ScheduleInsight is provided by Vantis Project Intelligence Ltd, a company registered in England and Wales (company number 17285923), registered office 128 City Road, London, United Kingdom, EC1V 2NX ("we", "us"). We are the data controller for the personal data described in this policy. This policy explains what data we collect, why, and how it is handled. Questions or data-protection requests: support@scheduleinsight.co.uk.
Your schedule file is parsed and analysed entirely in your browser. The .xer/.xml file is read locally with client-side JavaScript to compute the Schedule Quality Score, the metric breakdowns, the Gantt and the report — the raw schedule file is never uploaded to our servers.
The only time schedule-derived content leaves your device is when you explicitly create a shareable report link: at that point the generated report (not the source XER) is stored via our database provider (Supabase) so the link can serve it, subject to whatever passcode, expiry and revocation you set. You can revoke or delete a shared report at any time.
Your schedules are used only to provide the analysis you request. We do not use your schedule content to train models, and we do not share or sell it.
When you create a share link, the report is stored so the link can serve it. You control each link: you can set a passcode, an expiry, a recipient watermark, and you can revoke a link at any time, which immediately makes it inaccessible.
We keep account, schedule and report data while your account is active. You can delete shared reports individually, and you can request deletion of your account and associated data by emailing us; we will remove it within a reasonable period except where we must retain limited records (for example, payment records required for tax or accounting).
We rely on a small number of trusted providers to operate the service: Vercel (hosting/compute), Supabase (authentication and database), and Stripe (payments). Each processes data only as needed to deliver their part of the service.
International transfers. Some of these providers may process data on servers outside the UK and EEA (for example in the United States). Where that happens, the transfer is protected by an appropriate safeguard — such as the UK International Data Transfer Agreement / Addendum, the EU Standard Contractual Clauses, or a UK/EU adequacy decision — so your data continues to receive an equivalent level of protection.
ScheduleInsight does not use advertising or third-party analytics cookies. We use a small number of strictly necessary cookies and browser-storage items to make the service work:
Because these are essential to providing the service you've asked for, they don't require a consent banner under PECR. If we ever add analytics or marketing cookies, we will ask for your consent first and update this policy.
Where UK/EU data protection law applies, we rely on the following legal bases: performance of a contract (to create your account, process your schedules into the analytics and reports you request, and serve any share links you create); legitimate interests (to keep the Service secure and reliable through minimal request/error logs, and to prevent misuse), balanced against your rights; and legal obligation (to retain limited payment records for tax and accounting). We will ask for your consent separately before any optional processing such as marketing, and you can withdraw it at any time.
Depending on your jurisdiction (including under GDPR/UK GDPR), you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise any of these, contact us at the address above. If you are in the UK and are unhappy with how we have handled your data, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk; if you are in the EEA, you may complain to your local supervisory authority.
We use encryption in transit, scoped access keys, and provider-managed infrastructure. No system is perfectly secure, but we work to protect your data and to limit who and what can access it.
We may update this policy as the product evolves. Material changes will be reflected by the "last updated" date above.