Privacy notice

Last updated: 10 November 2026

Who we are

Schedulo is a brand of Newey Transport Services, a sole trader business in the United Kingdom ("we", "us"). We are the controller of the personal information described here. For anything about your information, email Support@schedulo.uk.

This notice covers the website at schedulo.uk, the client area at account.schedulo.uk, the CMS at cms.schedulo.uk, the Schedulo apps (on your computer and at txc.schedulo.uk, bus.schedulo.uk and coach.schedulo.uk), licence keys, support, bug reports, the software feedback page and consultancy. We do not sell personal information, we do not use it for advertising, and we make no decisions about you by automated means alone.

The public website

• The website sets no cookies of its own and has no advertising or tracking.
• We count visits with Cloudflare Web Analytics, which does not use cookies and does not identify you. It records things like the page visited, the referring site, the country and the type of device. Our staff see only totals, such as visits per day and the most-read pages.
• The enquiry form, the licence key request on the Licensing page and the Consultancy health check do not send anything to us by themselves: they open your own email program with your message filled in, and you choose whether to send it. If you do, we receive it as an ordinary email (see Consultancy and enquiries).
• The videos on the home page and the product pages are not loaded until you press play. Pressing play loads the video from YouTube (Google) in its privacy-enhanced mode (youtube-nocookie.com), so YouTube receives your IP address and browser details and may store information on your device, under Google's privacy policy. If you do not press play, nothing is sent to YouTube.
• Our hosting provider, Cloudflare, briefly processes technical information such as your IP address to deliver the pages and protect them from attacks.

The software feedback page

If we invite you to give feedback on our software, the feedback page sends us your name, email address, your company if you give it, whether you agree to your name and company being shared, the products you tried, your scores, the positives, negatives and notes you write, your browser's name and version and your IP address. We use the IP address only to stop robots and repeat sending (each address can send a limited number a day). If you open the page from the client area, your name, email and company are filled in from your account. We use your feedback to improve Schedulo, and the owner gets an email for each response. We may quote your feedback, for example as a review on our website, but we only show your name and company with it if you tick the box on the form that says we may; otherwise it is shown anonymously. The box is never ticked for you, and you can withdraw your agreement at any time by emailing Support@schedulo.uk, after which we remove your name and company from anything we publish.

The client area and the CMS

Accounts are created only by us, for our clients and staff. For each account we hold:

• your name, email address, company, and what you are allowed to do (for example, whether you are your company's manager);
• how you sign in: a securely hashed password (never the password itself), and, if you use Sign in with Google, your Google account ID;
• invitation and password reset records (only a scrambled form of each link is kept, and links expire);
• sign-in records: when you signed in, your IP address and your browser, kept for security;
• your licence keys and key requests, the downloads you can see and take, and when you last looked at software updates (to show what is new);
• support cases, bug reports and feedback you send, and our replies;
• for client companies, the plan and billing details we agree with the company;
• a log of what is done in the client area and the CMS, and who did it.

A company manager can see their company's licence keys, key requests, support cases and bug reports, including colleagues' names. Our staff see only what their role needs.

Sign in with Google

If you choose Sign in with Google, Google tells us your name, your email address, whether Google has verified that address, and an account ID. We use this only to sign you in to your Schedulo account. We do not ask for access to your Gmail, contacts, files or anything else in your Google account, we do not use it for advertising, and we never sell or share it.

Schedulo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Emails we send

Emails from the client area and the CMS are sent from our own Gmail account, with permission only to send. That is our account, not yours: nothing in your Google account is read. We send:

• invitations to set up an account, and password reset links;
• support case updates and replies;
• licence key notices: when a key is added for you or a request is declined (the key itself is never emailed);
• a copy of each bug report you send, and updates on it when we choose to email you;
• notices about changes to these terms or this notice that affect you.

We keep a short log of emails sent (to whom, the subject and whether it was sent) to check they work. We do not send marketing emails from the client area.

Licence keys and downloads

• Each licence key is issued to a named person and company. It carries their name, company, products and dates, and may carry a computer's code if it is locked to one computer. We keep a record of every key we issue, in the Licence Manager on our own computer and in the client area, so we can support it, revoke it and prevent sharing.
• If a key is revoked, its key ID (not your name) is added to a signed list we publish online for the apps to check.
• We decide which downloads each company and person can see, and record each download (who, which file and when) so we know who has which version and can control redistribution.
• Software update notices are shown to you based on the products on the licence keys you can see. Working this out uses only information we already hold.

Support cases and bug reports

• For support cases we keep the subject, product, type, priority, messages and files, our internal notes, and any rating you give when a case closes.
• For bug reports we keep what you type, up to three screenshots or photos you attach, your browser's name and version and your IP address, together with your account. We use them only to look into the bug and reply to you. Please leave other people's personal information out of photos unless it is needed.
• If you send us files such as timetables to look at, we use them only to help you and delete them when the case no longer needs them.

The Schedulo apps

• The apps run on your own computer, or in your browser at txc.schedulo.uk, bus.schedulo.uk and coach.schedulo.uk. Your timetables, schedules and other work stay there: they are not sent to us.
• Licence keys are checked on your computer. When they are online, the apps fetch our signed list of revoked keys from GitHub, and the web versions check the time with Cloudflare or timeapi.io. These requests send no personal information, but those services see your IP address, as with any website.
• If you use live collaboration, the people you invite connect to you directly, encrypted end to end; where a direct connection is not possible, the encrypted traffic passes through a relay server run by n0 (the makers of iroh), which cannot read it.
• Roadworks shown in Schedulo TXC come from Street Manager open data, which we receive and keep for 35 days. It describes roadworks, not you.
• If you connect Schedulo to other services (such as the Bus Open Data Service with your own API key), that information goes between your computer and that service, not through us.

Consultancy and enquiries

When you email us, we keep your message and contact details to answer you. For consultancy work we also keep the quote, our correspondence and the data you give us for the work (such as TransXChange files, timetables and working rules). We use it only for that work, keep it confidential, and delete the data you gave us when the work ends, unless you ask us to keep it.

Why we use it, and our lawful basis

• To provide what you or your company have asked for (software, licence keys, downloads, updates, support, bug fixes and consultancy): this is needed for our contract with you or your company, or, where the contract is with your employer, our legitimate interest in providing it.
• To protect our software and prevent sharing or redistribution (key records, download records, revocation): our legitimate interest in protecting our software and our licensed clients.
• To keep accounts and services secure and prevent misuse (sign-in records, locking after wrong passwords, limits on the feedback page, the activity log): our legitimate interest.
• To improve Schedulo (bug reports, feedback, visitor totals): our legitimate interest in making better software.
• To keep business and tax records we are required to keep by law.

Who else handles it

We use these providers to run the service. They process information only on our instructions:

• Cloudflare: hosting of the website, the client area, the CMS and the web apps; the database and file storage (including bug report photos); website analytics; and receiving Street Manager data.
• Google: Sign in with Google; sending our emails through Gmail; storing our download files in Google Drive (when you download, Google Drive delivers the file); and YouTube, for the videos on our pages when you press play.
• GitHub: storage of the website's own pages and of the public list of revoked keys (no client information).

Some of these providers may process information outside the UK, for example in the United States or the EU. Where they do, they use safeguards approved under UK data protection law, such as the UK International Data Transfer Addendum or the UK-US data bridge.

How long we keep it

• Accounts: while you or your company are a client, and deleted within 12 months after the account is closed.
• Sign-in records, the activity log and the email log: 2 years.
• Support cases, licence key records and requests, download records and billing records: 6 years after the end of the year they relate to, as business records.
• Bug reports and their photos: until the bug is fixed or closed and the report no longer helps us improve Schedulo, and at most 2 years.
• Feedback responses: at most 2 years.
• Consultancy data you give us: until the work ends, unless you ask us to keep it.

Cookies and browser storage

The public website sets no cookies of its own. If you press play on one of our videos, YouTube may store information on your device. The website remembers your light or dark choice in your own browser's storage; that is never sent to us.

In the client area and the CMS we use one essential cookie to keep you signed in, and a second one that lasts 10 minutes while you sign in with Google. The light or dark choice is kept in your browser. There are no analytics or advertising cookies, so there is nothing to accept or refuse.

The web apps keep your work in your browser's own storage on your device.

Keeping it safe

Connections are encrypted, passwords are stored only as salted hashes, sign-in tokens and email permissions are stored encrypted or as hashes, accounts lock after repeated wrong passwords, and each person sees only the information their account allows: a client sees their own licence keys, cases and bug reports, and a company manager sees their company's. Licence keys are signed and made offline; the client area never holds the means to make them.

Your rights

Under UK data protection law you can ask for a copy of your information, ask us to correct or delete it, ask us to limit or stop using it, object to how we use it, or ask for it in a form you can take elsewhere. Email Support@schedulo.uk. We will reply within one month. If your account was set up by your employer, we may need to check with them first, because some records belong to the company's licence.

If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

Our services are for businesses and are not meant for children.

Changes

If we change this notice we will update the date at the top. If a change affects how we use your information in a significant way, we will tell account holders by email. Our terms of use explain the rules for using Schedulo.