Conciergr Timetable

Privacy Notice

Last updated: 29 September 2026

1Who we are

Conciergr Timetable is provided by LONUT (UEN 53462899X), a sole proprietorship registered in Singapore (LONUT, we, us). LONUT also runs Conciergr.

This notice covers timetable.conciergr.com: the homepage and help pages, the sign-up form, the staff app, each centre's public timetable page (the Timetable Page) and the API. It also covers the emails we send from getconciergr.com to offer the Timetable to businesses (section 13). The Conciergr assistant has its own privacy policy.

We follow Singapore's Personal Data Protection Act 2012 (the PDPA). Where a centre, or a person, is in the United Kingdom or the European Union, we also follow the UK GDPR and the EU GDPR as they apply.

The Terms of Service set out what we and each centre agree, including the Data Processing Addendum.

2Our two roles

For the centre's timetable data, the centre is in charge

A centre (a tuition centre, a dance studio or any other business that runs classes) decides what goes into its timetable, who on its staff can see and change it, and what its Timetable Page shows. For that data the centre is the controller, and we are its processor, called a "data intermediary" under the PDPA. We use the data only to run the service for the centre.

If you are a parent, a teacher or a member of a centre's staff and have a question about how a centre uses your data, please ask the centre first. If you write to us instead, we will pass your request to the centre and let you know we have.

For our own records, we are in charge

We are the controller (the "organisation", under the PDPA) for the personal data we use for our own purposes: account and sign-in records, billing, security and abuse protection, the sign-up form, emails with us, and the emails we send to offer the Timetable to businesses.

3What we collect

Centre owners and staff

• Your name and work email address, the centre you work for, and which branches and permissions the centre's Owner has given you.
• Sign-in records: when you signed in and whether by emailed link or Google. If you use Google sign-in, Google tells us your email address and that it is verified. We never receive your Google password or anything else from your Google account.
• The change history: each change you make to the timetable is recorded with your name and the time.
• Emails we send you and anything you write to us.

Sign-up

The sign-up form asks for the centre's name and country and the name and work email address of the person signing up. We also record which version of the Terms of Service and this notice they accepted. The browser's time zone is used only to set the centre's time zone.

The form uses Cloudflare Turnstile to check that a person, not a bot, is signing up (see section 6). To limit spam, we keep a scrambled (salted and hashed) form of the network address the request came from, never the address itself. We then email a link to confirm the address. The centre is created only when the link is opened, and at that point we record when the terms were accepted. Sign-up requests, whether or not anyone confirms them, are deleted after 30 days.

When a new centre is created, we send ourselves a message on Telegram with the centre's name and country and the Owner's name and email address, so that we know when a centre joins.

Billing, for paid API access

Stripe collects and keeps the card and billing details. In our own database we store only Stripe's reference for the centre, and the subscription's status, currency and renewal or end date. In Stripe we can see the billing name, email address and address, invoices, and the card's brand and last four digits. We never see the full card number.

What a centre puts in its timetable

Branches and their addresses, classes, closed days, fees, the centre's WhatsApp number and logo, and teacher names. Teacher names appear on the Timetable Page unless the centre switches them off. We process all of this for the centre, as section 2 explains.

Trial children

When a centre, or a booking system the centre connects (such as the Conciergr assistant), holds a trial place, we store the child's first name and level, the lesson date and how the place was booked. A connected system may add its own reference for the booking, which is an opaque code, never a phone number. We delete the first name and the reference 30 days after the lesson and keep only the count of trial places.

Families and other visitors to a Timetable Page

• Visitors do not sign in, and we collect no names, phone numbers or email addresses from them.
• The level and branch a visitor chooses are remembered in their browser's local storage, on their own device, so the page opens at the same choice next time. They are also part of the page address, so our server can show the right classes.
• Like any website, the page receives each visitor's IP address and browser details. Cloudflare uses them to deliver and protect the page. We use the IP address for a moment to limit how often a single address can load pages, and we do not store it in our database.
• The page's fonts are served from our own domain, so no font service sees who visits. A centre's logo is loaded from wherever the centre keeps it, and that host sees the visitor's IP address.
• If a centre embeds its Timetable Page on its own website, that website's own privacy practices also apply.
• The WhatsApp button opens WhatsApp with a message already typed. If the visitor sends it, the conversation is between the visitor and the centre, on WhatsApp, which Meta runs. It does not pass through us.

Our homepage and help pages

They set no cookies and have no analytics or advertising. Their fonts are served from our own domain too.

4How we use it

We use personal data to:

• run the service: sign staff in, show and update the timetable, publish the Timetable Page, answer API requests, and hold trial places;
• send service emails to staff: sign-in links, reminders when a class's months are running out or class sizes have not been updated, and notices about the service, the account or our terms (including warnings before we delete an unused free account);
• bill for paid API access, and keep the records tax law requires;
• keep the service secure: limit request rates, stop bots at sign-up, keep the change history and investigate misuse;
• offer the Timetable to businesses that run classes, in a short email, as section 13 explains;
• answer questions and support requests;
• comply with the law, and establish or defend legal claims; and
• improve the service, using counts and statistics that identify no one.

The Timetable itself sends service emails, plus the few emails about Conciergr below, and it never messages a centre's customers. We do not sell personal data, use it for advertising or profiling, or use it to train AI models.

Emails about Conciergr. After you sign up, we may email the owner up to three times about Conciergr, the WhatsApp assistant made by the same team, copying our shared inbox hello@conciergr.com. Tell us you'd rather not, by replying to any of them, and we won't write about it again; your account and service emails are not affected. We send these from the mailbox described in section 13.

For the service, under the PDPA we rely on your consent, which you give when you sign up or are invited to the service, or on consent you are deemed to have given by providing your details for these purposes. For security and legal compliance, we may also rely on the exceptions the PDPA allows, such as legitimate interests. If you withdraw consent, we may no longer be able to give you access to the service, and we will tell you what that means before we act on it.

5Legal bases, for people in the UK and EU

The GDPR requires a legal basis for each use of personal data. For the data we control, these are ours:

For timetable data we process for a centre, the centre decides the legal basis. We do not make decisions about people by automated means that have legal or similarly significant effects.

6Cookies and storage on your device

Timetable Pages, the homepage and the help pages set no cookies. Nowhere on timetable.conciergr.com do we use analytics, advertising or tracking cookies. We use only these, and each is needed for something you ask for:

7Who we share it with

Our subprocessors

Others

• Google, when a staff member chooses Google sign-in, where we offer it, and as the provider of the mailbox for the emails in section 13.
• Anthropic, whose AI assistant, Claude, helps us write and answer the emails in section 13, and reads a timetable a centre emails us to load for it (section 8 says the terms it works under).
• Telegram, which carries our own message about each new centre (the centre's name and country, and the Owner's name and email address) and our alerts about the emails in section 13.
• The centre. A centre's Owner can see its staff's details and the change history. Its staff can see the trial places at the branches they are allowed to work on.
• Systems the centre connects. A centre can give an API key to its own website or to an assistant such as Conciergr's. Each key reads only what the centre allows.
• The public. A Timetable Page is public. It shows classes, branch details, closed days with their reasons and, if the centre chooses, teacher names.
• Advisers and authorities. Our professional advisers, and authorities or courts where the law requires it.
• A successor. A business that takes over the service, such as a company LONUT sets up to run it. We will tell centres by email before this happens.

We do not sell personal data to anyone.

8Where your data is kept

The database is kept in Cloudflare's Asia-Pacific region, which may be outside Singapore. Pages and the API are served from Cloudflare's worldwide network, close to each visitor. Resend and Stripe process data in the United States and other countries, and Telegram processes our new-centre messages on its servers outside Singapore.

When we transfer personal data outside Singapore, we make sure the recipient is bound by legally enforceable obligations, such as its data processing agreement with us, or holds a certification recognised under the PDPA, so that the data keeps a standard of protection comparable to the PDPA's. One exception: we use Anthropic's Claude on a Claude plan, under Anthropic's own terms and privacy policy rather than a data processing agreement with us, with the setting that lets Anthropic use chats to improve its models switched off. It handles only the outreach records in section 13 and timetables a centre emails us to load.

For centres and people in the UK or EU, a transfer to us in Singapore is covered by the European Commission's standard contractual clauses and, for the UK, the UK addendum to them. Both are set out in the Data Processing Addendum. Our subprocessors use their own approved safeguards for onward transfers. Write to us for a copy of the safeguards that apply.

9How long we keep it

We keep counts and statistics that identify no one.

10Security

We protect personal data with reasonable security arrangements, as the PDPA requires. All traffic uses HTTPS. There are no passwords to steal: staff sign in with single-use emailed links or with Google. Session tokens and API keys are stored only in hashed form. Each centre's data is kept apart from every other centre's and checked by automated tests, and every change is recorded. The Data Processing Addendum lists our measures in full.

No system is perfectly secure. If a data breach affects a centre's data, we tell the centre within 48 hours. If it affects data we control, we notify the Personal Data Protection Commission and the people affected where the PDPA requires, and the relevant authorities where the GDPR requires.

11Your rights

Under the PDPA

You can ask us for access to the personal data we hold about you and how it has been used or disclosed in the past year, ask us to correct it, and withdraw your consent to our using it. We reply within 30 days, or tell you within that time when we will. We do not charge for requests unless one is plainly excessive, and if so we tell you the fee first.

Under the UK or EU GDPR

If the GDPR applies to you, you can also ask us to delete your data, to restrict or stop using it, or to give it to you or another organisation in a machine-readable form. You can object to our use of it based on legitimate interests. Where we rely on consent, you can withdraw it at any time.

Data a centre controls

For data a centre put into its timetable, the centre answers your request, and we help it. If you write to us, we pass your request to the centre.

How to ask

Email hello@conciergr.com. To have your data deleted, put "Delete my data" in the subject. We may ask you to confirm the request from the email address we hold for you, so that we do not act on someone else's request. Staff can also ask their centre's Owner to remove them, and an Owner can close the centre's account as the Terms of Service describe.

12Children

The service is for businesses. It is not meant for children, and children never sign in to it. The only data it holds about a child is a trial child's first name and level, entered by a centre or by a booking system acting for the centre, and we delete the name 30 days after the lesson. The centre is responsible for having a parent's or guardian's consent to enter it. A parent who has a question should contact the centre first, or write to us.

13If we emailed your business

We email businesses that run group classes at set weekly times, such as tuition centres and dance, swim and music schools, to offer them Conciergr Timetable. If we emailed your business, this section explains how we found you, what we keep and how to stop us writing.

The emails are sent by LONUT (UEN 53462899X), Singapore, which runs Conciergr and Conciergr Timetable. They come from joshuawwy@getconciergr.com, our outreach address, in the name of Joshua, who runs LONUT. For these records we are the controller (the "organisation", under the PDPA), and our Data Protection Officer can be reached at hello@conciergr.com.

How we found you

We found your business, and the address we wrote to, on its own website or its Google Maps listing. We write only to an address a business publishes for enquiries. We never guess addresses, buy them or collect them with scraping software. For a business in the UK, we also check the public Companies House register, because we email only live companies and LLPs there.

What we keep

• Your business's name and website, and its Google Maps listing if that is where we found it.
• The enquiry email address it publishes, and the page where we found that address.
• A short note on why we thought the Timetable would suit it, such as the classes it runs and how it publishes its timetable now, and, for a UK business, that Companies House lists it as a live company or LLP.
• The emails we sent and any replies, with a note of what each reply was (for example, a question, or a request not to write again).

Most of this is about the business, not a person. It is personal data where it identifies someone, such as an address with a person's name in it or a reply signed with a name.

Why we use it, and our legal basis

We use it only to offer your business the Timetable and to answer you if you reply. We email at most twice, a first email and one follow-up, unless you reply. We do not add you to a mailing list, sell these records, or give them to anyone else to market to you.

For people in the UK and EU, our legal basis is legitimate interests: telling businesses that run classes about a service that may suit them, in a short email that is easy to refuse.

If you send us your timetable

If you reply with your timetable and ask us to set it up, we create your Timetable account for you, with the address you wrote from as its owner, and load your classes and any prices from what you sent, with settings such as your time zone, currency and how customers reach you taken from your timetable and your own website. Nothing is shown publicly until you sign in, accept our Terms and make it live yourself. If you don't sign in, we remind you once and then delete the account and what you sent on the date that reminder gives.

A short video about your business

We may make a short video about your business to show how the Timetable would look for you. We make it from what your business publishes on its own website, such as its name, logo and class times, sometimes with illustrations we generate, and it is narrated by an AI voice from ElevenLabs; no real person's voice or face is used. The video sits on a private page that only the link in our email opens, hosted by Cloudflare. We note whether that page was opened, how many minutes of the video played and whether its button was pressed, from Cloudflare's own records; the page sets no cookies and our emails carry no tracking pixels. To tell people apart from the security software that opens links in emails automatically, the page also notes the kind of browser and network each visit came from, and a scrambled form of its internet address that changes every month. We delete the video and its page 30 days after we email you, or straight away if you ask us not to write again. ElevenLabs and Cloudflare may process this outside Singapore, including in the United States.

Who sees it

• Google, which runs the mailbox we send these emails from and receive replies in (Google Workspace).
• Anthropic, whose AI assistant, Claude, helps us read businesses' websites, write and answer these emails, and make the short videos above. Claude writes and sends most replies on Joshua's behalf, in his name, and passes anything unusual to him; ask and we will tell you whether a person wrote a particular reply.
• Telegram, which carries our own alerts, such as when a reply needs Joshua's attention.
• ElevenLabs, whose AI voice narrates a video we make about your business, from the script we send it.
• Cloudflare, which hosts that video and the page it plays on.

Our records are kept in a small database on our own computer and in the mailbox. A reply that shows interest in Conciergr, our WhatsApp assistant, is also passed to our shared inbox hello@conciergr.com, which Cloudflare delivers to our Gmail (Google); if you later ask us not to write again, those copies are deleted too. Google, Anthropic and Telegram may process them outside Singapore, including in the United States. We use Claude on a Claude plan, under Anthropic's own terms and privacy policy rather than a data processing agreement with us, and with the setting that lets Anthropic use chats to improve its models switched off.

How long we keep it

• If your business did not reply, we delete its record 12 months after our last email to it.
• If you replied, we keep the conversation as we keep any emails with us (section 9): as long as we need it to deal with your message and keep proper business records. If your business signs up, the rest of this notice covers its account.
• If you ask us not to write again, we delete the rest of the record and keep only your address and its domain (such as yourschool.co.uk) on a do-not-email list. We keep that entry for good, so that we never email you again.

Your choices

• To stop our emails, reply "no", or anything to that effect, to any of them, and we will not write to you again. For people in the UK and EU, this is also your right to object to direct marketing, which we always honour.
• To see, correct or delete what we hold, email hello@conciergr.com, as section 11 describes. If you ask us to delete it, we keep only the do-not-email entry above, so that we never write to you again.
• To complain, if you are not satisfied with our reply: in the United Kingdom, to the Information Commissioner's Office, at ico.org.uk; in Singapore, to the Personal Data Protection Commission, at pdpc.gov.sg. Section 15 also lists the authorities in the European Union.

14Changes to this notice

We may update this notice. The date at the top shows the current version. We will email centre Owners at least 30 days before a material change takes effect.

15Contact and complaints

LONUT (UEN 53462899X), Singapore. Our Data Protection Officer can be reached at hello@conciergr.com.

If you are not satisfied with our reply, you can complain to:

• in Singapore, the Personal Data Protection Commission, at pdpc.gov.sg;
• in the United Kingdom, the Information Commissioner's Office, at ico.org.uk; or
• in the European Union, the data protection authority where you live or work, listed at edpb.europa.eu.