This policy explains how Appoint by Vulcan collects, uses, and protects personal data — both for the professionals who use our platform to manage their scheduling and for the people who book time with them.
Vulcan Apps operates Appoint by Vulcan at appoint.byvulcan.com, an online scheduling platform that allows professionals ("Hosts") to create booking pages and manage appointments. Appoint is part of the By Vulcan product ecosystem at byvulcan.com.
For inquiries: privacidade@byvulcan.com
| Category | Examples | Purpose |
|---|---|---|
| Identity | Name, email, password (hashed) | Authentication and account management |
| Profile & Branding | Brand name, logo, color palette, slug | Personalizing your public booking page |
| Availability | Weekday rules, buffer times, timezone | Computing available booking slots |
| Calendar credentials | Google OAuth tokens (encrypted AES-256) | Reading busy times and creating calendar events |
| Payment | Subscription plan, transaction reference (no card data) | Billing and plan management |
| Service usage | Event types created, bookings confirmed, features used | Analytics, product improvement, support |
| Device & network | IP address, browser, operating system | Security and fraud prevention |
| Category | Examples | Purpose |
|---|---|---|
| Contact | Full name, email address, WhatsApp number | Booking confirmation, reminders, cancellation |
| Scheduling | Chosen date/time, timezone, duration | Creating and managing the appointment |
| Custom form answers | Responses to Host-configured questions | Providing context to the Host before the meeting |
| LGPD consent | Timestamp and acceptance of data processing terms | Legal basis documentation |
| Cancellation & reschedule tokens | Secure one-use tokens embedded in emails | Allowing self-service changes without authentication |
When a Host activates Smart Routing, Invitees answer a pre-booking qualification form before selecting a time slot. This data includes:
At the moment of booking, Appoint computes a rule-based no-show risk score using: lead time, day of week, hour of day, the Invitee's historical cancellation rate, and booking source. This score informs Hosts and may trigger additional reminders. No automated legal decisions are made from this score (LGPD Art. 20 / GDPR Art. 22).
If the Host connects a compatible meeting intelligence tool, meeting transcripts may be sent to Appoint via a secure webhook. Appoint uses Google Gemini Flash to extract summaries, action items, key topics, and sentiment — stored linked to the booking and accessible only to the Host.
| Legal Basis | Applies to |
|---|---|
| Contract performance | All data necessary to provide the scheduling service to Hosts and Invitees |
| Consent | Invitee LGPD consent collected at booking; marketing emails to Hosts; optional analytics |
| Legitimate interests | Security monitoring, fraud prevention, no-show risk scoring, product analytics |
| Legal obligation | Tax, accounting, and regulatory compliance obligations |
When a Host connects their Google account, Appoint requests the following OAuth scopes — shown in Google's consent screen at the time of connection, never at login:
https://www.googleapis.com/auth/calendar.events — to create and update meeting events in the Host's and Invitee's calendars.https://www.googleapis.com/auth/tasks — to export action items from meeting summaries as Google Tasks.OAuth tokens are stored encrypted (AES-256-GCM) and never shared with third parties. Access can be revoked at any time from Settings → Calendar or directly from your Google Account permissions page.
Appoint sends transactional notifications to Invitees who provide a phone number at booking:
WhatsApp messages are sent via Z-API (primary) or Twilio (fallback). Email is sent via Amazon SES. These are operational messages and cannot be opted out of while a booking is active.
Your data is not sold to third parties. We share data only with the following subprocessors:
| Recipient | Purpose | Data shared |
|---|---|---|
| Paddle / Asaas | Payment processing | Host billing info, subscription status |
| Supabase | Database and authentication | All structured data (stored in your project region) |
| Cloudflare R2 | Asset storage | Host-uploaded files (logos, brand images) |
| Google APIs | Calendar sync, Tasks, AI (Gemini) | Calendar events; Smart Routing and Summary text via Gemini Flash API |
| Anthropic | Fallback AI (Claude Haiku) | Logo generation prompts only — no booking or personal data |
| Amazon SES | Email delivery | Invitee email, name, booking details |
| Z-API / Twilio | WhatsApp delivery | Invitee phone number, booking date/time |
| Upstash | Rate limiting and job queue | Booking ID and scheduled send time only |
| Meeting Intelligence (opt-in) | Meeting transcript processing (when enabled) | Booking ID, transcript text, summary output |
| Legal authorities | Legal compliance | Only as legally required |
Appoint supports an optional integration with compatible meeting intelligence tools within the By Vulcan ecosystem. When enabled, the integration shares the same infrastructure, privacy governance, and DPO.
Public booking pages use only essential cookies required to process the booking flow.
Incident notification: In the event of a personal data breach, we will notify affected Hosts and relevant authorities within: 72 hours (GDPR), per ANPD guidance (LGPD), per applicable law.
| Data type | Retention period |
|---|---|
| Host account and profile data | While active; deleted within 30 days of account closure |
| Booking records (Invitee data) | Duration of Host account; deleted on account closure or explicit request |
| Smart Routing responses | Linked to booking record; deleted with the booking |
| Meeting summaries & transcripts | Linked to booking; Hosts may delete individually |
| Payment and billing records | Up to 5 years (Brazilian tax law; LGPD legal obligation) |
| Security and access logs | Up to 12 months for fraud prevention; up to 5 years where legally required |
You have the following rights, exercisable by emailing privacidade@byvulcan.com:
Request a copy of your personal data.
Correct inaccurate or outdated information.
Request deletion of data processed on consent.
Receive data in a machine-readable format.
Object to processing based on legitimate interests.
Request limitation of processing.
Withdraw consent at any time.
Lodge with ANPD (Brazil) or local authority (EU).
We respond within 15 business days (LGPD) or 30 calendar days (GDPR).
Appoint by Vulcan is not directed at persons under 18. We require parental consent for users under 13 (LGPD / COPPA) and verifiable parental consent for users under 16 in the EU (GDPR). Data collected from minors without appropriate consent will be deleted immediately upon discovery.
Substantial changes will be communicated by email to registered Hosts at least 15 days before taking effect. The current version is always available at appoint.byvulcan.com/privacy.
Brazilian users may contact the national data protection authority at gov.br/anpd. EU users may contact their local supervisory authority at edpb.europa.eu.