduly Me data, PT Scheduly Teknologi Indonesia acts as the Personal Data Controller.
2. For Guest and customer data entered or collected by an Operator through the Services, including guest lists, guest forms and customer conversations, the Operator acts as the Personal Data Controller and Scheduly acts as the Personal Data Processor on the Operator's instructions.
3. Guests who wish to exercise their rights over data controlled by an Operator may submit their request to that Operator. Scheduly will assist the Operator in fulfilling the request where technically feasible.
4. Scheduly has appointed a data protection officer, who can be contacted at dpo@scheduly.id.

3.1 All Users

1. Account data: name, email address, Google account profile photo if the User signs in with Google, WhatsApp number and Telegram ID if connected.
2. Technical and security data: IP address, device and browser type, sign-in times, security activity logs and system error records.
3. Form and comment data: name, business name, contact details and description of needs entered in the business enquiry form, and the name and email entered when commenting on an article. Comment emails are not shown publicly.
4. Payment data: invoice number, amount, status and payment method. Card and account data are processed directly by the payment service provider and are not stored by Scheduly.

3.2 Scheduly Me Users

1. Schedule and note data: event titles and times, locations typed by the User, categories, reminder settings, notes, goals and emergency contacts.
2. Conversation data: the User's messages to the Beaver assistant, Beaver's replies and conversation memory kept so that later replies remain in context.
3. Personal financial data: transactions, budgets, savings and zakat calculations recorded by the User.
4. Health data: menstrual cycle dates, colour and symptoms, if the User uses that feature.
5. Data about children: information about children recorded by a parent or guardian.
6. Reminder history: delivery channel, delivery status, provider error messages and delivery time.

3.3 Operators and Guests

1. Business data: business name, boats or assets, cabins, prices, schedules, agents, commissions, invoices and team members.
2. Guest data: name, contact details, nationality, passport number, date of birth, dietary requirements and flight information collected through guest forms or entered by the Operator.
3. Customer conversation data: message content, attachments and contact identity from channels the Operator connects to Scheduly Omni, including WhatsApp, Instagram, Facebook, email, website widget and marketplaces.
4. Content and social media account data: content, post schedules and access tokens of accounts the Operator connects to Scheduly Suite.

Personal Data is obtained directly from Users, from Operators entering Guest data, from third-party services connected by the User (including Google, Meta, Telegram and marketplaces) in line with the permissions the User grants on those services, and automatically from the User's device when accessing the Services.

Scheduly does not sell Personal Data and does not use it for targeted advertising.

1. Personal financial data, menstrual cycle data and data about children are processed only when entered by the User and on the basis of the User's consent.
2. Such data is used solely to provide the features chosen by the User and to write fitting Beaver replies. It is not used for any other purpose and is not shared with any party other than the providers listed in section 8.
3. The User may change or delete such data at any time and may withdraw consent as described in section 12.

1. Beaver assistant replies, suggested replies in Scheduly Omni, schedule document reading during import, product descriptions and detection of signs of danger in conversations are processed automatically. The text required for such processing is sent to the automated language processing providers listed in section 8.
2. Those providers are bound to process the data only on Scheduly's behalf and not for their own purposes.
3. If the system detects a serious sign of danger, such as self-harm or domestic violence, Beaver shows emergency helpline numbers and the conversation may be reviewed by authorised personnel.
4. Users have the right to object to decisions based solely on automated processing that produce legal effects or significantly affect them, as provided in Article 10 of the PDP Law, by contacting dpo@scheduly.id.

Scheduly uses the following providers to deliver the Services. Each provider receives only the Personal Data required for its function.

Beyond the providers above, Personal Data is disclosed only to marketplaces or other services connected by the User in line with the permissions the User grants, to Operators for Guest data they control, or to competent authorities upon an official request in accordance with the law.

Some providers listed in section 8 process Personal Data outside the territory of the Republic of Indonesia. Such transfers are made while ensuring an equivalent or higher level of protection, or adequate and binding safeguards, in accordance with Article 56 of the PDP Law. By using the Services, Users understand that their Personal Data may be processed in those countries.

1. Personal Data is stored on servers in Singapore operated by Tencent Cloud.
2. All data is encrypted in transit.
3. Sensitive data, including passport numbers, phone numbers, Guest email addresses, bank account holder names, account numbers and tax identification numbers (NPWP), is additionally encrypted at the application layer before storage.
4. Each Operator's and each User's data is logically separated so that it cannot be accessed by other Accounts.
5. Scheduly personnel access Personal Data only when requested by the User for technical support, for system maintenance and security, or to follow up a serious sign of danger. Every access is logged.

When the retention period ends, Personal Data is deleted or anonymised, unless longer retention is required by law.

Under Articles 5 to 13 of the PDP Law, Data Subjects have the right to:

1. obtain information about the identity, legal basis, purpose and accountability of the processing;
2. complete, update and correct errors and inaccuracies in their Personal Data;
3. access and obtain a copy of their Personal Data;
4. end the processing of, delete and destroy their Personal Data;
5. withdraw consent to processing, without affecting the lawfulness of processing carried out before withdrawal;
6. object to decisions based solely on automated processing;
7. delay or restrict processing proportionately to its purpose;
8. sue and receive compensation for breaches in the processing of their Personal Data;
9. obtain and/or use their Personal Data in a commonly used structure and format.

1. Requests to exercise rights are submitted to dpo@scheduly.id from the email address registered to the Account.
2. Scheduly may ask for identity verification before processing a request to prevent unauthorised access.
3. Scheduly responds within 3 × 24 (three times twenty-four) hours of receiving the request, and gives notice if fulfilling the request requires more time as permitted by the PDP Law.
4. Scheduly may refuse a request in the cases provided by the PDP Law, including where it would endanger the security, physical health or mental health of others, or conflict with a legal obligation, and will state the reason for refusal.

1. Essential cookies: sign-in session, consent record and language choice. The Services cannot function without them.
2. Statistics cookies: Google Analytics (_ga, _ga_*) and PostHog (ph_*), which are not used for advertising. Users may block them in their browser settings.
3. Local storage: a copy of the latest data is stored in the browser so pages can be displayed immediately. The copy is removed when the User signs out or clears browser data.

1. Scheduly Accounts are intended only for Users aged 18 (eighteen) and over. Scheduly does not knowingly collect Personal Data directly from children.
2. Data about children recorded by a User in Scheduly Me or entered by an Operator as Guest data is processed with the consent of a parent or guardian, in accordance with Article 25 of the PDP Law.
3. Anyone who becomes aware that a child's Personal Data is being processed without the consent of a parent or guardian may contact dpo@scheduly.id, and Scheduly will delete the data within 3 × 24 hours of receiving notice.

In the event of a failure in the protection of Personal Data, Scheduly gives written notice to the affected Data Subjects and to the personal data protection authority within 3 × 24 (three times twenty-four) hours of becoming aware of it, in accordance with Article 46 of the PDP Law. The notice states the Personal Data disclosed, when and how it was disclosed, and the handling and recovery measures taken.

The Services may contain links to third-party sites or services, including Operator pages and maps. This Privacy Policy does not apply to those sites or services, and Users are advised to read their respective privacy policies.

Scheduly may amend this Privacy Policy. Changes are published on this page and notified by email or notice within the Services. Where a change concerns Specific Personal Data or a new processing purpose, Scheduly will ask Users for renewed consent.

Questions, requests and complaints about this Privacy Policy may be sent to the data protection officer of PT Scheduly Teknologi Indonesia at dpo@scheduly.id. Users also have the right to lodge a complaint with the personal data protection authority.