Privacy Policy

Last updated: November 6, 2025

1. Operator

Schedule4Later is operated by PENTURE Kevin EI (trade name: Protosoft), a sole proprietorship registered in France.

  • Legal entity: PENTURE Kevin EI
  • SIRET: 51085985300051
  • Trade name: Protosoft
  • Contact email: contact@protosoft.co

2. Personal Data We Collect

When you grant Schedule4Later access to your Google Workspace Chat account, we may collect and process the following personal information:

  • Your name, email address, and profile information
  • Time zone and language preferences
  • Google Workspace organization name
  • Avatar and profile picture
  • Message content that you choose to schedule
  • Information about spaces and conversations where messages are scheduled

When you sign in to our website or manage your subscription, we may also collect:

  • Name and email address for account creation
  • Payment information (processed securely by our payment processor)
  • Usage data and analytics to improve our service

3. How We Use Your Data

We follow the principles of purpose limitation and data minimization, processing only the data necessary to provide and improve our service:

  • To deliver scheduled messages at the requested time
  • To manage your account and subscription
  • To provide customer support and respond to your inquiries
  • To improve and optimize our service
  • To comply with legal obligations
  • To send service-related communications and updates

4. Legal Bases for Processing

We process your personal data based on the following legal grounds under the General Data Protection Regulation (GDPR):

  • Contract Performance: Processing necessary to fulfill our service obligations to you
  • Consent: When you voluntarily approve specific data processing activities
  • Legal Obligation: When required by applicable laws and regulations
  • Legitimate Interests: For marketing, customer support, fraud prevention, and service improvement, provided your rights are not overridden

5. Data Storage and Retention

  • Scheduled messages: Messages are encrypted with AES-256-GCM using our private MESSAGE_ENCRYPTION_KEY secret until their scheduled delivery time, then deleted within 24 hours after successful delivery
  • Account information: Retained while your account is active and for a reasonable period after deactivation to comply with legal obligations
  • Backup data: Retained for up to 30 days for disaster recovery purposes
  • App removal: When you uninstall Schedule4Later, all associated data is deleted within 30 days

6. Data Sharing and Third Parties

We do not sell your personal data. We may share your information only with:

  • Service providers: Trusted third parties who help us operate our service (cloud hosting, payment processing, analytics)
  • Legal requirements: When required by law, court order, or government regulation
  • Business transfers: In connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations

All third-party service providers are contractually obligated to protect your data and use it only for the purposes we specify.

7. Data Security

We implement industry-standard security measures to protect your personal data:

  • Encryption of data in transit and at rest
  • Secure password protection and access controls
  • Restricted employee access on a need-to-know basis
  • Regular security audits and updates
  • Incident response procedures with notification within 72 hours of discovering a data breach

8. Your Rights Under GDPR

As a data subject, you have the following rights:

  • Right of Access: Request a copy of the personal data we hold about you
  • Right to Rectification: Request correction of inaccurate or incomplete data
  • Right to Erasure: Request deletion of your personal data ("right to be forgotten")
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Restrict Processing: Request limitation of how we process your data
  • Right to Object: Object to processing based on legitimate interests or for direct marketing
  • Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
  • Right to Lodge a Complaint: File a complaint with your local data protection authority

To exercise any of these rights, please contact us at contact@protosoft.co. We will respond within 30 days of your request.

9. Data Deletion

To request deletion of your data:

  1. Uninstall the Schedule4Later app from your Google Workspace
  2. Send an email to contact@protosoft.co with your deletion request
  3. We will confirm completion of data deletion within 15 days

10. Google API Services

Schedule4Later's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google API scopes we request & why

  • https://www.googleapis.com/auth/chat.messages – Required for our scheduler worker to post the exact content you authored in the Google Chat space you selected.
  • https://www.googleapis.com/auth/chat.memberships.readonly – Used to confirm that you still belong to the destination space and to display the human-readable space name inside /schedule list.
  • https://www.googleapis.com/auth/chat.bot (service account) – Powers our bot identity so it can receive slash commands and retrieve Google Chat metadata. No user-generated content leaves Google through this scope.

Limited Use & AI/ML commitments

  • Google Workspace data is only used to provide user-facing scheduling features or to secure the service. We never sell or use it for advertising.
  • Human access occurs solely with your explicit approval for support or where required by law.
  • We do not use or transfer Google API data to develop, improve, or train generalized AI/ML models, nor do we send your messages to Gemini, LLMs, or other AI services.

Data lifecycle for Google API data

  • OAuth tokens are encrypted with AES-256-GCM using our AUTH_ENCRYPTION_KEY secret before being stored in PostgreSQL.
  • Scheduled message content is encrypted with AES-256-GCM (`MESSAGE_ENCRYPTION_KEY`), stored only until delivery plus 24 hours for retries, then deleted automatically or immediately upon uninstall.
  • Revoking access through Google Account permissions or contacting contact@protosoft.co triggers deletion of the remaining encrypted tokens and message metadata.

11. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

12. Children's Privacy

Schedule4Later is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on our website and updating the "Last updated" date. Your continued use of Schedule4Later after changes take effect constitutes acceptance of the revised policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: