Privacy policy

Who this covers

Gobookfy ("we", "us") provides booking pages and scheduling tools for businesses. Two groups of people give us personal data, and we treat them differently.

• Business owners and their team use Gobookfy to run a booking page. For their account details we are the controller of the data (we decide why and how it is used).
• Customers of those businesses book appointments through a business's page. For their booking details the business is the controller and we are its processor: we store and handle the data on the business's behalf and only as it instructs. Questions about a booking, such as changing or deleting it, are best sent to the business first.

What we collect

Depending on how you use the service, we handle the following.

• Account data: email address, password (stored only as a secure hash by our sign-in provider), and, if you use Google sign-in, the name and email Google shares with us.
• Business content: the business name, page text, services, prices, opening hours, team members, photos and other content you add to your page.
• Booking data: a customer's name, email address and phone number, the service, date and time, any answers to the questions the business added to its booking form, and the booking status (for example confirmed, cancelled or no-show).
• Notes kept by a business: private notes and warnings a business adds about a customer. Only that business's team can see them.
• Payment information: we never see or store card numbers. Cards are handled by the payment provider the business chose (PayPal, Stripe or Square). When a business asks for a card on file, we keep only the provider's reference IDs for that customer and card, the amount owed and whether it was charged. A business's own payment keys are stored encrypted.
• Activity records: a log of important actions in a business account (for example who changed a booking), used for security and so teams can see what happened.
• Technical data: our servers and our hosting provider process IP address, browser type and request details when you visit, to deliver the pages and keep the service secure.

How we use it

• To provide the service: show booking pages, take and manage bookings, and let teams work together.
• To send messages you need, such as booking confirmations, account and security emails, and password resets.
• To process payments and fees through the provider a business has chosen.
• To keep the service safe, prevent abuse and fix problems.
• To meet legal obligations and to handle questions and complaints.

We do not sell personal data. We do not show advertising, and we do not use customer booking data for marketing.

Legal bases

Where European data protection law applies, we rely on: performing our contract with you (running your account and the booking service), our legitimate interests (securing and improving the service), legal obligations, and consent where we ask for it. For customer booking data the business decides the legal basis, usually that the data is needed to make and manage the booking.

Who we share it with

We use a small number of service providers to run Gobookfy. They may only use the data to provide their service to us.

• Supabase: database, sign-in and file storage.
• Vercel: hosting and delivery of the website.
• Stripe, PayPal and Square: payments, only for businesses that turn them on, using the business's own account. Their privacy policies apply to the payment details you give them.
• Resend: sending emails such as booking confirmations.
• Google: sign-in with Google, and fonts and maps that some pages load (see Cookies and storage).

A business sees the bookings and details of its own customers. Businesses and their team members can only see their own data, not other businesses' data. We may also disclose information if the law requires it or to protect people and the service from harm.

Where data is processed

Our providers run servers in several countries, which may be outside your own. When data leaves the European Economic Area we rely on safeguards such as the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

We keep account and booking data while the account is active. A business can delete bookings, and an account owner can delete the whole account from the account settings, which removes the business data. Some data may stay in backups for a short time before it is overwritten, and we may keep limited records where the law requires (for example payment records).

Your rights

You can ask us to:

• give you a copy of your personal data, or correct it
• delete it, or restrict or object to how it is used
• move it to another service (business owners can download a full backup from their dashboard)
• withdraw consent you have given

Write to privacy@gobookfy.com. If you are a customer of a business, we may pass your request on to that business because it controls your booking data. You also have the right to complain to your local data protection authority.

Security

Data is encrypted in transit. Access to each business's data is limited by role (owner, manager or staff) and enforced in the database itself. Payment keys are stored encrypted, and card details never touch our servers. No system is perfectly secure, so please use a strong, unique password.

Children

Gobookfy is meant for businesses and adults. We do not knowingly collect data from children under 16 for our own purposes. A business that takes bookings for minors is responsible for doing so lawfully.

Changes to this policy

If we make important changes, we will update the date at the top and, where appropriate, tell account holders by email.

Contact

Questions about privacy: privacy@gobookfy.com. General questions: see Contact.