Privacy Policy
Last updated: April 19, 2026
IntelliLesson (“we”, “our”, “the platform”) is a lesson booking and management platform for instructors and their clients. This privacy policy explains what data we collect, how we use it, and your rights.
1. Information We Collect
From Instructors (account holders)
- Account information: Name, email address, business name
- Calendar data: When you connect Google Calendar, we access your calendar events and free/busy information to sync lesson bookings and prevent scheduling conflicts
- Booking data: Lesson schedules, client bookings, lesson notes, availability settings, location information
From Clients (people booking lessons)
- Contact information: Name, email address, phone number (provided during booking or by the instructor)
- Booking history: Lesson dates, times, types, and status
Automatically collected
- Usage data: Pages visited, features used
- Device information: Browser type, operating system
2. How We Use Your Data
- Booking management: Schedule, confirm, reschedule, and cancel lesson bookings
- Calendar synchronization: Sync bookings with your Google Calendar so lesson appointments appear alongside personal events, and detect scheduling conflicts via free/busy data
- Notifications: Send booking confirmations, reminders, and status updates via in-app notifications and web push
- Account management: Authenticate users, manage instructor profiles, process onboarding
3. Google Calendar Data (Limited Use Disclosure)
IntelliLesson’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We access Google Calendar data only to sync lesson bookings and check free/busy availability
- We do not use Google Calendar data for advertising or sell it to third parties
- We do not allow humans to read your calendar data except where necessary to provide support you have requested, for security purposes, or to comply with applicable law
- We store calendar sync tokens and event IDs to enable incremental synchronization—we do not store the full content of your personal calendar events
4. Data Sharing
We do not sell, rent, or trade your personal data.
We share data only with:
- Supabase — database hosting and authentication
- Vercel — application hosting
- Google — Calendar API integration (only when you connect your Google account)
- Twilio — SMS notifications (when enabled by the instructor)
5. Data Retention
- Active accounts: Data is retained as long as your account is active
- Deleted accounts: Upon account deletion, we remove your personal data within 30 days, except where retention is required by law
- Calendar sync tokens: Removed immediately when you disconnect Google Calendar
6. Your Rights
You have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your account and associated data
- Disconnect Google Calendar at any time from your account settings
- Export your booking data
To exercise these rights, contact us at the email below.
7. Security
We use industry-standard security measures including:
- Encrypted connections (HTTPS/TLS) for all data in transit
- Row-level security on all database tables to enforce tenant isolation
- OAuth 2.0 for Google Calendar authentication—we never see your Google password
- Minimum-necessary scopes when requesting third-party API access, and revocation on disconnect
- At-rest encryption of third-party API tokens (including Google Calendar access and refresh tokens) via authenticated encryption (Supabase Vault). Encryption keys are managed separately from the database and are never stored alongside ciphertext.
- Every decryption of an OAuth token is recorded in an append-only audit log with actor, action, and timestamp
8. Children's Privacy
IntelliLesson is not directed at children under 13. We do not knowingly collect personal information from children.
9. Changes to This Policy
We may update this policy from time to time. We will notify account holders of material changes via email or in-app notification.