Conciergr Timetable

Conciergr Timetable

Terms of Service

Last updated: 28 September 2026

In brief

  • Conciergr Timetable is run by LONUT, a sole proprietorship registered in Singapore. These terms are a contract between LONUT and the business that signs up.
  • The staff app, your timetable page and its WhatsApp button are free. The free service comes as it is, and we give you 30 days' notice by email before we change or end it.
  • API access costs S$29 a month per centre (or US$22, or £17), billed monthly by Stripe. You can cancel at any time, and it stops at the end of the month you paid for. We do not refund part months unless the law requires it.
  • Your timetable data is yours. You can download it at any time, and we delete it within 30 days after you close your account.
  • You decide what personal data goes in. You are its controller and we process it for you, under the Data Processing Addendum in Part B.
  • Our liability is capped at S$100 or the fees you paid us in the 12 months before the claim, whichever is greater.
  • Singapore law applies, and the Singapore courts decide disputes.

1About these terms

Conciergr Timetable (the Service) is provided by LONUT (UEN 53462899X), a sole proprietorship registered in Singapore (LONUT, we, us). LONUT also runs Conciergr.

These terms are an agreement between LONUT and the business that opens a Timetable account (you). They are made up of Part A (these Terms of Service) and Part B (the Data Processing Addendum). Our Privacy Notice explains how we handle personal data.

You accept these terms by ticking the box on the sign-up form. The person who ticks it confirms that they are at least 18 years old and are allowed to accept these terms for the business. We record which version of these terms you accepted, and when.

The Service is for businesses. It is not offered to consumers for personal, family or household use.

2Words we use

Centre
Your business: a tuition centre, a dance studio, a swim school or any other business that runs classes. "Per centre" means per Timetable account, however many branches it has.
Owner
The person who holds your account. The Owner invites staff, decides what each of them may do, issues API keys and receives our notices.
Staff
The people the Owner invites to sign in and keep the timetable.
Timetable Page
Your public page at timetable.conciergr.com/<your-name>, which you can also embed on your own website.
Your customers
The families and other people who read your Timetable Page and contact you about classes. They never sign in to the Service, pay us or hear from us.
Centre Data
Everything you, your Staff or your API keys put into the Service: branches, classes, closures, fees, teacher names, staff details, trial places and anything else you enter.

3Your account

4The free service

These are free: the staff app (the week board, the day view, the class table, closed days, fees and staff), your Timetable Page, embedding it on your own website, and the WhatsApp button on the page.

Limits

Each centre can have up to 50 branches, 3,000 current classes and 50 Staff, whether or not it pays for API access. A current class is one whose last month is this month or later, so classes that have finished do not count. If you need more, email us. Higher limits apply only once we have agreed them with you in writing (email is enough). Centres whose Timetable comes with a Conciergr plan have no limits.

The Conciergr credit line

The free Timetable Page always shows a small "Timetable by Conciergr" line. You may not remove or hide it on the free service.

As it is

The free service is provided as it is and as available. We make no promise about uptime or support, though we will answer emails when we can.

Changing or ending the free service

We improve the Service all the time, and we make changes that take nothing away without notice. We will give the Owner at least 30 days' notice by email before we remove a feature of the free service, lower its limits, start charging for it or end it. If we end it, you can download your data during the notice period (section 7).

5Paid API access

API keys let your own website, software or AI agents read your timetable, hold trial places or make changes. A key that can read your timetable or hold trial places needs paid API access. A key that can only make changes is free. (If you have a Conciergr plan, API access is part of that plan: see section 6.)

Price

API access costs S$29 a month per centre. If you pay in US dollars it costs US$22, and in pounds sterling £17. The price shown when you subscribe is the price you pay.

Taxes

Prices do not include GST, VAT or similar taxes. LONUT is not registered for GST at present, so no GST is added today. If the law comes to require us to charge a tax, we add it to your invoice. If you are a business outside Singapore, you may have to account for VAT or a similar tax yourself under a reverse charge.

Billing

Stripe bills you monthly in advance, from the day you subscribe. Your subscription renews each month until you cancel it.

Cancelling

You can cancel at any time on Stripe's billing page, which we link to from the staff app. Cancelling takes effect at the end of the month you have paid for. Your API keys keep working until then and are paused afterwards. We keep paused keys, so they work again as soon as you subscribe again. The free service carries on.

Refunds

We do not refund or credit part months, unless the law requires us to. The one exception is in section 12: if we end your API access for a reason that is not your fault, we refund the unused part of the month.

Failed payments

If a renewal payment fails, Stripe retries your card. Your keys keep working until the end of the month you last paid for, but you cannot create new keys that need paid access. If the payment is still not made, those keys are paused until it is. The free service carries on.

Price changes

We will give the Owner at least 30 days' notice by email before a price change. The new price applies from your first billing month after the notice ends. If you do not accept it, cancel before then.

Rate limits

Each key has a limit on how many requests it can make per minute. The limit protects the Service for everyone, and the API returns a clear error with a time to retry if you reach it.

6If your Timetable comes with Conciergr

If your business has a Conciergr plan, your Timetable, its API access and the Conciergr assistant's access to it are part of that plan, with no limits on branches, classes or Staff, and your Conciergr agreement covers fees and billing. These terms cover everything else about the Timetable. If the two differ on fees or billing, the Conciergr agreement prevails.

If your Conciergr plan ends, your Timetable Page shows only your WhatsApp link and the API stops. We keep your data for 90 days in case you come back, then delete it. Email us for a copy of your data, or to have it deleted sooner.

7Your data

You own it

Centre Data belongs to you. You allow us to store, copy, process and display it as needed to run the Service for you: to show it on your Timetable Page, to send it to the API keys you issue, to send reminder emails to your Staff, and to keep backups. This permission ends when the data is deleted.

You keep it accurate

Your customers, and any assistant or system you connect, rely on what your Staff enter: times, places left, fees and closed days. We do not check it, and we are not responsible for decisions made on it. Keep it up to date.

Teacher names

Teacher names are shown on your Timetable Page unless you switch them off in the staff app. Show a teacher's name only if you are allowed to.

Downloading your data

You can download your classes as a CSV file from the staff app at any time. With paid API access you can also read all your timetable data through the API. For a complete copy in a machine-readable file, email us and we will send one.

What not to put in

The Service is built for timetables, not records about people. Do not enter NRIC, FIN or passport numbers, health information, bank or card details, or any contact details or full names of children. Free-text fields such as closure reasons may appear on your Timetable Page, so write them for the public.

What we do not do with it

We do not sell Centre Data, use it for advertising, or use it to train AI models. We may use counts and statistics that do not identify you or any person, such as how many classes the Service holds, to run and improve the Service.

8Acceptable use

You must not use the Service, and must make sure your Staff and API keys do not use it, to:

We may remove content that breaks this section, and section 12 explains when we may suspend an account.

9API keys

10Privacy and data protection

11Closing your account

You can close it at any time

The Owner can close your account by emailing hello@conciergr.com from the Owner's email address. If you have paid API access, we close the account at the end of the month you have paid for, unless you ask us to close it sooner. Download anything you want to keep first (section 7).

What we delete, and when

Within 30 days after your account closes, we delete Centre Data from our systems. Backup copies roll off within a further 30 days. We keep only what the law requires us to keep, such as invoices and billing records, and counts that identify no one.

Free accounts nobody uses

An account is in use when a Staff member signs in or one of its API keys is used. If a free account is not used for 12 months, we email the Owner a warning, and a second warning two weeks later. If it is still not used, we delete the account and its data 13 months after it was last used, as if it had been closed. Using the account at any point stops this. Accounts with paid API access, and accounts that come with a Conciergr plan, are not deleted for inactivity.

12Suspension

We may suspend or close your account, or part of it such as a Timetable Page or an API key:

We will tell you why, unless the law does not allow us to. If we end your paid API access for a reason that is not your fault, we refund the unused part of the month you paid for.

Sections 7, 10, 11 and 15 to 20, and Part B for as long as we hold Centre Data, continue to apply after your account closes.

13Our service and your feedback

We own the Service: its software, design, documentation and the Conciergr name. While your account is open, you may use the Service for your own centre under these terms. You may not copy, change or reverse-engineer it, except where the law allows you to.

If you send us ideas or feedback, we may use them freely, without paying you or naming you.

14Other services

The Service works with services run by others. The WhatsApp button on your Timetable Page opens WhatsApp, which Meta runs; the conversation that follows is between your customer and you, not us. Stripe handles payments, and Google handles Google sign-in. Their own terms apply to them, and we are not responsible for them.

If you also use Conciergr, its assistant reads your timetable and holds trial places through the API, under your Conciergr agreement.

15What we promise, and what we don't

We will provide paid API access with reasonable care and skill.

Apart from that, and to the extent the law allows, the Service is provided as it is and as available. We do not promise that it will be uninterrupted or free of errors, or that it will suit any particular purpose, and we give no other promises or warranties, whether stated or implied.

16Limits on liability

  1. Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that the law does not allow to be limited.
  2. Neither of us is liable to the other for loss of profits, revenue, business or goodwill, or for any indirect or consequential loss.
  3. Our total liability to you for all claims arising out of or relating to the Service or these terms, whether in contract, tort (including negligence) or otherwise, is limited to the greater of S$100 and the fees you paid us under these terms in the 12 months before the claim.
  4. These limits do not limit your duty to pay fees you owe, or your obligations under section 17.

17Indemnity

You will cover our reasonable losses and costs, including reasonable legal fees, arising from any claim or regulatory action by someone else that results from Centre Data, from your breach of section 8 or section 9, or from your breach of data protection law (for example, putting in personal data without the consent or notice the law requires). We will tell you about any such claim promptly and give you reasonable help in dealing with it.

18Changes to these terms

We may update these terms. The date at the top shows the current version. We will give the Owner at least 30 days' notice by email of any change that affects you materially. If the law requires a change, it may take effect sooner.

If you keep using the Service after a change takes effect, the new terms apply. If you do not accept them, close your account before then, and cancel any paid API access.

19General

20Law and disputes

These terms are governed by the laws of Singapore. The courts of Singapore have exclusive jurisdiction over any dispute arising out of or relating to them or the Service.

Before going to court, email us about the problem. We will both try in good faith to settle it within 30 days. Either of us may still go to court straight away for urgent relief.

Disputes under the standard contractual clauses in Part B are handled as those clauses say (Annex 4).

21Contact

LONUT (UEN 53462899X), Singapore. Email hello@conciergr.com.

Part B

Data Processing Addendum

Part of the Terms of Service above. Last updated: 28 September 2026

In brief

  • You decide what personal data goes into your Timetable. We handle it only to run the Service for you.
  • We keep it secure, tell you within 48 hours if a breach affects it, and help you answer people's requests.
  • We use four subprocessors: Cloudflare, Resend, Stripe and, only when you email us your timetable and ask us to load it, Anthropic. We give you 30 days' notice before adding another.
  • Transfers out of Singapore, the EU and the UK are covered below, including the EU standard contractual clauses and the UK addendum.
  • We never sell your data, advertise with it, train AI on it or message your customers.

B1What this Addendum covers

This Addendum applies whenever we process personal data in Centre Data for you. It forms part of the Terms of Service, and you accept it by accepting them.

Data Protection Law means the laws that apply to that processing: Singapore's Personal Data Protection Act 2012 (the PDPA); the EU General Data Protection Regulation (the EU GDPR); the UK GDPR and the UK Data Protection Act 2018; and any other data protection law that applies to Centre Data.

Words such as personal data, processing, controller, processor and data subject have the meanings those laws give them. Under the PDPA, you are the "organisation" and we are a "data intermediary" processing personal data on your behalf.

B2Roles and instructions

  • You are the controller of the personal data in Centre Data (or, if you process it for someone else, a processor acting for them). We are your processor.
  • We process that personal data only on your documented instructions. Your instructions are these terms, the settings you choose, and what your Staff and API keys do in the Service. If the law makes us process it in another way, we will tell you first, unless the law forbids that.
  • We will tell you if we believe an instruction breaks Data Protection Law. Any instruction that goes beyond the Service needs our agreement in writing.
  • The details of the processing are in Annex 1.

B3Confidentiality

Only LONUT's owner, and any person we authorise who is bound by a duty of confidentiality, may access Centre Data. They may do so only to run, support or secure the Service, or to follow your instructions.

B4Security

We make reasonable security arrangements to protect Centre Data from unauthorised access, collection, use, disclosure, copying, change or disposal, and from loss, as the PDPA and Article 32 of the GDPR require. Annex 2 describes the measures we take. We may change them over time, but never in a way that lowers the overall protection.

You are responsible for the security of what is on your side: who you invite and what you let them do, your Staff's email accounts, and your API keys.

B5Data breaches

  • If we become aware of a breach of security that leads to accidental or unlawful loss, destruction, change, disclosure of or access to Centre Data (a data breach), we will tell the Owner by email without undue delay, and in any event within 48 hours.
  • We will tell you what we know: what happened, what data and roughly how many people are affected, what we have done to contain it, and what we suggest you do. We will add more as we learn it.
  • You decide whether the breach must be notified to a regulator or to the people affected. Under the PDPA, that means notifying the Personal Data Protection Commission within 3 calendar days after you assess the breach as notifiable; under the GDPR, the supervisory authority within 72 hours. We will give you the help and information you reasonably need to do this.
  • Telling you about a breach is not an admission of fault.

B6Subprocessors

  • You authorise us to use the subprocessors listed in Annex 3, and to add others under this section.
  • We bind each subprocessor to data protection terms that protect Centre Data at least as well as this Addendum, to the extent that suits the service it provides. We remain responsible to you for our subprocessors.
  • We will give the Owner at least 30 days' notice by email before a new subprocessor starts processing Centre Data, naming it, where it processes data and what it does. We will also update Annex 3.
  • If you object on reasonable data protection grounds within that notice period, we will try to find a solution with you. If we cannot, you may close your account, and we will refund any fees you have paid for the time after it closes.

B7Transfers out of Singapore, the EU and the UK

Where the data is

Your database is kept in Cloudflare's Asia-Pacific region, which may be outside Singapore. Cloudflare serves your Timetable Page and the API from its worldwide network, close to each visitor. Resend and Stripe process data in the United States and other countries, and so does Anthropic when it reads a timetable you sent us to load.

Transfers under the PDPA

When we transfer Centre Data outside Singapore, including to our subprocessors, we make sure the recipient is bound by legally enforceable obligations, or holds a certification recognised under the PDPA, that give the data a standard of protection comparable to the PDPA's. This is what section 26 of the PDPA and Part 3 of the Personal Data Protection Regulations 2021 require.

Transfers from the EU

If you are subject to the EU GDPR and your transfer of Centre Data to us is a transfer to a country without an EU adequacy decision, the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (the SCCs) apply. They are incorporated into this Addendum by reference and completed as set out in Annex 4. You are the data exporter and we are the data importer.

Transfers from the UK

If you are subject to the UK GDPR and your transfer to us is a restricted transfer, the SCCs apply as varied by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0) (the UK Addendum), completed as set out in Annex 4.

Other points

  • If the SCCs or the UK Addendum are replaced, or another lawful transfer mechanism is needed, we may adopt it by notice to the Owner, as long as it does not lower the protection of the data.
  • If a regulator or a data subject asks you for it, we will give you a completed copy of the SCCs or the UK Addendum for your records.
  • If this Addendum conflicts with the SCCs or the UK Addendum, the SCCs or the UK Addendum prevail for the transfer they cover.

B8Helping you meet your duties

  • People's requests. The staff app lets you find, correct and delete most Centre Data yourself. If we receive a request from someone about Centre Data (for example, a parent asking about a trial booking), we will pass it to the Owner promptly, and within 5 business days at most, and we will not answer it ourselves except to say we have passed it on. We will help you answer requests within the time the law allows; under the PDPA, you generally have 30 days to respond to an access or correction request.
  • Assessments. We will give you reasonable help with data protection impact assessments, and with consulting a regulator where the law requires it, as far as they concern our processing.
  • Cost. This help is free where it is reasonable. If a request would take substantial work, we will tell you the cost first and do the work only once you agree to it.

B9Keeping and deleting data

  • We keep Centre Data only while we need it to provide the Service to you, as section 25 of the PDPA requires.
  • A trial child's first name, and any booking reference from a connected booking system, are deleted automatically 30 days after the lesson. The count of trial places stays.
  • When your account closes, we delete Centre Data within 30 days, and backup copies roll off within a further 30 days (section 11). Free accounts nobody uses are deleted as section 11 describes.
  • Before your account closes, you can take a copy of your data (section 7). If you ask us before we delete it, we will send you a complete copy in a machine-readable file.
  • We keep data after that only where the law requires us to, and then only for as long as it requires, securely and for no other purpose.
  • If you ask, we will confirm in writing that the data has been deleted.

B10Information and audits

  • We will make available the information you reasonably need to show that we meet this Addendum, including this Addendum, Annex 2, Annex 3, and written answers to a reasonable security questionnaire once a year.
  • If Data Protection Law or a regulator requires more, you may audit our compliance once in any 12 months, with at least 30 days' written notice. The audit must be at your cost, under a confidentiality agreement, during Singapore business hours, and without disrupting the Service or giving access to other centres' data. Audits under the SCCs are carried out in this way.

B11Your responsibilities

  • You must have a lawful basis for the personal data you put into the Service, and must give the notices and get the consents that Data Protection Law requires. Under the PDPA, this covers consent and notice of purposes (sections 13 to 20) and accuracy (section 23). Under the GDPR, it covers Articles 6, 13 and 14.
  • This includes telling your Staff that their details are kept in the Service, getting a parent's or guardian's consent before entering a trial child's first name, and getting a teacher's agreement before publishing their name.
  • You must not put restricted data into the Service: NRIC, FIN, passport or other identity numbers; health information; bank or card details; data about race, religion, political opinions, sexual life, criminal records, biometrics or genetics; or any data about children beyond a trial child's first name and level.
  • Your instructions to us must comply with Data Protection Law.

B12What we will never do

We will never sell Centre Data, use it for advertising or profiling, use it to train, fine-tune or improve any AI model, combine it with another centre's data (except in counts and statistics that identify no one), or use it to contact your customers.

B13How long this lasts, liability and priority

  • This Addendum lasts for as long as we process Centre Data.
  • The limits on liability in section 16 apply to this Addendum and to the SCCs and UK Addendum, as far as those allow. Nothing in these terms limits the rights of data subjects under the SCCs or the UK Addendum.
  • On personal data, this Addendum prevails over Part A. The SCCs and the UK Addendum prevail over both, for the transfers they cover.

Annex 1Details of the processing

Controller (data exporter)The centre that accepted these terms. Contact: the Owner's email address.
Processor (data importer)LONUT (UEN 53462899X), a sole proprietorship registered in Singapore, which runs Conciergr Timetable. Contact: our Data Protection Officer, hello@conciergr.com.
Data subjectsThe centre's Owner and Staff; teachers named in the timetable; trial children; any other person the centre names in the timetable.
Personal dataStaff: name, work email, the branches and permissions granted, sign-in records and sessions, and the change history (who changed what, and when). Teachers: name. Trial children: first name, level, lesson date, how the place was booked, and, if booked through a connected system, an opaque booking reference (never a phone number). Anything else the centre enters, such as a WhatsApp number or a name in a free-text field.
Sensitive dataNone. Restricted data is not allowed (B11).
FrequencyContinuous, while the centre uses the Service.
Nature of processingStorage, hosting, display on the Timetable Page, delivery through the API, sending emails to Staff, backup and deletion.
PurposeTo provide the Service to the centre under these terms.
RetentionWhile the account is open, then as B9 describes. A trial child's first name is deleted 30 days after the lesson.
SubprocessorsAs listed in Annex 3.

Annex 2Security measures

  • Encryption in transit. All traffic to the Service uses HTTPS.
  • Hosting. The Service and its database run on Cloudflare, with its physical, network and environmental security. The database is kept in the Asia-Pacific region.
  • Separation between centres. Every record belongs to one centre. All reads and writes go through a single data-access layer that takes the centre first, database constraints stop a record from pointing at another centre's records, and automated tests check that one centre cannot reach another's data.
  • No passwords. Staff sign in with a single-use emailed link that expires after 15 minutes, or with Google. Each address can request at most 5 links in 15 minutes, and sign-in attempts are rate-limited.
  • Hashed secrets. Session tokens and API keys are stored only as SHA-256 hashes. An API key is shown once, carries only the permissions it was given (read, hold trial places, edit), and can be revoked at once.
  • Sessions. The sign-in cookie is HttpOnly, Secure and SameSite. Sessions expire 30 days after last use, signing out ends the session on our side, and one person's session can be ended without affecting anyone else.
  • Access within the centre. The Owner grants each Staff member specific branches and permissions.
  • Change history. Every change records who made it and when.
  • Rate limits. Requests are rate-limited per API key, and the Timetable Page and sign-in are rate-limited per network address.
  • Public page. The Timetable Page runs under a strict Content Security Policy, and no API key ever reaches a browser.
  • Recovery. The database can be restored to any minute in the previous 30 days.
  • Minimisation. Trial children's first names are deleted automatically 30 days after the lesson.
  • Administrative access. Only LONUT's owner has administrative access to the production systems.
  • Incidents. We investigate and contain security incidents and notify you as B5 describes.

Annex 3Subprocessors

SubprocessorWhat it doesWhere
Cloudflare, Inc. Hosting, database, backups, content delivery, security and rate limiting. Cloudflare Turnstile, the bot check on the sign-up form. Database in the Asia-Pacific region. Pages and API served from Cloudflare's worldwide network. Company based in the United States.
Resend Sending service emails to Staff: sign-in links, reminders and notices. United States
Stripe Payments and billing for paid API access. Stripe handles billing details, not timetable data. United States and other countries where Stripe operates
Anthropic Only when you email us your timetable and ask us to load it: its AI assistant, Claude, reads what you sent and turns it into classes for you to check. Used on a Claude plan under Anthropic's own terms, with the setting that lets Anthropic use chats to improve its models switched off. United States

Annex 4How the transfer clauses are completed

EU standard contractual clauses

  • Module. Module Two (controller to processor) applies where you are a controller. Module Three (processor to processor) applies where you process Centre Data for another controller.
  • Signature. Each of us is treated as having signed the SCCs, including Annex I, by accepting these terms.
  • Clause 7 (docking clause): not used.
  • Clause 9(a): Option 2, general written authorisation, with 30 days' notice of new subprocessors, as B6 describes.
  • Clause 11(a): the optional wording is not used.
  • Clause 13 and Annex I.C (competent supervisory authority): if you are established in an EU Member State, its supervisory authority. If you are not, but have appointed an EU representative under Article 27 of the GDPR, the authority of the Member State where your representative is. Otherwise, the authority of the Member State where the data subjects whose data is transferred are located, as you tell us in writing.
  • Clause 17: Option 1; the SCCs are governed by the law of Ireland.
  • Clause 18(b): the courts of Ireland.
  • Annex I.A and I.B: as in Annex 1. Annex II: as in Annex 2. Annex III: as in Annex 3.
  • Certification of deletion under Clauses 8.5 and 16(d) is given on your written request.

UK Addendum

  • Table 1 (parties): as in Annex 1. The start date is the date you accepted these terms.
  • Table 2 (selected clauses): the SCCs as completed above, with the same modules.
  • Table 3 (appendix information): as in Annexes 1 to 3.
  • Table 4 (ending the addendum when the approved addendum changes): the importer may end it.
  • The Mandatory Clauses of the UK Addendum apply, and each of us is treated as having signed it by accepting these terms.