Privacy Policy

This policy explains what personal data neosfy collects, why, who it is shared with and the rights you have over it. It applies to the website neosfy.com, the dashboard at app.neosfy.com, booking pages and the neosfy MCP server. It is written to meet Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and the EU and UK General Data Protection Regulation (GDPR).

Who we are

neosfy is a scheduling service operated from Brazil, which is the controller of the personal data described here.

For anything about privacy, including our data protection officer (encarregado), write to hello@neosfy.com.

The data we collect

Your account

When you sign up we receive your email address and a sign-in identifier from Clerk, the service that handles sign-in. We store your public handle, time zone, language, availability rules and booking links.

Connected calendars

When you connect a Google, Microsoft or Zoho account we store the account's email address, the names of its calendars, which ones count as busy, the permissions you granted and a refresh token. The refresh token is encrypted (see "Security").

We do not keep a copy of your calendar. Events are read from your provider each time availability is checked and are used to work out busy time, then discarded; slots shown on a booking page are cached in memory for up to 60 seconds. When an agent or a booking creates an event, the result of that request is kept so a retried request does not book twice, and it is deleted with your account.

Bookings

When someone books time with you, the name, email address and note they enter are written into the event on your calendar, and your calendar provider sends them the invitation. We do not keep a list of the people who book with you. To enforce booking limits and keep an audit trail we store the domain of their email address and a keyed hash of the address, never the address itself.

Agent keys

Keys you create for AI agents are stored only as a hash, with their label, scope and the time they were last used. We keep an audit log of actions taken in your account (who acted, what, and whether it succeeded).

Billing

Payments are handled by Stripe. We never see or store your card number. We keep the Stripe customer and subscription identifiers, your plan and its dates.

The website

neosfy.com measures how the site is used with Google Analytics, loaded through Google Tag Manager, only if you accept analytics cookies in the consent banner. Without that consent no analytics cookie is set. You can change your choice at any time from the "Privacy settings" link on the site.

Google user data

When you connect a Google account, neosfy requests your email address and access to Google Calendar. We use calendar access only to read your events so we can compute your availability, and to create, update and cancel the events you, your booking pages or your agents ask for. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI or machine-learning models, and nobody at neosfy reads it unless you ask us to for support, it is needed for security, or the law requires it.

neosfy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft accounts are connected read-only: we read events to compute availability and never write to them. Zoho accounts are used the same way as Google accounts.

Why we use it, and on what legal basis

• To provide the service (performance of a contract; LGPD art. 7, V; GDPR art. 6(1)(b)): your account, calendar connections, bookings, agent keys and billing.
• To keep it safe and working (legitimate interests; LGPD art. 7, IX; GDPR art. 6(1)(f)): audit logs, rate limits, booking limits and preventing abuse.
• To measure the website (consent; LGPD art. 7, I; GDPR art. 6(1)(a)): Google Analytics, only after you opt in.
• To meet legal obligations (LGPD art. 7, II; GDPR art. 6(1)(c)): tax and accounting records of payments.

Who we share it with

We do not sell personal data. We share it only with the providers that run the service:

• Clerk, for sign-in and account sessions.
• Stripe, for payments and subscriptions.
• Google, Microsoft and Zoho, the calendar providers you connect, which receive the events and invitations you ask us to create.
• Vercel, which hosts the website.
• Google Analytics, for website measurement, only with your consent.

We may also disclose data when the law or a court order requires it, or to protect the rights and safety of our users and of neosfy.

International transfers

Some of these providers process data outside Brazil and outside your country, mainly in the United States. Where that happens we rely on the safeguards the law provides, such as standard contractual clauses, and on the providers' own data protection commitments.

Security

Calendar tokens are encrypted with AES-256-GCM using a separate key per account, and those keys are themselves encrypted by a master key held in a dedicated key service. Agent keys are stored only as hashes. Data travels over HTTPS. No system is perfectly secure; if a breach affects your data we will tell you and the competent authority as the law requires.

How long we keep it

• While your account exists, we keep the data described above.
• When you delete your account in the dashboard, it is erased at once: we cancel your subscription, revoke our access to your Google and Zoho accounts and delete your calendars, tokens, keys, booking links, settings and audit log. There is no undo.
• When a trial or subscription ends and is not renewed, your account data is erased 30 days later in the same way.
• Billing records (Stripe identifiers, plan and dates) are kept for as long as tax and accounting law requires.

Microsoft offers no way for an app to give up its access, so after deleting your account remove neosfy from your Microsoft account's app permissions. You can also remove neosfy's access to Google at any time from your Google Account's security settings.

Your rights

Under the LGPD and the GDPR you can ask us to confirm whether we process your data, give you access to it or a copy of it, correct it, delete it, restrict or object to its processing, and tell you who we share it with. Where we rely on your consent you can withdraw it at any time. Write to hello@neosfy.com; we answer within 15 days.

You can also complain to Brazil's data protection authority (ANPD) or, in the EU or UK, to your local data protection authority.

If you booked time with a neosfy user, your details live in that person's calendar: they decide how to use them, and you can ask them, or us, to help.

Cookies

• neosfy.com stores your consent choice and, only if you accept analytics, Google Analytics cookies.
• The dashboard uses Clerk's cookies to keep you signed in and a NEXT_LOCALE cookie to remember your language. Both are necessary for it to work.
• Booking pages set no cookies.

Children

neosfy is not meant for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

When we change this policy we update the date at the top. If a change materially affects how we use your data, we tell account holders by email before it takes effect.

Contact

Questions or requests about your data: hello@neosfy.com. See also our Terms of Service.