Privacy Policy.

This policy explains how BookAppointment ("we", "us", "our") collects, uses and protects personal data when you visit our website (www.bookappointment.co.uk), create an account, subscribe to a plan, or make a booking on a shop that uses our platform. It is written to comply with UK GDPR and the Data Protection Act 2018.

If you use our iOS app, BookAppointment for Business, see the App Privacy Policy for the App Store Connect disclosure.

1. Who we are

BookAppointment is a UK-built booking platform for salons, spas, clinics and other appointment-led businesses, operated by BOOKAPPOINTMENT LTD, a company registered in England and Wales (company number 17481702, registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ). We act as a data controller for our own website and account holders, and as a data processor when we host booking data on behalf of a shop (the "tenant") that uses our platform. In that case the tenant is the controller of their customer data.

BOOKAPPOINTMENT LTD is registered with the Information Commissioner's Office (ICO) under registration reference ZC268227. If you're unhappy with how we've handled your data, you can complain to the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We'd appreciate the chance to put things right first — email privacy@bookappointment.co.uk.

2. What we collect

• Account data — name, email, hashed password, business details, billing address.
• Booking data — appointments, services booked, staff assigned, notes, tips.
• Customer data (on behalf of tenants) — name, email, phone, appointment history; for permitted business types this may include intake/consent records or property viewing preferences.
• Payment data — handled by Stripe (including Tap to Pay and card readers); we store the last 4 digits, card brand and Stripe customer IDs only.
• Identity verification — where required, Stripe Identity verifies your ID; we store the result only, never the document.
• AI assistant conversations — chat messages between end customers and a tenant's AI assistant, stored per-tenant so the business can review them.
• Device data — push notification tokens for staff who enable notifications in our iOS app, plus notification preferences.
• Usage data — pages viewed, features used, log data, IP address (kept short-term for abuse prevention).
• Cookies — see our Cookie Policy.

3. Why we use it (legal bases)

• Contract — to run your account, process bookings and payments.
• Legitimate interests — to keep the service secure, prevent fraud, and improve features.
• Legal obligation — accounting, tax and regulatory records.
• Consent — for optional marketing emails and non-essential cookies. You can withdraw consent at any time.

4. Who we share it with

With explicit advertising consent, I use Meta Platforms (Facebook and Instagram), the Meta Pixel and Conversions API to measure and optimise BookAppointment ads. I share visits, completed business sign-ups and submitted marketing enquiries, their time, page address, browser information, IP address and advertising cookie identifiers. Names, emails, phone numbers, form text and tenant customer bookings are excluded. Meta may combine events with its own platform data. Consent evidence records the visitor reference, time, region, choice and notice version; withdrawal preserves earlier evidence. Withdraw through Cookie settings or contact privacy@bookappointment.co.uk. This also applies to any future CRM lead sharing; no CRM customer matching is enabled here.

We only share data with providers strictly necessary to run the service:

• Stripe — payment processing, Tap to Pay / Terminal and identity verification (UK/EU/US).
• Cloudflare — hosting, DNS and DDoS protection (UK/EU).
• Supabase — database and authentication (EU region).
• Resend — transactional email delivery.
• Twilio / MessageBird — SMS delivery (only if you enable SMS features).
• Google (Gemini) — powers the AI chat assistant; conversation text is processed to generate replies, not used to train models.
• Apple Push Notification service — delivers notifications to our iOS app (device tokens only).

We never sell your data. We only transfer data outside the UK/EEA under Standard Contractual Clauses or equivalent safeguards.

5. How long we keep it

• Account data — while your account is active, plus 30 days after cancellation.
• Booking and financial records — 6 years (UK accounting requirements).
• Support tickets — 24 months.
• Marketing preferences — until you unsubscribe.
• Aggregated, anonymised statistics — kept indefinitely; these cannot be traced back to a person or a business.

We also produce aggregated and anonymised statistics from platform activity — things like booking volumes, no-show rates, popular services and pricing benchmarks — to improve the product, spot abuse and publish industry insights. This information is stripped of names, contact details and anything that could identify an individual or a single business, so it is no longer personal data. We do not sell personal data or customer lists.

Where an end customer chooses to create a BookAppointment account instead of booking as a guest, that account belongs to them and works across every business on the platform. We are the controller of that account record and may email them about their bookings and account, and about the platform only where they have opted in.

6. Your rights

Under UK GDPR you have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Erase data (where we're not required to keep it).
• Restrict or object to processing.
• Data portability.
• Withdraw consent where processing is based on consent.
• Complain to the Information Commissioner's Office (ICO).

To exercise any of these rights, email privacy@bookappointment.co.uk.

7. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access is role-based and audited. We follow least-privilege principles for staff access. Read more on our Security & GDPR page.

8. Data on behalf of shops (tenants)

When a shop uses BookAppointment to run its bookings, that shop controls its own customer data. If you're a customer of a shop, contact the shop directly for access, correction or deletion requests. We'll assist as processor and route the request if you're not sure who to contact.

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or a banner in the app. The "last updated" date at the top always reflects the latest revision.

10. Contact

Data Protection contact: privacy@bookappointment.co.uk
General support: bookappointment.co.uk/support