Privacy Policy

Last updated: June 2026

This Privacy Policy explains how Scheduler (“Scheduler”, “we”, “us”), operated by Royal Bengal AI, collects, uses, stores, and shares information when you use our scheduling application at scheduler.royalbengal.ai (the “Service”). By using the Service you agree to the practices described here.

1. Who this applies to

It applies to two groups: hosts (people with a Scheduler account who create event types and share booking links) and invitees (people who book a time through a host’s public booking page).

2. Information we collect

Account information (hosts)

Your name, email address, password (stored only as a secure hash by our authentication provider), time zone, language preference, optional profile picture, welcome message, and workspace name and booking-link slug.

Booking information (invitees)

When someone books a meeting, we collect the name, email address, and chosen time they provide, and the time zone detected by their browser, so we can create and manage the booking and send confirmation and reminder emails.

Google user data (hosts who connect Google Calendar)

Connecting your Google Calendar is optional. If you connect it, we access:

Free/busy information (via the calendar.freebusy scope) — only the times you are busy or free, not the titles, attendees, or details of your events. We use this to avoid offering times that conflict with your calendar.
Calendar events (via the calendar.events scope) — we create, update, and delete the calendar events that correspond to bookings made through Scheduler (for example, adding a booked meeting to your calendar, moving it when it’s rescheduled, and removing it when it’s cancelled). We do not read or modify events that Scheduler did not create.

To maintain this connection we store the OAuth tokens Google issues to us and the email address of the connected Google account.

Microsoft Outlook (hosts who connect Outlook)

Connecting Microsoft Outlook is optional. When connected, we read your free/busy times to avoid offering times that conflict with your calendar, and we create, update, and delete the Outlook calendar events that correspond to bookings made through Scheduler. To maintain this connection we store the OAuth tokens Microsoft issues to us and the email address of the connected Microsoft account.

Apple iCloud (hosts who connect Apple Calendar)

Connecting Apple iCloud is optional and uses Apple’s CalDAV protocol. Because Apple does not offer OAuth sign-in for iCloud calendars, the connection relies on an app-specific password that you generate at appleid.apple.com and provide to us. When connected, we read your busy times to avoid offering conflicting slots, and we create, update, and delete the calendar events that correspond to bookings made through Scheduler. To maintain this connection we store the app-specific password, your Apple ID email, and the calendar URL it points to. The app-specific password grants access only to your iCloud calendar data and can be revoked by you at any time from your Apple ID account.

Zoom (hosts who connect Zoom)

Connecting Zoom is optional. When connected, we create, update, and delete the Zoom meetings that correspond to your bookings so each booking has a video link. To maintain this connection we store the OAuth tokens Zoom issues to us and the email address of the connected Zoom account.

3. How we use information

To provide the scheduling service: showing availability, creating and managing bookings.
To check your connected calendar (Google, Outlook, or Apple iCloud) for conflicts and to place booking events on it, when connected.
To send transactional emails (booking confirmations, reschedules, cancellations, reminders).
To operate, secure, and improve the Service.

We do not use your information for advertising, and we do not sell it.

4. Google user data — Limited Use

Scheduler’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained from Google APIs is:

used only to provide and improve the scheduling features described above;
never used for advertising;
never sold or transferred to third parties, except as needed to provide the Service, to comply with applicable law, or as part of a merger or acquisition;
never used to train generalized or non-personalized artificial-intelligence or machine-learning models;
not accessed by humans unless you give explicit consent, it is necessary for security or to comply with law, or the data is aggregated and anonymized.

5. How we store and protect information

Data is stored with our infrastructure providers, Supabase (database) and Railway (application hosting), and is transmitted over encrypted connections (HTTPS). Calendar and video integration credentials — including OAuth tokens and any app-specific passwords — are held in access-restricted database tables reachable only by our server using privileged credentials; they are not exposed to browsers or other users. We take reasonable and appropriate measures to protect your data, though no method of transmission or storage is completely secure.

6. Sharing

We share information only with service providers that help us run the Service:

Supabase — database and authentication.
Railway — application hosting.
Google — calendar conflict checking and event creation, when you connect Google Calendar.
Microsoft — calendar conflict checking and event creation, when you connect Outlook.
Apple iCloud — calendar conflict checking and event creation via CalDAV, when you connect Apple Calendar.
Zoom — creating video links for your bookings, when you connect Zoom.
Our outbound email (SMTP) provider — to deliver booking and reminder emails.

We may also disclose information if required by law. We do not sell personal information.

7. Your data rights, retention, and how to exercise them

You have the right to access the personal information we hold about you, to request correction of inaccurate information, to request deletion of your account and associated data, to obtain a copy of your data, to object to or restrict certain processing, and to withdraw consent (for example by disconnecting an integration) at any time. To exercise any of these rights, email us at admin@royalbengal.ai or use our Support page; we will respond within a reasonable time. Exercising these rights will not lead to any discriminatory treatment.

You can disconnect Google Calendar, Outlook, Apple iCloud, or Zoom at any time from the Integrations page; when you do, we delete the stored tokens or credentials and stop accessing that service. Removing the app from Zoom or Google also triggers deletion of the stored tokens on our side.
You can revoke Scheduler’s access from your Google Account permissions page (myaccount.google.com/permissions) or the Zoom App Marketplace (Manage → Added Apps) at any time. For Apple iCloud, revoke access by deleting the app-specific password from your Apple ID account (appleid.apple.com).
You may request deletion of your account and associated data by contacting us.
We retain booking records for as long as needed to provide the Service and meet legal obligations, then delete or anonymise them.

8. Analytics and cookies

On our public website we use Google Analytics, loaded through Google Tag Manager, to understand how visitors find and use the site. This sets cookies and collects usage data such as the pages viewed, approximate location (country, derived from IP address), referring site, and device and browser type. This information is processed by Google on our behalf; see Google’s privacy policy for how Google handles it. We use it only in aggregate to improve the site, not to identify you personally. You can opt out through your browser’s cookie controls or Google’s opt-out tools. Analytics is not applied to the signed-in application beyond what is described elsewhere in this policy.

9. International users

The Service is operated from Bangladesh and data may be processed in countries where our providers operate. By using the Service you consent to this processing.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their data.

11. Changes

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above, and continued use of the Service constitutes acceptance.

12. Contact

Questions about this policy or your data: admin@royalbengal.ai.

Scheduler is operated by Royal Bengal AI. This document describes our current data practices for the Service at scheduler.royalbengal.ai.