Privacy Policy

School and family data. When a school uses Little Desk to schedule parent-teacher conferences, that school (or its district) decides what information is collected about its staff, students, and families, and why. The school is the data controller (or, under FERPA, the educational agency or institution). Appointlet LLC processes that information on the school's instructions as a service provider and, where FERPA applies, as a "school official" with a legitimate educational interest.

Staff and parents who have questions about a school's use of Little Desk should start with that school. We will point you to the right school contact when we can.

Our own marketing and account data. Appointlet LLC is the controller of information we collect for our own purposes: school administrator accounts, billing contacts, demo and contact form submissions, and website visitors.

School staff and administrator accounts

When someone creates or is invited to a Little Desk account we collect:

• Name and email address
• Password (stored hashed) and login timestamps
• Optional profile photo, timezone, and language preference
• Staff profile details the school adds: full name, email, phone number, photo, bio, and any school-assigned staff identifier

If a staff member connects Google or Microsoft, we receive the identifiers those providers return (typically name, email, and profile photo) and OAuth tokens so we can read calendar availability and create or update conference events. We request calendar read and event scopes only. We do not request access to email contents.

Parent and student information from bookings

Parents do not create Little Desk accounts. When a parent books a conference we collect, from the person filling in the form:

• Parent name and email (a second parent name and email are optional)
• Optional phone number and messaging channel (SMS or WhatsApp), only for the parent who books and only if they opt in
• Student name
• Optional notes the parent or staff add to the booking
• Meeting time, format (in person or virtual), and any virtual meeting link

A school may also store student first and last name and parent contact details on a roster it uploads. That roster path is not part of the current booking flow, but the fields exist in the product.

School and billing information

We collect the school's name, address, phone, email, timezone, and locale; and, when the school subscribes, a billing contact name, email, mailing address, purchase-order number, and the Stripe customer and subscription identifiers needed to invoice them.

Marketing and support

Demo and contact forms collect a name, work email, school or district, optional role, and a free-text message. Those submissions are stored so we can reply.

Messages we send

We send transactional email (booking confirmations, reminders, staff invitations, invoices) and, when a parent has opted in, SMS or WhatsApp reminders. We keep a delivery record for those messages, including the destination address or phone number, status, and provider message identifiers.

Information collected automatically

Our hosts and application-performance tools record technical data such as IP address, browser and device information, and request timestamps. We use this to operate, secure, and debug the Service. We do not use it to advertise.

We use personal information to:

• Provide, operate, and secure the Service (accounts, scheduling, reminders, calendar sync, billing)
• Communicate with schools, staff, and families about their use of the Service
• Respond to demo requests, support questions, and privacy requests
• Prevent abuse and investigate security incidents
• Meet legal, accounting, and tax obligations

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use third-party advertising trackers. We use application-performance monitoring and, on littledesk.com, Google Tag Manager to measure how the site is used. See Subprocessors for those providers.

We share personal information only as described here:

• With the school. Staff at a school can see the bookings, parent contact details, and student names for that school's conferences.
• With the people in a booking. Confirmation and reminder messages go to the parent email (and phone, if they opted in) and to the relevant staff.
• With service providers (subprocessors) that process data on our instructions. The current list is on our Subprocessors page.
• If required by law, or to protect the rights, safety, or property of schools, families, or Appointlet LLC.
• In a business transfer, such as a merger or acquisition, subject to appropriate confidentiality commitments.

We do not use calendar access for any purpose other than showing availability and writing conference events the school asked us to schedule.

Little Desk sets a session cookie so you stay signed in and a CSRF cookie to protect forms from cross-site request forgery. These are strictly necessary. We do not set advertising cookies. Google Tag Manager, when a container is configured, may set measurement cookies on littledesk.com. See Subprocessors.

We keep personal information for as long as the school's account is active and as long as we need it to provide the Service, resolve disputes, or meet legal and accounting requirements.

When a school closes its account, or when a school or individual asks us to delete information we no longer need to keep, we delete or de-identify it. Transactional records we must retain for tax or legal reasons (for example, invoices) may be kept for the period the law requires.

Parents who want a booking updated or removed should contact the school first. We will honor a valid deletion request we receive directly once we have confirmed it with the school, where the school is the controller.

We use administrative, technical, and physical safeguards appropriate to the nature of the information, including encryption in transit and encryption at rest for data stored in our database. No method of transmission or storage is completely secure. If we become aware of a breach that affects your information, we will notify the school and, where the law requires, affected individuals.

Little Desk is used by schools and by parents or guardians acting for their children. We do not knowingly collect personal information directly from children under 13.

Student names and related booking details are supplied by a parent or by the school. Where FERPA applies, we treat that information as education-record data we process as a school official, and we do not use it for any purpose other than providing the Service to that school.

If you believe we have collected information from a child other than as described here, write to us at the address below and we will delete it.

Depending on who you are and where you live, you may have the right to access, correct, delete, or export personal information, or to object to or restrict certain processing.

• Parents and students. Ask the school. We will assist the school in responding.
• School staff and administrators. You can update much of your account and profile information in the Service. For the rest, email support@littledesk.com.
• Visitors and billing contacts. Email support@littledesk.com.

You can opt out of SMS or WhatsApp reminders by following the instructions in the message or by contacting the school. Transactional email about a booking you made (confirmations, time changes, cancellations) is part of providing the Service.

If you connect a Google or Microsoft calendar, you can disconnect it from your Little Desk account at any time. That stops future calendar access; it does not delete events we already wrote to the calendar.

Little Desk is operated from the United States and is intended for U.S. schools. If you access the Service from another country, your information will be processed in the United States, which may have different data protection rules than your home country. By using the Service you understand that transfer. If European or other non-U.S. privacy law applies to you, contact us at support@littledesk.com and we will work with you and the school on the request.

We will update this policy when our practices change. The "Effective" date at the top of the page will change when we do. For material changes we will notify school administrators by email or through the Service.

Privacy questions and requests:

Appointlet LLC (Little Desk) Email: support@littledesk.com