Privacy policy

Who we are

Peak Scheduler is meeting-scheduling software operated by TopOut Group ("we", "us"). It is sold to businesses, and each customer gets its own workspace. This policy covers the Peak Scheduler application at app.peakscheduler.net, its browser extension, its HubSpot app and its Zoom integration.

Two different groups of people appear in this policy, and the distinction matters:

• Our customers — the businesses that license Peak Scheduler, and the sales reps and administrators who log in to it. For their data we are the data controller.
• Our customers' invitees — the prospects and contacts who book a meeting through a customer's booking page. For their data we act as a data processor on that customer's instructions. If you booked a meeting and want your information removed, the fastest route is the company you booked with; you can also contact us and we will pass the request on.

What we collect

From people who log in

• Name, work email address, and role within the workspace.
• Workspace settings, branding and meeting-type configuration.
• Access and refresh tokens for the services an account holder connects — Microsoft 365, HubSpot and Zoom. These are encrypted at rest and are never displayed back, logged, or included in any API response.
• Standard server logs: IP address, user agent, timestamps and the URL requested.

From people who book a meeting

• Name and email address.
• Phone number, time zone and any notes, where the booking form asks for them.
• The meeting itself: date, time, duration, meeting type and the chosen location.

From connected services

• Microsoft 365 — free/busy availability and calendar events for the reps who connect their mailbox, so the booking page only ever offers times that are genuinely free. We create, update and delete the calendar events for bookings made through Peak Scheduler.
• HubSpot — contact records, so an inbound prospect can be matched to their existing owner, and so a booked meeting is written back to the CRM.
• Zoom — described in its own section below.

Zoom integration

This section is the complete account of our use of Zoom data. It applies whether a workspace connects Zoom per rep or connects one account-level Zoom app for the whole workspace.

What we access

• Your Zoom profile — user ID, account ID and the email address on the Zoom account. We use these to identify which Zoom user a meeting should be created for, and to show you which account is connected on the Integrations page.
• Meetings we create — we create, update and delete Zoom meetings that correspond to bookings made in Peak Scheduler. We store the Zoom meeting ID and the join URL against the booking.

What we do not access

• Recordings, transcripts, or any meeting content.
• Webinars, registrants, or reports.
• Meetings that Peak Scheduler did not create.
• The meeting host's start URL. It grants host control, so we never request it, never store it and never return it.

How it is stored and shared

Zoom OAuth tokens are encrypted at rest. The meeting ID and join URL are stored on the booking record. The join URL is shared exactly as a meeting link has to be: with the invitee and the host, in the confirmation and reminder emails, in the calendar invitation and its .ics attachment, and — if the workspace has connected HubSpot — on the meeting record written back to the CRM.

How to revoke access and delete the data

Either of these removes our access and deletes the stored connection:

• In Peak Scheduler, open Integrations and disconnect Zoom.
• In Zoom, open Settings → Installed Apps (or the Zoom App Marketplace → Manage → Installed Apps), find Peak Scheduler and click Remove. Zoom notifies us and we delete the stored credentials for that connection automatically.

Either route deletes the OAuth tokens and the connection record. Zoom meetings that were already created remain in your Zoom account and under your control — we no longer have access to change or delete them. Bookings already made keep working; new bookings fall back to Microsoft Teams rather than failing.

Why we are allowed to process it

For account holders, we process data to perform the contract we have with their employer, and on the basis of our legitimate interest in keeping the service secure and working. For invitees, we process on the instructions of the customer they booked with, who is responsible for having its own lawful basis.

Who we share it with

We do not sell personal data, and we do not use it for advertising. We share it only with the services required to run Peak Scheduler:

• Microsoft — calendar availability, and the calendar events we create.
• HubSpot — contact lookup and meeting writeback, for workspaces that connect it.
• Zoom — meeting creation, for workspaces that connect it.
• Cloudflare — DNS, TLS and traffic proxying.
• Resend — delivery of transactional email, such as booking confirmations and reminders.
• Our hosting and database provider, which stores the application data.

We will also disclose data where the law requires it.

How long we keep it

• Booking and workspace data — for as long as the workspace is active. When a workspace is closed, its data is deleted within 90 days.
• OAuth tokens — until the connection is disconnected or revoked, at which point they are deleted.
• Server logs — a rolling short retention window for security and debugging, then discarded.

How it is protected

• All traffic is served over TLS.
• Third-party credentials are encrypted at rest with application-level encryption, in addition to storage encryption, and are excluded from logs and API responses.
• Each workspace's data is scoped to that workspace at the query level, so one customer cannot read another's records.
• Access to production data is limited to the people who need it to operate the service.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to or restrict how it is used. Write to us at the address below and we will respond. If you are an invitee rather than an account holder, see the note at the top of this policy about contacting the company you booked with.

International transfers

We and the providers listed above may process data in countries other than your own, including the United States. Where required, transfers rely on the appropriate safeguards offered by those providers.

Children

Peak Scheduler is a business product and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes to this policy

We will update this page when the service changes, and the date at the top will change with it. Material changes will be notified to workspace administrators by email.

Contact

Questions, requests and complaints: [email protected].