CitySchedule
CitySchedule LLC
1. Who We Are
CitySchedule is a municipal appointment management platform operated by CitySchedule LLC. We provide software to city and county governments that allows residents to schedule appointments for municipal services such as permit inspections, utility connections, development applications, business licenses, and other city-administered programs.
This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over your own data. It applies to residents who create accounts or submit reservation requests through CitySchedule.
2. Information We Collect
Account Information
When you create an account, we collect:
- Full name
- Email address
- Phone number (optional; only if you provide it)
Reservation Information
When you submit a service request, we collect:
- Service type and sub-service requested
- Preferred date, time, and appointment duration
- Site address (only for services that require a service or inspection location)
- Optional notes you include with your request
- Confirmation # (assigned automatically by the system)
- Status history (pending, approved, denied, completed)
- Denial reason, if your request is denied by city staff
- Inspection outcome (passed, failed, or partial), inspector notes, and any field photos added by assigned city staff after your appointment
Uploaded Documents
You may upload supporting documents (images, PDFs, or Word files, up to 10 MB each) as part of a reservation. Assigned city staff may also attach inspection field photos to your reservation after an appointment. These files are stored on our behalf by Supabase and are accessible only to you and to authorized city staff assigned to your request.
Information We Do Not Collect
- Payment or financial information (CitySchedule does not process payments)
- Government ID numbers, Social Security numbers, date of birth, or driver's license numbers
- Location data or device tracking beyond standard web server logs
- Browsing or behavioral data for advertising purposes
- Biometric data
- Health information (unless you voluntarily include it in a document you upload)
3. How We Use Your Information
| Purpose | Data used |
|---|---|
| Create and manage your account | Name, email address |
| Process and track your reservation | All reservation information |
| Send transactional emails (confirmation, status updates, rescheduling notices) | Name, email address, confirmation # |
| Allow city staff to review and act on your request | Name, phone, reservation details, uploaded files |
| Maintain accurate city service records | Reservation history (retained per our data retention policy) |
| Improve platform reliability and troubleshoot errors | Anonymized server logs, error reports |
We do not use your personal information for advertising, marketing profiling, or sale to third parties.
4. How We Share Your Information
With Your City
Your reservation details including your name, phone number, service type, notes, and uploaded documents are visible to authorized staff of the city you submitted your request to. Staff at other cities cannot access your records.
With Service Providers (Subprocessors)
We share limited personal information with the following US-based vendors who help us operate the platform. Each is bound by a data processing agreement.
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Authentication, database, and file storage | All reservation and profile data, uploaded files |
| Resend | Transactional email delivery | Name, email address, confirmation # |
| Cloudflare | Turnstile captcha (bot and abuse protection on sign-in, sign-up, and password-reset forms) | IP address and browser challenge signals at the time you solve the captcha; no reservation or profile data |
Access Control & City Staff
Your reservation information is visible only to city staff assigned to your request or to your city's administrator. CitySchedule employs role-based access controls enforced on every API request to prevent staff at one city from accessing another city's resident data. CitySchedule employees have infrastructure access under confidentiality obligations but do not routinely access resident data.
Audit Logging
All actions on reservations (creation, approval, denial, rescheduling) are logged with the user ID, timestamp, and the names of the fields changed. Audit logs are designed to be free of personal information: they record what kind of change was made, not the contents of your data. API access logs likewise record only the request method and URL path, never query strings, request bodies, or headers. These logs are retained for security monitoring and compliance purposes; log entries older than the current and two prior years are exported to encrypted archive storage and removed from the live database.
Other Disclosures
We may disclose personal information if required by law, court order, or valid legal process. We will notify you of such compelled disclosures unless legally prohibited. We do not sell personal information to data brokers or advertising networks.
5. Data Retention
Account profiles are retained for as long as your account is active. Reservation records are retained for 3 years after the reservation is closed, consistent with standard municipal recordkeeping requirements. Uploaded files follow the same retention period.
When a reservation or other record is removed in the app, it is soft-deleted: hidden from view but retained in city records for the duration above, consistent with municipal records-retention requirements. The same applies to account deletion: when your account is deleted, your sign-in identity and any active sessions are removed immediately, but your profile record is retained (marked as deleted and hidden from user lists) so the city's reservation records remain complete. To request permanent deletion, see Section 6.
6. Your Rights
Depending on where you live, you may have some or all of the following rights regarding your personal information. California residents have additional rights under the CCPA.
Request a copy of the personal information we hold about you and how we use it.
Request correction of inaccurate information. You can update your name, email, and phone directly in your account settings.
Request deletion of your personal information, subject to legal or municipal recordkeeping obligations.
Exercising any of these rights will not affect your ability to use city services or your standing with the city.
California Residents — CCPA
How to Submit a Request
Email privacy@cityschedule.appwith the subject line "Privacy Request." Include your full name and the email address on your account. We will respond within 45 days (CCPA) or as required by applicable law.
7. Security & Breach Notification
We use industry-standard safeguards including:
- HTTPS (TLS 1.2+) encryption for all data in transit
- AES-256 encryption for data at rest
- Mandatory multi-factor authentication (TOTP authenticator app) for all accounts, with no exemptions; access fails closed until a second factor is verified
- Cloudflare Turnstile captcha on sign-in, sign-up, and password-reset forms
- Role-based access controls enforced on every API request
- Database row-level security policies as a second, database-level enforcement layer on data reads
- Per-identity API rate limiting and cross-origin request restrictions
- City-level data isolation (your data is separated at the database level)
- Time-limited cryptographically signed URLs for file downloads (1-hour expiration)
- Automated security testing and code linting
- Server-side validation of all user input
Breach Notification: If we discover unauthorized access to your personal information, we will notify you and the city within 72 hours of confirming the incident. Our notification will include a description of the incident, the types of information accessed, steps we have taken to remediate the breach, and resources available to you.
If you believe your account has been compromised, contact us immediately at security@cityschedule.app.
8. Contact Us
- Privacy requests: privacy@cityschedule.app
- Security incidents: security@cityschedule.app
- Mailing address: CitySchedule LLC, available upon request
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will update the effective date at the top of this page and notify active users by email if the changes are material. Continued use of CitySchedule after the effective date constitutes acceptance of the revised policy.