Privacy Policy

Customers do not create an account or log in to uTime. When making an appointment, a customer may provide the following information:

• Name
• Phone number
• Email address
• Appointment-related information, such as the selected service, the selected professional, the appointment date and time, and the appointment status

This information is used to: create and manage appointments; allow the business or professional to provide the requested service; send transactional communications related to the appointment, including confirmations, reminders, changes, or cancellations; and handle issues related to the appointment (for example, a rescheduling request or a complaint about the service provided).

In the current version of uTime, customer data is not used for marketing purposes. uTime does not sell customers' personal data to third parties, and does not use appointment or customer data for advertising or marketing purposes in the current version of the service.

To allow businesses and professionals to use uTime, we collect and process the information necessary to:

• Create and manage their account
• Identify and manage the business (for example, name, address, contact details, and the information shown on the business's public page)
• Configure the services offered
• Manage professionals and team members
• Manage schedules and appointments
• Use optional functionality, such as inventory management

In connection with providing a booked service, businesses and professionals may access customer information that is necessary to provide and manage that service — namely name, contact details, and appointment details. uTime does not currently provide businesses with the ability to export or directly edit customer data; access is limited to viewing the information needed to manage appointments.

uTime offers an OPTIONAL Google Calendar integration. This integration is only enabled if a professional explicitly chooses to connect it, through an authorization granted via Google OAuth.

Once authorization is granted, uTime uses it solely to create, update, and delete events on the professional's Google Calendar corresponding to appointments made through uTime. This integration is one-way: uTime → Google Calendar.

uTime does not import, copy, or store the professional's existing personal Google Calendar events in its database. The system retains only the technical identifiers strictly necessary to maintain the relationship between a uTime appointment and its corresponding Google Calendar event, namely the Google Calendar ID and the Google Event ID.

Google Calendar data is accessed and processed solely to provide the integration requested by the professional, in accordance with Google's API Services User Data Policy, including its Limited Use requirements. Information obtained through the Google API is not used for any purpose other than those described here, and is not shared with third parties except as necessary to provide or improve the requested functionality itself, to comply with applicable legal obligations, or in connection with a merger, acquisition, or sale of assets, always in accordance with Google's policy.

uTime uses a third-party email provider to send transactional communications related to appointments, namely:

• Appointment confirmations
• Appointment reminders
• Appointment changes
• Appointment cancellations
• Other operational communications directly related to the appointment

These communications are transactional and service-related, and are necessary for the appointment to function properly. They are not marketing communications.

uTime's current infrastructure includes a primary database hosted in Ireland / the European Union, application and server processing configured in Dublin, Ireland, and email sending configured for the Ireland region.

Not all data processed by uTime is, however, stored exclusively within the European Union. Some of the third-party providers uTime uses may process or store certain information outside the EU, including in the United States. When this occurs, uTime seeks to ensure that such international transfers are accompanied by appropriate legal safeguards, such as Standard Contractual Clauses approved by the European Commission or other recognized transfer mechanisms under the GDPR.

The application may generate technical error logs required for operation, fault detection, and troubleshooting.

uTime does not currently intentionally operate any behavioral analytics, advertising tracking, marketing pixels, dedicated analytics platforms (such as, for example, Sentry, PostHog, Datadog, or Vercel Analytics), or similar user-tracking or monitoring services.

The platform may use cookies or similar technologies that are strictly necessary for its technical operation — for example, to maintain the authentication session of businesses and professionals who log in to the management dashboard. These technologies are not used for advertising or profiling purposes.

In the current version (Beta), uTime does not process payments through the platform. Any payment for the service provided is agreed upon and made directly between the customer and the business or professional, outside of uTime.

The current version of uTime does not use customers' appointment data for marketing purposes. There are currently no marketing newsletters, promotional campaigns based on appointment data, advertising profiling, or marketing communications directed at customers.

If marketing functionality is introduced in the future, the relevant privacy notices and consent or objection mechanisms will be updated accordingly, and data subjects will be duly informed before such functionality takes effect.

Different personal data processing activities carried out by uTime may rely on different legal bases under the GDPR, depending on the purpose involved.

For processing related to appointments (for example, creating and managing the appointment and sending associated transactional communications), the applicable legal basis will generally be the performance of a contract or steps taken at the customer's own request prior to entering into a contract.

Other processing may be based on compliance with a legal obligation to which uTime is subject, the legitimate interest of uTime or third parties (for example, to ensure the security of the platform), or the data subject's consent, in cases where consent is genuinely required. Consent is not the legal basis for all processing carried out by uTime.

The relationship between uTime and businesses/professionals regarding their classification as data controller or processor depends on the specific processing activity involved, so this policy does not make a single, absolute classification applicable to every situation.

In general, the business or professional will be responsible for determining the purposes of processing their customers' data in connection with providing their services (for example, deciding which appointments to accept and how to communicate with their customers), while uTime processes that information to provide the platform and its features.

uTime also acts as a data controller with respect to data it processes for its own legitimate platform and business purposes, such as managing business and professional accounts, ensuring the security and proper functioning of the service, and complying with its own legal obligations.

uTime does not sell personal data to third parties. Personal information may be shared in the following circumstances: with the business or professional with whom the customer booked the appointment, to the extent necessary to provide the service; with third-party providers that support the platform's technical operation (namely hosting infrastructure and email delivery), acting on behalf of and under the instructions of uTime; with Google, within and only to the extent of the optional Google Calendar integration enabled by the professional; or where required by law, court order, or a competent authority.

Personal data is retained only for as long as necessary to: provide the service; manage appointments; comply with applicable legal obligations; resolve any disputes; and protect the platform and its users.

This policy does not set fixed, universal retention periods, as these may vary depending on the type of data and the purpose of the processing involved.

uTime adopts reasonable technical and organizational measures to protect the personal data it processes, including:

• Access controls over information
• Authentication and authorization mechanisms
• Encryption of data in transit, via HTTPS
• Database-level security controls
• Secure handling of credentials and OAuth authorization tokens (such as those used in the Google Calendar integration)
• Restricting access to personal data to the personnel and systems that need it
• Use of specialized, market-recognized infrastructure providers

No system is entirely immune to failures or security incidents. While uTime makes reasonable efforts to protect personal data, it is not possible to guarantee that your data will always be, and remain, completely secure.

As a data subject, you have the following rights, subject to the terms and limits set out in the GDPR:

• Right of access to your personal data
• Right to rectification of inaccurate or incomplete data
• Right to erasure of your data (“right to be forgotten”)
• Right to restriction of processing
• Right to object to processing
• Right to data portability, where applicable
• Right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal
• Right to lodge a complaint with the competent supervisory authority

In Portugal, the competent supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD — the National Data Protection Commission), with information available at www.cnpd.pt.

To exercise any of these rights, you can contact us using the contact details listed in the “Contact Us” section below.

Because customers do not have an account on uTime, we provide a direct method for requesting the deletion of your personal data: through the contact details listed in the “Contact Us” section of this policy.

For security reasons, we may need to verify the identity of the person requesting deletion, to ensure the request is made by the data subject themselves or by someone legally authorized to act on their behalf.

Data will be deleted whenever this is legally possible. However, some information may need to be retained where required by law (for example, due to tax or accounting obligations applicable to the business the appointment was made with) or where another valid legal basis justifies its retention. In these cases, the complete and immediate deletion of all data may not be possible in every circumstance.

This Privacy Policy may be updated periodically, in particular to reflect changes to uTime's functionality, applicable law, or data processing practices. The “Last updated” date shown at the top of this page will always be revised when this happens. In the event of material changes, we will seek to inform users appropriately, through the platform or another suitable means of communication.

The entity responsible for uTime is as follows:

• Legal entity: uTime
• General contact: [email protected]
• Data protection / privacy contact: [email protected]
• Last updated: September 11, 2026

If you have questions about this Privacy Policy, about how we handle your personal data, or wish to exercise any of the rights described above, including requesting the deletion of your data, please contact us at [email protected].