Privacy Policy

1. Who We Are

Appointment Lite is a scheduling and service management application for SHOPLINE merchants. It enables product appointments, standalone bookings, paid bookings, post-purchase scheduling, staff availability, service locations, notifications, and Google Calendar synchronization.

2. Information We May Process

2.1 SHOPLINE Store Information

When a merchant installs and authorizes Appointment Lite, we may receive the store name, SHOPLINE store ID, store domain, language, timezone, market or basic store configuration, app authorization status, and authorization information necessary to operate the App.

We use this information to identify the merchant store, load the appropriate booking configuration, and operate Appointment Lite.

2.2 SHOPLINE Product Information

When a merchant connects an appointment service to a SHOPLINE product, we may process product IDs, product titles, variant or SKU identifiers, product status, and other basic product information required to maintain the service relationship.

2.3 SHOPLINE Order Information

For services involving purchases, payments, or post-purchase scheduling, we may process authorized order information including SHOPLINE order ID, order status, payment status, order creation time, customer name, customer email, relevant line items, appointment-related metadata, and shipping or customer address when required by the service.

This information is used to determine booking eligibility, synchronize order lifecycle status, verify payment status, and associate appointments with the appropriate SHOPLINE order. Appointment Lite does not modify or delete SHOPLINE orders as part of normal appointment functionality.

2.4 Customer Booking Information

When a customer submits a booking, we may process name, email address, phone number when enabled, customer notes when enabled, service address when required, selected service, appointment date and time, timezone, staff member, service location, booking status, payment and order relationship status, and booking creation, rescheduling, cancellation, or related activity.

2.5 Staff Information

If a merchant uses staff management, we may process staff names, email addresses, avatars, working hours, special availability, service assignments, and notification preferences to calculate availability, assign appointments, and send booking notifications.

2.6 Location Information

When SHOPLINE Locations or custom locations are used, we may process SHOPLINE Location IDs, location names, addresses, and the location configuration selected for an appointment service.

2.7 Google Calendar Information

Google Calendar is optional. Appointment Lite accesses Google Calendar only after a merchant initiates the connection and completes Google OAuth authorization. The App requests only these scopes: https://www.googleapis.com/auth/calendar.calendarlist.readonly and https://www.googleapis.com/auth/calendar.events.owned.

The calendar-list scope is used to retrieve calendars owned by the connected Google account, including each calendar ID, display name, primary-calendar status, and time zone. The events scope is used to create, update, and delete Appointment Lite booking events in the merchant-selected calendar. Although the scope technically permits access to events on owned calendars, the current App uses it only for the create, update, and delete operations needed for its own booking events; it does not use the Google Calendar API to list, search, or read the contents of existing calendar events.

When a booking is synchronized, its event may contain the service title, appointment date and time and time zone, customer name, email address and phone number when provided, staff name, service location, online meeting URL when configured, and booking reference. These details may appear in the event title, description, or location. The current integration does not add customers as event attendees or send Google Calendar invitations.

Appointment Lite stores the selected calendar ID, display name and time zone, granted scope names, event IDs, and synchronization status associated with the relevant booking records in the application database. The Google OAuth refresh token is encrypted with AES-256-GCM before it is stored. Short-lived access tokens are used to make Google API requests and are not stored as persistent database records.

When a merchant disconnects Google Calendar, Appointment Lite requests Google token revocation and deletes the local calendar connection, including the stored refresh token. Disconnecting does not automatically delete events previously created in the merchant’s Google Calendar; those events remain there until the merchant deletes them in Google Calendar. If a booking is cancelled or removed while the connection is active, Appointment Lite’s synchronization process may delete the corresponding event.

Google Calendar data is used only to provide the merchant-requested appointment synchronization feature. We do not sell Google user data, use it for advertising, or use it to train generalized AI or machine-learning models. Our access, use, storage, and transfer of Google user data follow the Google API Services User Data Policy, including its Limited Use requirements.

3. How We Use Information

We may use information to:

• Provide and operate Appointment Lite;
• Create and manage appointment services and available dates and times;
• Manage staff schedules and service locations;
• Associate bookings with SHOPLINE products and orders and determine order or payment status;
• Manage post-purchase booking eligibility;
• Send booking confirmations, updates, cancellations, reminders, staff notices, and private post-purchase booking links;
• Create, update, or remove Google Calendar events;
• Display booking records and order lifecycle information;
• Prevent duplicate appointments and scheduling conflicts;
• Provide rescheduling and cancellation functionality;
• Diagnose errors, maintain reliability, and prevent fraud, abuse, or unauthorized access;
• Respond to merchant support requests.

We do not sell merchant or customer personal information.

4. Booking Emails

Appointment Lite may send transactional emails on behalf of merchants, including booking confirmations, updates, cancellation notifications, appointment reminders, staff assignment notifications, and private post-purchase scheduling links.

These communications are used only to provide appointment-related services. Appointment Lite does not use customer booking email addresses for unrelated marketing communications unless separately authorized as required by applicable law.

5. Sharing of Information

We do not sell, rent, or trade merchant or customer personal information. To operate Appointment Lite, information may be processed by service providers in categories including:

• SHOPLINE;
• Cloud hosting providers;
• Database infrastructure providers;
• Transactional email providers;
• Google Calendar and Google OAuth;
• Security, monitoring, and infrastructure providers.

These providers process information only as necessary to deliver their services. We may also disclose information when required by applicable law, a valid legal request, court order, or regulatory obligation.

6. Data Security

We use reasonable technical and organizational safeguards designed to protect information, including HTTPS encryption in transit, authentication and authorization for protected operations, and limiting unnecessary data access. Google Calendar refresh tokens are encrypted with AES-256-GCM before they are stored in the application database. Short-lived access tokens used to call Google APIs are not stored as persistent records.

However, no Internet transmission or electronic storage system can be guaranteed to be completely secure.

7. Data Retention

Google Calendar refresh tokens and local calendar connection details are retained only while the merchant keeps the integration connected. When the merchant disconnects the integration, Appointment Lite requests token revocation and deletes the local calendar connection record, including the stored refresh token.

Google Calendar Event IDs and synchronization status associated with a booking are retained as part of that booking record and follow the retention rules for booking data. Disconnecting does not delete events already written to Google Calendar; the merchant must delete those events directly in Google Calendar. Other booking and order-related information is retained only for as long as reasonably necessary to provide Appointment Lite, resolve disputes, maintain security, or comply with applicable legal obligations. Data deletion requests can be sent to the email address listed in the “Contact Us” section of this policy.

8. App Uninstallation

When a merchant uninstalls Appointment Lite from SHOPLINE:

• Appointment Lite will no longer be able to use the store's previous active authorization to access new SHOPLINE information;
• Appointment Lite storefront booking functionality will stop operating;
• External connections such as Google Calendar may be disabled or become inactive;
• Certain historical booking or operational records may remain for a reasonable period for recovery, security, dispute resolution, or legal purposes.

Merchants may request deletion of applicable data associated with their store through the official support contact shown on this page.

9. Privacy Rights

Depending on applicable privacy laws, individuals may have rights to request access, correct inaccurate information, request deletion, restrict certain processing, obtain a portable copy of applicable data, withdraw consent, or object to certain processing.

Customers should generally contact the SHOPLINE merchant with whom they made the booking first. For requests involving information processed directly by Appointment Lite, use the official support contact shown on this page.

10. Merchant Responsibilities

SHOPLINE merchants using Appointment Lite generally determine how customer booking information is collected and used. Merchants are responsible for complying with applicable privacy laws, maintaining an appropriate store privacy policy, informing customers what booking information is collected, collecting only information reasonably necessary for their services, lawfully using customer contact and appointment information, and configuring booking fields and notifications appropriately.

Appointment Lite provides scheduling technology but does not replace a merchant's own privacy and compliance obligations.

11. Children's Privacy

Appointment Lite is not specifically designed for children. Merchants are responsible for determining whether minors may use their services and obtaining parental or guardian consent where required by applicable law.

12. International Data Processing

Depending on the locations of merchants, customers, and service infrastructure, information may be processed in countries or regions outside the customer's jurisdiction. Where applicable, reasonable safeguards are used to protect information processed internationally.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes to Appointment Lite, legal requirements, or our data processing practices. The updated policy will be published on this page with a revised “Last updated” date. If a change materially affects users' privacy rights, we may provide additional notice to merchants where appropriate.

14. Contact Us

For questions about this Privacy Policy, Appointment Lite's data practices, or data deletion requests, please contact us through the following official support channel: