Privacy Policy
How SkedEz handles account, appointment, consent, analytics, advertising, security, and support information.
Legal contact
- Version
- privacy-2026-10-07
- Effective date
- October 7, 2026
- Last updated
- October 7, 2026
Controller and processor roles
StationByte LLC is the controller for SkedEz account, site, acquisition, billing, support, security, analytics, and advertising data. A SkedEz customer is generally the controller for its clients' appointment data, while StationByte is a processor of that appointment data to provide the service.
- Customers decide why their appointment data is used and must give lawful instructions and notices to the people whose data they enter.
Information collected
Depending on the feature used, SkedEz collects account and profile information, business configuration, appointment data, communications, billing metadata, device and security logs, consent records, campaign attribution, conversion events, and transient coarse request country used for jurisdiction gating without retaining raw IP for that purpose.
- Account and profile information and business configuration support account administration and requested service features.
- Appointment data and communications support booking, scheduling, notifications, support, and customer-requested operations.
- Billing metadata, device and security logs, consent records, campaign attribution, and conversion events support payment, security, accountability, measurement, and controlled advertising.
- A trusted infrastructure signal may provide a coarse request country for jurisdiction gating; raw IP is not retained solely for that purpose.
Sources of information
Information comes from the user, the user's business, other users booking with that business, authentication and payment providers, and consented advertising or analytics technologies.
- Some data is entered directly, some is supplied by a business or booking participant, and some is returned by a requested provider or an optional technology after its category is allowed.
Purposes and legal bases
Optional consent is not a condition of service. Optional cookie consent can be withdrawn at any time, and withdrawal does not change the availability of services that do not require the withdrawn category.
- Contract: accounts, scheduling, support, subscriptions, and requested integrations.
- Legal obligation: accounting, tax compliance, fraud prevention, and lawful requests.
- Legitimate interests: security, abuse prevention, reliability, and limited operational diagnostics balanced against applicable rights.
- Consent: optional analytics storage, advertising storage, personalized advertising signals, Google Signals, Meta Pixel/CAPI, Google Ads tags and enhanced conversions, and associated attribution.
Consent and advertising
Terms acceptance and delivery of this Privacy Policy are not consent to advertising. Legal acceptance never enables Analytics or Marketing providers.
Meta Conversions API (Meta CAPI) may receive hashed identifiers and browser/network data only when Marketing consent was present at the event. Marketing withdrawal, a recognized opt-out, missing evidence, or an unavailable decision blocks the delivery.
Google Ads (Google Ireland Limited and Google LLC) may receive from our servers a normalized SHA-256 hash of the account e-mail address, the ad click identifier (gclid, gbraid, or wbraid), the conversion event name, time, and value, and the recorded consent state, for conversion measurement and advertising optimisation (enhanced conversions). The legal basis is Marketing consent: delivery occurs only when Marketing consent was present at the event, and Marketing withdrawal, a recognized opt-out, missing evidence, or an unavailable decision blocks the delivery, as for Meta CAPI. Google retains this data under its conversion data policies. Consent can be withdrawn at any time in Your Privacy Choices. See Google's Privacy Policy (https://policies.google.com/privacy) and the Google Ads Data Processing Terms (https://business.safety.google/adsprocessorterms/).
Google Signals, when enabled in Google Analytics, associates measurement data with the Google accounts of users who are signed in to Google and have allowed ads personalization, enabling cross-device reporting and ads personalization. It is active only when both Analytics and Marketing consent are granted and adds no first-party cookies beyond those listed in the Cookie Policy. Withdrawing either category in Your Privacy Choices stops it for future events; ads personalization can also be controlled in Google's Ads Settings (https://adssettings.google.com).
- Analytics and Marketing are independent optional categories; each provider request and each conversion delivery is evaluated against its own category.
Recipients and provider registry
The authoritative versioned provider registry identifies each actually enabled recipient or subprocessor, its role, data fields, purpose, destination, verified transfer safeguard, provider privacy or DPA link, and retention rule. The registry is updated when deployment evidence changes.
- A provider without verified deployment and account facts is not presented as a complete enabled disclosure; account-specific provider details remain subject to verification.
International transfers
Where an enabled vendor receives information in another country or region, the provider registry publishes the destination and the verified contractual or other transfer safeguard used for that vendor.
- Provider-side privacy terms and retention can also apply and are disclosed through the provider's published information and the verified registry entry.
Retention and deletion
The following retention labels describe the initial schedule. Deletion jobs are idempotent and auditable by aggregate counts; account deletion removes or pseudonymizes attribution and conversion links where no overriding legal obligation applies, and evidence retains only the minimum needed for accountability or contract defense.
- skedez_consent browser cookie — 180 days from each effective decision.
- skedez_privacy_optout browser cookie — fixed Max-Age up to 400 days from issue or a verified active renewal; a valid closure keeps the same handle only through its finite last committed server expiry and does not renew it. A delayed response may leave stale browser bytes after server expiry; expired or revoked handles are terminal.
- skedez_attr_analytics and skedez_attr_marketing browser cookies — 90 days.
- Raw UTM and advertising click IDs — maximum 90 days after capture.
- BrowserMeasurementContext — maximum 90 days and deleted on category withdrawal.
- PurchaseMeasurementIntent raw browser-context linkage — maximum 90 days; remaining non-raw billing correlation follows conversion retention.
- ConsentDecision evidence — 5 years after the final decision unless a shorter period is legally required.
- PrivacyOptOut and PrivacyOptOutClosure evidence — 5 years after the final opt-out, closure, or account closure, subject to applicable law.
- LegalAcceptance evidence — account life plus 6 years after closure, subject to legal-claims requirements.
- Canonical conversion and provider delivery metadata — 25 months.
- BrowserDispatchAttempt metadata — 25 months; attempt evidence only and never represented as provider acceptance.
- Generic idempotency replay records — at least 24 hours; immutable resource and business uniqueness survives separately.
- Safe provider error diagnostics — 30 days.
- Failed payload bodies — not logged; permitted identifiers remain only in the protected outbox for the conversion period.
Privacy rights
Subject to applicable law and verification, a person may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, and the ability to complain to a competent supervisory authority. Requests may be sent to contact@stationbyte.com.
- We may verify a request, use an authorized agent process where required, and explain any lawful reason a request cannot be completed.
US state privacy rights
StationByte does not sell personal information for money. Where applicable law treats Marketing controls as an opt-out of sale, sharing, or targeted advertising, the same Marketing control is honored for that purpose.
We verify requests, support authorized agents where required, provide an appeal process where required, and do not discriminate against a person for exercising applicable privacy rights.
- The request process, appeal path, and non-discrimination protection are applied according to the law that covers the requesting person.
Global Privacy Control and universal opt-outs
Global Privacy Control and other recognized universal opt-out mechanisms may apply at browser or device scope and, after an authenticated association where permitted, at account scope. Later signal absence is not an opt-in; any legally required repermission waiting period still applies.
- A recognized signal forces Marketing off and does not create an optional grant; Analytics remains independently selectable where allowed.
Automated decisions
This tracking system does not make a solely automated decision with legal or similarly significant effect about a person.
- Service operations and account decisions remain subject to the applicable product rules, support processes, and human review paths.
Adults and appointment data
Business accounts must be created and controlled by adults. This rule is distinct from appointment data that a customer may lawfully process for a minor; the customer is responsible for any notice, consent, or parental authorization required for that appointment data.
- Customers must not enter appointment data unless they have a lawful basis and have met the obligations that apply to their clients and users.
Security
StationByte uses proportionate technical and organizational safeguards for access, authentication, least privilege, encryption where applicable, segregation, backups, logging, vulnerability management, incident response, availability, and personnel confidentiality. No method of transmission or storage is risk-free.
- Raw click identifiers, tokens, email, IP addresses, cookies, and provider payloads are excluded from application logs and error trackers where the design requires it.
EEA processing gate
Before offering services to, accepting a new signup from, or monitoring a person in the EEA in circumstances that may fall within GDPR Article 3(2), counsel must document territorial scope, the Article 27 representative analysis, Chapter V transfer safeguards, and local ePrivacy and cookie requirements. Until that review is recorded, the release blocks new EEA signup, service onboarding, optional Analytics or Marketing processing for EEA visitors, behavioral monitoring, and EEA-targeted campaigns; public informational and legal pages remain available with Essential processing only.
Changes and contact
Material changes to this Privacy Policy create a new version and are communicated through the service or another appropriate notice. The effective date and last-updated date identify this revision.
- For privacy requests or questions, contact contact@stationbyte.com.
Provider registry
| Provider registry | Version |
|---|---|
| Provider registry | provider-registry-2026-09-16 |
Provider verification required
This versioned registry is not release-complete while an enabled provider lacks verified account and legal evidence. Incomplete provider details are not presented as facts.
Professional advisers and public authorities, where lawfully required
- professional-advisers-public-authorities
- professional-advisers-and-public-authorities
- Only information lawfully required for advice, proceedings, or an authority request
- Obtain professional advice or respond to a lawful authority request
- Legal obligation and legitimate interests, as applicable
Retention schedule
| Retention schedule | Version |
|---|---|
| Retention schedule | retention-2026-09-11 |
Consent cookie
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Privacy opt-out cookie
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Attribution cookies
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Raw attribution
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Browser measurement context
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Purchase raw linkage
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Consent evidence
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Opt-out evidence
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Legal acceptance
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Conversion delivery
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Browser dispatch attempts
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Idempotency replay
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Provider error diagnostics
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.
Failed provider payload
- Deletion or pseudonymization is performed according to the applicable schedule and lawful exceptions; account closure removes or pseudonymizes attribution and conversion links where no overriding duty applies.
- Retained evidence is limited to the minimum needed for accountability, security, legal duties, or contractual defense.
- Provider-specific retention is linked only after the provider account and current public terms are verified; unknown provider retention remains a release blocker.
- Deletion jobs are intended to be idempotent and auditable through aggregate counts; aggregate runtime evidence does not prove an individual record was deleted.