Privacy Policy

From business users: name, email, phone number, password (stored only as a one-way hash), business details, team members’ names and schedules, and how you use the dashboard (sign-in times and an audit log of changes).

Billing: your plan and subscription status. Card details go directly to our payment provider, Stripe; we never see or store full card numbers.

From clients, on the business’s behalf: what a client enters when booking (name, mobile number, email if given, notes to the business, answers to any intake questions), their appointments, and anything the business records about them, which can include preferences, treatment notes and allergies.

Support messages: what you send us through the help form.

Technical data: IP address and basic request information, used for security, rate limiting and diagnosing faults. We don’t use advertising trackers.

• To run the service: take and manage bookings, send confirmations, reminders and review requests the business has switched on, and show the business its calendar, clients and reports.
• To run your account: sign-in, password resets, trial and billing emails, and support replies.
• To keep the service secure and working: prevent abuse, detect faults and keep records we are legally required to keep.
• For optional AI features, only when a business uses them: to answer the business’s questions about its own calendar and clients, and to draft messages. A business can switch AI off; everything else keeps working.

Each business decides what it collects from its clients and why, and is responsible for having its clients’ consent. We process client data only to provide DiaryPilot to that business, keep each business’s data separate from every other business, and do not sell it or use it for our own marketing.

If you are a client and want to see, correct or delete what a business holds about you, please contact that business first; its contact details are on its booking page. We will help the business respond.

DiaryPilot is not designed for medical records. Licensed healthcare providers should not use it to store patient health information.

We use a small number of service providers, each bound by contract to use the data only to provide their service to us:

• Vercel — hosts the website and app (Singapore region).
• Neon — hosts the database (Singapore region).
• Stripe — processes subscription payments.
• Resend — sends emails (routed through Tokyo, Japan).
• Anthropic — powers the optional AI features (United States), only when a business uses them.
• A WhatsApp assistant — only if a business connects one (for example, Aureus’s SmartFAQ), to send its messages.

Where data is transferred outside Singapore, we take steps so that it receives protection comparable to the PDPA. We may also disclose data where the law requires it.

Data is encrypted in transit (HTTPS) and held with providers that encrypt it at rest. Passwords are stored only as salted hashes, and password-reset links expire after one hour and work once. Each business can only reach its own data, and admin actions are recorded in an audit log. No system is perfectly secure; if a data breach is likely to cause significant harm, we will notify the affected businesses and the Personal Data Protection Commission as the PDPA requires.

We keep an account’s data while the account is active. If a trial ends without a subscription or a subscription is cancelled, we keep the data for at least 90 days so the business can come back or export it, after which we may delete it. A business can ask us to delete its account and data sooner. We keep billing records for as long as tax law requires.

Under the PDPA you can ask to access or correct your personal data, and withdraw consent for its use (which may mean we can no longer provide the service). Business users can export clients and bookings as CSV at any time from the dashboard.

To make a request, use our help form or email us. We will reply within 30 days.

Data Protection Officer, Aureus Automation Pte Ltd, Singapore
Email: aureusautomation@gmail.com · or use the help form and choose “Privacy or my data”.

We may update this policy as DiaryPilot changes. The date at the top shows the latest version; for material changes we will tell business users by email.