Privacy Policy

1. Scope and responsibilities

This policy applies to the ArrangeMore website, accounts, workspaces and integrations. ArrangeMore provides scheduling and operations software to studios, tutors and training organisations. Each organisation controls the instructor, student and family records it enters and decides why those records are used. ArrangeMore processes that workspace data to provide the service and on the organisation's instructions.

Organisations are responsible for giving their own participants appropriate privacy notices, obtaining any consent they require and managing which authorised staff can access their workspace.

2. Information we collect

Account and organisation data. We collect names, email addresses, password hashes, verification and security records, organisation details, workspace roles, settings and support requests.

Scheduling and participant data. An organisation may enter instructor profiles, contact details, pay rates and availability; student and parent or guardian details; rooms, course types, lesson dates, attendance, notes, reminder preferences and payroll records.

Billing and communications data. We receive plan, invoice, subscription and transaction status from payment providers, but do not store complete card numbers. Email and SMS providers may return recipient, delivery, failure and usage information.

Technical and usage data. We may process IP address, browser and device information, requested pages, timestamps, cookie identifiers, diagnostic information and security events to operate, protect and improve the service.

3. How we use information

We use information to create and secure accounts; provide schedules, records, reminders, calendar synchronisation and payroll reports; administer trials, subscriptions and invoices; respond to support requests; monitor reliability; prevent fraud or misuse; enforce our terms; and comply with legal obligations.

We do not sell personal information. We do not use student, family or Google user data for targeted or behavioural advertising.

4. Google Calendar integration

Google Calendar connection is optional. An instructor follows an authorisation link, signs in to Google, reviews Google's consent screen and chooses whether to grant access. The instructor can then select a writable calendar. ArrangeMore requests only these Google permissions:

• OpenID and email: to identify the Google account that authorised the connection.
• View calendar list: to display calendars the account can write to, including calendar name, identifier, time zone, access role and display information.
• Manage calendar events: to create, update and delete ArrangeMore lesson events in the selected calendar.

Synced events may contain the course type, student and instructor names, room or location, lesson date and time, and lesson notes entered by the organisation. ArrangeMore stores the connected Google account email, selected calendar details, connection time, encrypted OAuth refresh token and identifiers for events created by ArrangeMore. We do not request access to Google contacts, Gmail or Google Drive.

Calendar information is used only to let the instructor select a calendar and to keep authorised lesson events synchronised. It is not used to build advertising profiles, determine creditworthiness or train general-purpose artificial intelligence models.

5. Google data sharing and Limited Use

We do not sell Google user data or transfer it to data brokers or advertising platforms. We disclose it only to infrastructure providers acting for us where necessary to operate and secure the integration, when the user directs or consents to a disclosure, or when required for security or by law. Human access is limited to cases where the user has given permission, where access is needed to investigate abuse or a technical problem, or where law requires it.

ArrangeMore's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Other sharing and service providers

Workspace information is visible to authorised members of the relevant organisation according to their role. We share only information reasonably needed with providers that host the application and database, deliver email or SMS, provide analytics and diagnostics, process payments or support calendar connections. Current providers may include Vercel, Google, Stripe, Resend and ClickSend.

We may also disclose information to professional advisers, regulators, courts or authorities where reasonably necessary or legally required. Providers may process information in Australia, the United States or other countries in which they operate.

7. Children and family information

Education and training organisations may serve children. An organisation should collect only information reasonably needed to manage teaching, tell parents or guardians how it will be used and obtain consent where required. Children should not create a workspace account without a parent, guardian or authorised organisation representative. Requests concerning a student record should normally be made to the organisation that entered it.

8. Security

We use encrypted network connections, password hashing, role-based access controls, tenant separation, protected sessions, rate limits and operational monitoring. Google OAuth refresh tokens are encrypted before storage. Access to production systems is restricted to authorised personnel and service providers that need it to perform their duties.

No online service can guarantee absolute security. Users should choose strong, unique passwords, protect their devices and promptly report suspected unauthorised access.

9. Retention and deletion

We retain account and workspace information while the service is active and afterwards only as reasonably necessary for recovery, security, billing, dispute resolution or legal compliance. When no longer required, information is deleted or de-identified, subject to limited backup and legal retention periods.

A workspace administrator can disconnect an instructor's Google Calendar from the instructor settings. ArrangeMore then removes the stored Google token, connected account and calendar details, attempts to delete events it created and asks Google to revoke the token. If Google access has already expired, some events may need to be removed manually. Deleting an eligible instructor record also revokes and removes its stored Google authorisation.

10. Your choices and requests

Account holders can update core account and workspace information in Settings. Students, parents and instructors should ask their organisation to access, correct or delete workspace records because that organisation controls them. For ArrangeMore account, privacy or deletion requests, use our Support page or contact form. We may verify identity and may retain information where required by law.

Google access can also be reviewed or revoked at any time from the Google Account permissions page. Revoking access stops future synchronisation but does not automatically remove events already present in a calendar.

11. Cookies, analytics and communications

We use essential cookies for sign-in, security, Google Calendar connection and workspace selection. We also use Google Analytics and Vercel Analytics or Speed Insights to understand website usage, performance and reliability. These services may process device, browser, page, approximate location and interaction information according to their own privacy terms. We do not use third-party advertising cookies.

Transactional communications may include verification codes, reminders, billing notices, calendar invitations and support replies. Organisations are responsible for ensuring recipients reasonably expect their reminders and can update their communication details.

12. Contact, complaints and policy changes

ArrangeMore operates from New South Wales, Australia. Send privacy questions, complaints or requests through our Support page or contact form. We will review the request, may ask for information needed to verify identity and will explain the outcome. If an Australian privacy complaint remains unresolved, you may be able to contact the Office of the Australian Information Commissioner.

We may update this policy when our service, providers or legal obligations change. Material changes will be posted here with an updated effective date.