Privacy policy

YRCAppointments is an appointment scheduling service run by YRC — Your Resource Consultants (“we”, “us”). This policy covers two groups of people:

• Hosts: people who create an account, set their availability and share a public booking page.
• Guests: people who request an appointment on a host’s booking page. Guests do not need an account.

It also covers people who only visit our website. Our contact details are in the last section.

When you create and use a host account we store what you give us:

• Account details: your name, your email address and your password. We never store the password itself, only a one-way hash of it, so we cannot read it or send it to you.
• Booking page settings: the address of your page (your “link”), your time zone, your welcome message, and your branding (an accent colour and a logo, if you add them).
• Availability: your weekly hours and the dates you block or give different hours.
• Event types: their names, lengths, descriptions, locations, the questions you ask guests, and their booking rules.
• Bookings: the requests and appointments made with you, including the guest details described in the next section, and any bookings you add by hand.

We also keep a few things the service creates for your account:

• when your account was created, when you confirmed your email address, and two setup milestones (when you last saved your profile and when you first copied your booking link);
• the secret that makes up your private calendar feed address, once you open that setting (see Calendar feed and export);
• a record of each link we email you to reset your password, confirm your email address or change it. We store only a hash of the link’s secret, the address it was sent to, and when it expires or was used.

When you request an appointment on a host’s booking page we store:

• your name and email address;
• the note you add for the host, if you add one;
• your answers to any questions the host asks on the booking form;
• your time zone, which your browser reports and you can change on the page, so that we can show and email times in your own zone;
• the appointment itself: the host, the event type, the start and end time, its status (requested, confirmed, declined or cancelled) and whether you moved it.

The host you book with receives this information. They see it in their dashboard and in the emails we send them about your booking, and they can download it or see it in their own calendar (see Calendar feed and export). The host decides what to ask you and what to do with your answers, and is responsible for how they use them. We handle your information on the host’s behalf, to run the booking. If you have a question about how a particular host uses your details, ask that host first.

Each booking gets a private link, which we email to you. Anyone who has that link can see the booking and cancel or move it, so keep the email to yourself.

A host can also add a booking by hand, for example after a phone call. In that case the host enters your name and, if they choose, your email address and a note. If they enter your email address, we email you about that booking as well.

Other guests never see your details. A host’s public page shows only which times are free.

We keep this to what is needed to run the service safely.

• Abuse prevention. To slow down password guessing and spam, the service counts recent attempts (sign-ins with a wrong password, sign-ups, password reset requests, booking requests and similar) by the internet (IP) address they come from and, for some actions, by the email address or account involved. These counters are held in the server’s memory only, are not written to our database, and expire within an hour at most.
• Error logs. When something goes wrong, the server writes a short technical error message to its log so that we can fix it.
• Hosting logs. The companies that host the service for us may keep standard request logs (such as IP address, time, the page requested and browser type) for security and troubleshooting.

We do not use analytics or advertising trackers, and our pages load no scripts from other companies.

We use the information above only to:

• Run the service: show hosts’ booking pages and free times, pass a guest’s request to the host they chose, and let hosts and guests see, confirm, decline, cancel and move bookings.
• Send service emails, listed in the next section. These are about your own account or booking; we do not send marketing email.
• Keep the service secure: sign hosts in, check that an email address belongs to the person who entered it, and prevent abuse.
• Meet legal obligations and answer requests from the people whose information we hold.

We do not sell personal information, we do not share it for advertising, and we do not use it to build advertising profiles or to make automated decisions about you.

All of our emails are plain text. They contain no tracking images or tracked links.

To hosts

• A link to confirm your email address, and links to reset your password or change your email address when you ask for them.
• Notices that your password or email address was changed, or that a change was requested, and a final notice when your account is deleted.
• Booking emails: a new request (with the guest’s name, email address, note and answers), your confirmations and cancellations, a guest’s cancellation or change of time, and a reminder about a day before a confirmed appointment.

To guests

• That your request was received, and whether the host confirmed or declined it.
• That a booking was cancelled or moved, including when the host closes their account.
• A reminder about a day before a confirmed appointment.

Emails to guests name the host but do not include the host’s email address. Confirmations carry a calendar file for the appointment. If you add a message when you cancel or decline a booking, we pass it on in the email to the other person; we do not keep it afterwards.

Guests and visitors: viewing our website or a booking page and requesting an appointment sets no cookies and stores nothing else in your browser.

Hosts: signing in sets cookies that are strictly necessary for the account to work. They are set by our own site, cannot be read by scripts in the page, and are not used for tracking.

• Session cookie: keeps you signed in. It holds a signed, encrypted token that identifies your account and lasts up to 30 days, or until you sign out. Changing or resetting your password ends every existing session.
• Sign-in helper cookies: our sign-in system may also set two short-lived cookies, one that protects the sign-in request against forgery and one that remembers which page to return you to. They disappear when you close your browser.

Because we use only strictly necessary cookies, we do not show a cookie banner. If you block these cookies you can still book appointments, but you cannot sign in to a host account.

Hosts have two ways to take booking information out of the service:

• Private calendar feed. A host can subscribe their own calendar app to a feed of their bookings. The feed lists pending requests and confirmed appointments, from about 90 days back onwards, with the time, the event type and its location, and the guest’s name, email address and note. Its address contains a long random secret and there is no other password: anyone who has the address can read the feed. A host can replace the address at any time in their settings, which stops the old one working at once.
• Bookings export. A signed-in host can download their bookings as a spreadsheet (CSV) file with the date, time, time zone, event type, guest name, guest email address, status and note.

Once a host has subscribed a calendar app or downloaded a file, that copy is in the host’s hands and outside our control.

• Hosts and guests, with each other. A host receives the details of the guests who book with them. A guest sees what the host publishes on their booking page: the host’s name, welcome message, branding, event types and free times. We do not show a host’s email address on their booking page or in emails to guests.
• Service providers. We rely on other companies to run the service, in particular to host the application and its database and to deliver email. They handle personal information only on our instructions and only as needed to provide that service to us.
• Legal reasons. We may disclose information when the law requires it, or when it is necessary to protect the rights, safety or property of our users, the public or ourselves.
• A change of ownership. If the service is transferred to another company, the information it holds would move with it and stay covered by this policy until you are told otherwise.

Our service providers may process information in countries other than the one you live in. Where the law requires safeguards for such transfers, we put them in place.

While an account is open

We keep a host’s account and everything in it, including bookings, for as long as the account exists. Hosts can change their profile, availability, event types and branding at any time.

Cancelled and declined bookings

Cancelling or declining a booking does not delete it. The booking stays in the host’s records, marked as cancelled or declined and with the guest’s details, so that both sides can see what happened. Past appointments are kept in the same way. They are removed when the host deletes their account, or earlier if we are asked to delete them (see Your rights).

Deleting a host account

A host can delete their account in their settings, after entering their password. Deletion takes effect at once and cannot be undone. It removes the account, its availability, event types, branding, private links and every booking made with that host, including the guests’ details. Guests with an appointment or request still ahead are emailed that it has been cancelled, the host receives a final confirmation email, and the address of the booking page becomes free for someone else to use.

Other records

• Password reset and email change links work for one hour, and email confirmation links for 24 hours. Our record of a link is deleted some time after it has expired, and not before seven days have passed, so that an old link can explain why it no longer works.
• Emails that have been delivered stay in the recipient’s mailbox, and copies a host has exported or synced to their calendar stay with the host.
• If our hosting providers keep backups or logs, those copies are removed on the provider’s own schedule.

Wherever you live, you can ask us to:

• Access: tell you what information we hold about you and give you a copy.
• Correct: fix information that is wrong or out of date.
• Delete: erase your information.
• Export: give you your information in a common, machine-readable format.
• Object or restrict: stop or limit a particular use of your information.

Hosts can do most of this themselves: edit their details in the dashboard, download their bookings from the bookings page, and delete their account in settings.

Guests can view, cancel or move a booking with the private link in their emails. For anything else, such as a copy, a correction or deletion, contact the host you booked with, or contact us and we will work with the host to answer you.

To make a request, contact us by email at info@yourresourceconsultants.com. We may need to check that you are the person the information is about, for example by replying to the email address on the account or booking. We answer within the time the law allows, and we will not treat you differently for making a request.

Under the General Data Protection Regulation (GDPR) and the UK GDPR, the following also applies.

• Roles. YRC — Your Resource Consultants is the controller of hosts’ account information. For guests’ booking information the host is the controller and we act as the host’s processor.
• Legal bases. We process hosts’ information to perform our contract with them (our Terms of service); abuse prevention and security rest on our legitimate interest in keeping the service safe; and some processing is needed to comply with the law. Hosts are responsible for having a legal basis for the guest information they collect.
• Your rights. You have the rights of access, rectification, erasure, restriction, data portability and objection described above.
• Complaints. You can complain to the data protection authority where you live or work. We would appreciate the chance to put things right first.

California law gives residents the right to know what personal information a business collects about them and why, to have it corrected or deleted, and not to be discriminated against for using these rights. The categories we collect are the identifiers and booking details listed in this policy, collected directly from you or from the host you book with, for the purposes listed in How we use information.

We do not sell personal information and we do not share it for cross-context behavioural advertising. To use your rights, contact us as described in Your rights; you may also ask through an authorised agent.

• Passwords are stored only as salted, one-way hashes.
• The links we email (password reset, email confirmation, a guest’s booking link, a host’s calendar feed) contain long random secrets. Account links work once and expire, and we store only a hash of their secret.
• Connections to the live service are encrypted in transit (HTTPS).
• Each host can reach only their own bookings and settings.
• Repeated sign-in, sign-up, password reset and booking attempts are rate limited.
• Changing or resetting a password signs out every other session of the account.

No service can promise perfect security. If you believe your account or a booking link has been misused, contact us straight away.

YRCAppointments is not intended for anyone under 16, and we do not knowingly collect information from children under 16. If you believe a child has given us their information, contact us and we will delete it.

When the service or the law changes we will update this policy and the effective date at the top of this page. If a change significantly affects how we use hosts’ information, we will tell hosts by email or in the dashboard before it takes effect.

Questions about this policy or about your information go to:

Company

YRC — Your Resource Consultants

Email

info@yourresourceconsultants.com

Post

20 S Charles St Ste 403, Baltimore, MD 21201, USA

Telephone

1-301-900-6952