Privacy Policy

Tecton Scheduler is a software platform operated by:

Tecton Logic

Website: https://tectonlogic.com

For privacy-related questions or requests, please contact us through the contact or support information provided on the Tecton Scheduler website.

For purposes of applicable Indian data-protection law, Tecton Logic may act as the entity determining the purposes and means of processing personal data through Tecton.

This Privacy Policy applies to information collected through:

• Tecton Scheduler website
• Tecton user accounts
• The Tecton web application
• Tecton dashboards
• Customer-facing booking and rescheduling pages
• Tecton APIs
• Tecton integrations
• Communications with Tecton
• Customer support interactions
• Other Services operated by Tecton that link to this Privacy Policy

This Privacy Policy applies to information processed by Tecton directly.

It does not govern the independent privacy practices of third-party services such as Acuity Scheduling, Squarespace, Stripe, Square, OpenAI, or other providers.

Those services have their own privacy policies and terms.

The information we collect depends on how you interact with Tecton.

We may collect the following categories of information.

You may voluntarily provide information when you:

• Create an account
• Connect an integration
• Configure your business
• Contact support
• Submit a form
• Request information
• Configure services
• Create appointment types
• Configure booking rules
• Configure rescheduling rules
• Configure payment settings
• Communicate with us

This information may include business information, contact information, configuration information, and other information necessary to provide the Services.

Tecton can connect to third-party platforms, including Acuity Scheduling.

When you authorize a connection, Tecton may receive information made available through the permissions granted to us.

Depending on your configuration, this may include:

Acuity supports OAuth 2.0 for applications that allow multiple Acuity users to connect their accounts. Tecton uses authorized integration mechanisms to connect a customer's Acuity account where applicable. (Acuity Scheduling)

We only request and use information reasonably necessary to provide the functionality you authorize.

Tecton may integrate with payment services such as Stripe and Square.

When you use payment functionality, payment information may be processed directly by the applicable payment provider.

Tecton generally does not need to store your complete credit-card number or other full payment credentials to provide payment-related functionality.

Depending on the integration, Tecton may receive information such as:

• Transaction ID
• Payment status
• Amount
• Currency
• Refund status
• Payment date
• Customer reference
• Payment method type
• Transaction-related metadata

The applicable payment provider may collect and process additional information under its own privacy policy.

For example, Stripe's current privacy policy describes its processing of transaction data and personal information associated with payment transactions. (Stripe)

Certain Tecton features may use artificial intelligence services, including OpenAI's API.

Depending on the feature you use, information may be sent to an AI service to generate:

• Booking responses
• Answers to customer questions
• Scheduling assistance
• Summaries
• Recommendations
• Other AI-generated content

We seek to limit information sent to AI providers to information reasonably necessary for the relevant feature.

Where we use the OpenAI API for business data, OpenAI states that API inputs and outputs are not used to train its models by default, unless the customer explicitly opts into applicable data-sharing programs. (OpenAI)

OpenAI may nevertheless process information according to its applicable business terms, privacy documentation, security practices, and data-processing agreements.

Tecton does not represent that every AI provider or AI configuration will have identical data-retention or processing practices.

When you access Tecton, we may automatically collect technical information such as:

• IP address
• Browser type
• Operating system
• Device type
• Screen characteristics
• Language preferences
• Time zone
• Referring website
• Pages or screens accessed
• Features used
• Date and time of access
• Session information
• Error information
• Performance information
• Approximate geographic information derived from technical data

We use this information to operate, secure, troubleshoot, analyze, and improve the Services.

Tecton may use cookies, local storage, pixels, SDKs, and similar technologies.

We may use these technologies for:

• Authentication
• Maintaining sessions
• Security
• Remembering preferences
• Analytics
• Performance monitoring
• Understanding how users interact with the Services
• Improving the website and application

Some cookies may be provided by third-party service providers.

You may be able to control cookies through your browser settings. Disabling certain cookies may affect the functionality of Tecton.

We may use information for the following purposes:

Where applicable law requires a legal basis for processing personal information, we may process information based on:

• Your consent
• Performance of a contract or provision of requested services
• Compliance with legal obligations
• Legitimate operational purposes where legally permitted
• Other lawful grounds available under applicable law

Under India's Digital Personal Data Protection framework, processing of digital personal data is governed by specified lawful grounds and obligations applicable to Data Fiduciaries and Data Principals. (India Code)

Where consent is the applicable basis for processing, you may withdraw consent subject to applicable law and the consequences of withdrawal.

Withdrawal of consent may cause certain Tecton functionality to stop working.

Tecton is primarily a business software platform.

A business using Tecton ("Business Customer") may connect its scheduling account and provide information relating to its customers, clients, employees, or other individuals ("End Users").

Where a Business Customer provides personal information to Tecton through an integration:

• The Business Customer is responsible for determining the appropriate legal basis for providing the information.
• The Business Customer is responsible for providing required privacy notices to its customers.
• The Business Customer is responsible for obtaining required permissions or consents.
• Tecton processes the information to provide the Services to the Business Customer.

For example, if a fitness, healthcare, wellness, professional-services, or other business connects its Acuity account to Tecton, that business remains responsible for its relationship with its customers and for determining what information it may lawfully make available to Tecton.

We do not sell personal information to third parties for their own independent direct-marketing purposes.

We may share information with the following categories of recipients where necessary.

We may use third-party companies to help operate Tecton.

These may include providers of:

• Cloud hosting
• Databases
• Infrastructure
• Security
• Authentication
• Email delivery
• Customer support
• Analytics
• Monitoring
• AI services
• Payment processing
• Error tracking
• Communications
• Backup and storage

These providers may process information on our behalf and are expected to use appropriate safeguards and only process information for authorized purposes.

We may disclose information where reasonably necessary to:

• Comply with applicable law
• Respond to lawful governmental requests
• Respond to court orders
• Protect the rights or property of Tecton Logic
• Protect users or third parties
• Investigate fraud
• Investigate security incidents
• Enforce our Terms
• Prevent illegal activity

If Tecton Logic undergoes a merger, acquisition, restructuring, financing, sale of assets, or similar transaction, information associated with Tecton may be transferred as part of that transaction.

Where required, we will provide appropriate notice and handle personal information in accordance with applicable law.

Tecton may use service providers and infrastructure located outside India.

As a result, personal information may be processed or stored in countries other than the country in which you or your customers are located.

Where applicable law imposes requirements on international transfers, we will take steps reasonably necessary to comply with those requirements.

India's Digital Personal Data Protection Act contains provisions addressing processing of personal data outside India, including restrictions that may be specified by the Central Government. (India Code)

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, misuse, or destruction.

Depending on the system and information involved, security measures may include:

• Encryption in transit
• Encryption at rest where supported
• Access controls
• Authentication mechanisms
• Tenant-level data separation
• Logging and monitoring
• Security updates
• Backup mechanisms
• Restricted administrative access
• Infrastructure security controls

However, no system connected to the internet can be guaranteed to be completely secure.

You are also responsible for maintaining the security of your account credentials and connected services.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• Provide the Services
• Maintain accounts
• Maintain integrations
• Provide support
• Comply with legal obligations
• Resolve disputes
• Prevent fraud
• Maintain security
• Enforce agreements
• Maintain appropriate business records

Retention periods may vary depending on the type of information and the reason it was collected.

When information is no longer required, we may delete, anonymize, or securely dispose of it, subject to applicable legal and operational requirements.

You may disconnect your Acuity account from Tecton where the functionality is available.

Disconnecting Acuity will stop Tecton from accessing the account through the applicable integration, subject to technical processing already initiated.

You may also revoke Tecton's authorization through Acuity.

Acuity's OAuth documentation provides an OAuth disconnect mechanism for disabling an access token. (Acuity Scheduling)

Disconnecting an integration does not necessarily mean that all historical information is immediately deleted.

If you want information deleted, you may submit a deletion request as described below, subject to applicable law and legitimate retention requirements.

Depending on your location and applicable law, you may have rights relating to your personal information.

These may include the right to:

• Know what personal information is being processed
• Request access to personal information
• Request correction of inaccurate information
• Request deletion or erasure where legally available
• Withdraw consent where consent is the basis for processing
• Request information about processing activities
• Raise a privacy-related grievance
• Exercise other rights provided by applicable law

Under India's Digital Personal Data Protection Act, the framework includes rights relating to access to information, correction and erasure, grievance redressal, and nomination. (India Code)

The exact availability and scope of these rights depends on applicable law and the circumstances of the processing.

To make a privacy request, contact us through the privacy or support contact information provided on:

https://tectonscheduler.com/

Please include enough information for us to understand:

• Your identity
• Your relationship with Tecton
• The account or business involved
• The nature of your request

We may need to verify your identity before fulfilling certain requests.

This is intended to protect personal information from unauthorized disclosure.

If your personal information is contained within a Tecton account belonging to a business, that business may be the primary party responsible for responding to your request.

For example, if you are a customer of a fitness studio that uses Tecton, the fitness studio may control the customer information it provides to Tecton.

In those circumstances, you may need to contact the business directly first.

We may assist the Business Customer in responding to lawful requests where appropriate.

Tecton is primarily designed for businesses and their authorized users.

Tecton is not intended to knowingly collect personal information directly from children for independent use of the Services.

Business Customers are responsible for ensuring that their use of Tecton involving children complies with applicable law.

Under India's DPDP Act, a "child" is an individual who has not completed eighteen years of age, and the Act contains specific provisions relating to processing children's personal data. (India Code)

If you believe a child has provided personal information directly to Tecton without appropriate authorization, please contact us.

We may send service-related communications that are necessary to operate your account.

For promotional communications, where required by applicable law, we will provide an appropriate mechanism to opt out.

You may unsubscribe from marketing emails using the unsubscribe mechanism included in the communication.

Even if you opt out of marketing communications, we may continue sending essential service communications, such as security alerts, account notices, and important changes to the Services.

We may analyze information about how Tecton is used.

Where appropriate, we may aggregate or de-identify information so that it no longer reasonably identifies a particular individual or business.

We may use aggregated or de-identified information for:

• Product development
• Analytics
• Performance measurement
• Research
• Service improvement
• Business planning

We will not intentionally attempt to re-identify properly de-identified information except where required or permitted by law.

Tecton Logic does not sell personal information to third parties for their own independent advertising or marketing purposes.

We may share information with service providers and connected integrations as necessary to provide Tecton.

We may also disclose information where legally required or otherwise permitted under this Privacy Policy and applicable law.

Tecton may link to or integrate with third-party services.

Those services operate independently from Tecton and may have different privacy practices.

Examples include:

• Acuity Scheduling / Squarespace
• Stripe
• Square
• OpenAI
• Cloud infrastructure providers
• Analytics providers
• Other integrations

You should review the privacy policies of services that you connect to Tecton.

Our Privacy Policy does not control information that a third party collects independently of Tecton.

Tecton's integration with Acuity allows authorized users to connect their scheduling accounts.

Acuity's developer documentation describes OAuth 2.0 as the recommended method for applications that need to allow multiple Acuity users to authenticate and connect their accounts. (Acuity Scheduling)

When you authorize Tecton, Acuity provides Tecton with the access necessary to make authorized API requests.

Tecton does not receive your Acuity password through the OAuth authorization process.

You can revoke or disconnect authorization as supported by Acuity and Tecton.

Where Tecton uses payment providers such as Stripe or Square, those providers may independently collect and process personal and payment information.

Stripe's privacy documentation, for example, describes collection of transaction information including payment status, transaction amount, payment method information, and related transaction data. (Stripe)

Tecton's receipt of limited payment-related information does not mean that Tecton stores the underlying full payment credentials.

Where Tecton sends information to AI providers, we aim to send only information necessary for the requested functionality.

For example, an AI booking assistant may receive information necessary to:

• Understand a customer's request
• Identify available services
• Determine available appointment times
• Answer configured business questions
• Assist with booking

OpenAI states that business/API data is not used to train its models by default, although organizations can opt into certain data-sharing programs. (OpenAI)

Tecton does not independently control OpenAI's underlying infrastructure or privacy practices.

You should not provide Tecton with confidential information unless you are authorized to do so and the information is necessary for the intended use of the Services.

Business Customers should configure integrations and AI features appropriately for the information they intend to process.

If your business requires specific contractual confidentiality, security, data-processing, HIPAA, or other compliance commitments, those requirements should be agreed with Tecton Logic separately in writing before processing such information.

If we become aware of a security incident involving personal information that requires notification under applicable law, we will take steps required by applicable law.

Depending on the circumstances, this may include:

• Investigating the incident
• Containing the incident
• Taking corrective measures
• Notifying affected parties
• Notifying regulators or authorities where required

We cannot guarantee that a security incident will never occur.

We may update this Privacy Policy from time to time.

Changes may be made because of:

• Changes to Tecton
• New integrations
• New features
• Changes in applicable law
• Changes in data-processing practices
• Security improvements
• Business requirements

When we make material changes, we may provide notice through the Services, by email, or through another reasonable method.

The updated policy will include a revised "Last Updated" date.

Your continued use of the Services after the effective date of the updated policy constitutes acknowledgment of the updated policy to the extent permitted by law.

This Privacy Policy is governed by the laws of India as applicable in the State of Rajasthan, subject to applicable mandatory privacy and data-protection laws.

Subject to applicable law, courts having jurisdiction in Jaipur, Rajasthan, India will have jurisdiction over disputes relating to this Privacy Policy.

Nothing in this section limits rights that cannot legally be waived or restricted.

If you have questions, concerns, complaints, or requests regarding this Privacy Policy or the handling of personal information, contact us through the contact or support information available on the Tecton Scheduler website.