Privacy Policy

2. What Data We Collect and Why

We collect personal data when you register for an account, use our services, or interact with us. Below is a summary of the data we collect and the lawful basis for processing it:

Account Registration Data

Data collected: Name, email address, phone number, business name, address

Lawful basis: Contract (Article 6(1)(b) UK GDPR) — necessary to provide you with access to our platform and services.

Client Records

Data collected: Client names, contact details (email, phone), appointment dates, service history, service preferences, and any additional notes you store

Lawful basis: Contract (Article 6(1)(b) UK GDPR) — to facilitate booking management and service delivery through our platform.

Important note: When you input client data into our platform, you are acting as the data controller and we are acting as your data processor. You are responsible for obtaining appropriate consent from your clients to share their data with us. Our Data Processing Agreement sets out our responsibilities as your processor.

Payment Information

Data collected: Subscription tier, billing address, transaction history (but NOT payment card details)

Lawful basis: Contract (Article 6(1)(b) UK GDPR) — to process subscriptions and manage billing. Card details are handled directly by Stripe (see Section 4).

Usage Data and Analytics

Data collected: IP address, browser type, pages visited, time spent on pages, interactions with features, device type

Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR) for the server and security logs our host keeps, for bot checks on our sign-up and sign-in forms, and for error reports — to keep the service secure and working. Consent (PECR and Article 6(1)(a) UK GDPR) for product analytics, which only run if you allow analytics cookies.

Chats and Calls with Our AI Assistants

Data collected: The messages you type to the chat assistant on our website or on a business's website, text messages you send to a business's Bookd number, the transcript and summary of a call to a business that uses our voice receptionist (and the caller's phone number), and any name, email address or phone number you choose to give so someone can get back to you.

Lawful basis: Legitimate interests (Article 6(1)(f) UK GDPR) — answering your question and passing your enquiry on. When you chat with, text or call a business that uses Bookd, that business is the data controller and we process the conversation on its behalf.

Campaign Measurement

When you create an account, we record the campaign labels in the link you signed up from (for example, that it came from a Facebook advert) and your answer to “How did you hear about Bookd?”. We use them to understand which marketing brings us customers. They come from the sign-up itself, so nothing is stored on or read from your device for this and it does not depend on your cookie choice. Our lawful basis is legitimate interests, and we keep these labels with your account until the account is deleted. If you also allow analytics or marketing cookies, we keep campaign labels in your browser for up to 30 days so that a later sign-up can still be matched to the campaign. Our account records separately track verified registration, completed setup, confirmed bookings and successful subscription payment so we can operate and assess the service.

Business Outreach

We contact some businesses that might benefit from Bookd. We find them in public sources — the Companies House register and business listings on Google Maps, which we gather using Apify — and keep the business contact details, the evidence that we may contact them, and any opt-out in HubSpot. We send these emails and process replies through Google Workspace, and use Anthropic's AI to sort replies (for example, spotting an unsubscribe request) so a person can follow them up. Every outreach message provides an opt-out. We retain the minimum suppression record needed to honour an objection even if other prospect or CRM records change. Booking and account-service messages are separate from outreach. You can contact us using the details below to ask about your information or object to direct marketing.

Communication Data

Data collected: Email content, support tickets, feedback, complaint records

Lawful basis: Contract (Article 6(1)(b) UK GDPR) — to respond to your inquiries and provide customer support. Legitimate interests — to maintain records and resolve disputes.

Marketing Data

Data collected: Email address, preferences, engagement with marketing communications

Lawful basis: Consent (Article 6(1)(a) UK GDPR) — for direct marketing via email under PECR. You may withdraw consent at any time by clicking "unsubscribe" in any email or contacting us.

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing and administering your account and access to our platform
• Processing subscription payments and managing billing
• Sending service-related notifications (appointment reminders, account updates)
• Sending transactional emails (payment confirmations, password resets)
• Improving our platform, features, and user experience
• Analysing platform usage and performance
• Providing technical and customer support
• Detecting and preventing fraud, abuse, or security incidents
• Complying with legal obligations and enforcing our Terms of Service
• Sending marketing communications (with your consent under PECR)

4. Third-Party Data Processors

We use the following service providers, who process personal data on our behalf. All processors are contractually bound to comply with UK GDPR and adopt appropriate security measures. Meta also uses advert-measurement data for its own purposes, under its own privacy policy:

Running the service

Email and text messages

AI assistants

Only if you allow them (cookie choices)

Our own business operations

We have data processing agreements in place with all third parties that require them. These agreements ensure that your data is processed lawfully and securely. We do not share your data with any third parties for their own marketing purposes without your explicit consent.

5. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Account data: Retained for the duration of your subscription plus 12 months after cancellation (for historical/financial records)
• Client records: Retained as long as needed for your business operations. You can request deletion at any time
• Pet photos: Stored as legitimate interest for grooming record-keeping. Image metadata (EXIF including any location data) is stripped client-side before upload. Photos are compressed to 500KB / 1280px on upload before they ever leave your device. Photos are retained until the groomer manually deletes them or the associated pet or customer record is deleted (cascade). Customers may ask their groomer to delete photos at any time. Photo hosting currently runs on the Supabase Free tier (1GB shared cap with daily backups but no point-in-time recovery); we monitor usage and will move to a paid tier with PITR before approaching the cap
• Payment data: Retained as required by UK tax law (6 years for business records)
• Marketing communications: Retained until you unsubscribe or request deletion
• Support tickets: Retained for 2 years for dispute resolution and service improvement
• Usage analytics: Up to 24 months (in aggregated, non-personal form)

If you delete your account, we will securely delete your personal data within 30 days, unless we are required by law to retain it. You may also request erasure of your data at any time (see Section 7).

6. Cookies and Similar Technologies

We use a small number of cookies and browser-storage items to keep you signed in and to remember choices you make. We only set analytics cookies (PostHog) or marketing cookies (Meta) if you allow them in our cookie banner: visiting the site does not by itself give consent, rejecting is as easy as accepting, and you can change your choice at any time with the Cookie settings button shown on every page.

Our Cookie Policy lists every cookie and storage item by name, with who sets it, why, and for how long.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. We will provide this within one month of receiving your request.

Right to Rectification

You can request that we correct inaccurate or incomplete personal data about you.

Right to Erasure ("Right to be Forgotten")

In certain circumstances, you can request that we delete your personal data. This right is not absolute and may not apply if we have a legal obligation to retain the data.

Right to Restrict Processing

You can request that we limit how we use your data in certain situations (e.g., if you believe the data is inaccurate).

Right to Data Portability

You can request your data in a structured, commonly used format so you can transfer it to another service provider.

Right to Object

You can object to us processing your data for direct marketing purposes or on the basis of legitimate interests. You can unsubscribe from marketing emails at any time by clicking "unsubscribe" in any email.

Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing if it produces a legal or similarly significant effect. We do not make decisions like that about you.

Our AI assistants — Teddy, the chat assistant on our website and on businesses' websites, and the voice receptionist — answer questions using only the business's own information, take messages and pass enquiries on. They do not accept or refuse bookings, set prices or make any other decision about you: the business, a person, does that, and anything the assistant can't answer is handed to them. Our sign-up bot check can stop a sign-up that looks automated; if you think it has blocked you by mistake, email us and a person will look at it.

How to Exercise Your Rights

To exercise any of these rights, please contact us at info@getbookd.io with details of your request. We will respond within one month. You may need to provide proof of identity to confirm your request.

8. International Data Transfers

Several of the providers in Section 4 are based in, or process data in, the United States — for example Vercel, Stripe, Resend, Twilio, Anthropic, OpenAI and Cloudflare. Where personal data leaves the UK, we rely on one of these safeguards:

• UK adequacy regulations, including the UK–US data bridge for US providers certified to it
• The ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing agreement

We primarily process data within the UK and European Union. Where services involve international transfers, we ensure these safeguards are in place.

9. Data Security

We implement comprehensive technical and organisational measures to protect your personal data:

• End-to-end encryption for data in transit (TLS/SSL)
• Encrypted data storage at rest
• Regular security audits and penetration testing
• Access controls and role-based permissions
• Staff training on data protection and security
• Incident response procedures for data breaches
• Backup and disaster recovery systems

However, no method of transmission over the internet is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

Data Breach Notification

In the unlikely event of a personal data breach, we will notify affected individuals within 72 hours (unless the breach is unlikely to result in risk to your rights and freedoms). We will also report breaches to the Information Commissioner's Office (ICO) where required.

10. Children's Data

Our platform is not intended for children under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a child has provided data to us, we will take steps to delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately.

11. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of significant changes by posting the updated policy on our website with a new "Last updated" date.

Your continued use of our services following such changes constitutes your acceptance of the updated privacy policy.

12. Contacting Us About Privacy

If you have questions about this privacy policy, your rights, or how we handle your data, please contact us:

Complaint to the ICO

If you believe we have not handled your data properly or violated your rights, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

You can also use the ICO's online complaint form at ico.org.uk/make-a-complaint.