Privacy Policy

1. Information we collect

From Vendors: name, business name, email, phone number, business logo, brand color, trade type, and — if a Vendor connects Stripe — account status information from Stripe (we never see full card or bank numbers).

From Vendors, about their Customers: a Customer's name, mobile phone number, and, optionally, email address, service address, and job notes. Vendors enter this information themselves in order to schedule and bill their own Customers.

Automatically: basic usage and device data (pages visited, timestamps, IP address, browser type) for security, to keep the Service working, and to understand which parts of the product are used. We do not link this to your name or email address.

Where a signup came from: when a Vendor creates an account we record the country, region and city that our hosting provider derives from the connection. We never store the IP address it was derived from, and we do not update these afterwards. We use them only to understand which areas our advertising reaches.

And which channel sent them: if a Vendor arrives from an advertisement or a link on another site, we keep the campaign name and the the name of the site only — never the page or address they came from. It is kept in a cookie for 90 days so a click today and a signup next week are counted once, recorded when the account is created, and never updated. We use it only to understand which advertising works.

2. How we use information

• To operate the scheduling, invoicing, payment, and review features Vendors use.
• To send SMS and email on a Vendor's behalf to that Vendor's own Customers — job confirmations, appointment reminders, invoices, and payment receipts (transactional), and review requests (treated as promotional and restricted to daytime hours in the Customer's own timezone). See Section 4 below for our full SMS policy.
• To process payments through Stripe and detect fraud.
• To provide customer support and respond to inquiries.
• To maintain security and improve reliability of the Service.

We do not use Customer contact information for marketing, and we do not sell or rent personal information to anyone, ever.

3. Who we share information with

We share information only with the service providers that make BookFlows work, each acting on our behalf and under contract:

• Stripe — payment processing (Vendor subscriptions and Vendor-to-Customer payments).
• Twilio — sending and receiving SMS text messages.
• Resend — sending transactional email.
• Supabase — database hosting and authentication.
• Vercel — application hosting.
• HeyCatch — anonymous product analytics (which pages are used, and how often). It is not given your name or email address.
• Google — advertising measurement. If a Vendor arrives from a Google advertisement and later opens a trial account, Google is told that a signup happened and an account reference number. It is never given a name, an email address, a phone number, or anything a Customer entered.

We do not sell or rent information to data brokers, and the only thing an advertiser is ever told is the measurement described above — never who you are. We may disclose information if required by law or to protect the rights, safety, or property of BookFlows, our Vendors, or the public.

4. SMS / text messaging policy

A Vendor's Customer receives text messages because that Customer gave their mobile number directly to the Vendor in the course of booking a service — not because they signed up on this website. By entering a Customer's phone number into BookFlows, the Vendor confirms they have that Customer's permission to text them about their own appointments, invoices, and receipts.

Message types: appointment confirmations, appointment reminders, "running late" notices, invoices and payment links, payment receipts, payment reminders, and review requests. Message frequency varies by how often a Customer books a job with that Vendor. Message and data rates may apply. Reply STOP to a message at any time to stop receiving texts from that Vendor; reply HELP for help. Carriers are not liable for delayed or undelivered messages.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories of information described above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

5. Data retention

We retain Vendor and Customer information for as long as a Vendor's account is active, and for a reasonable period afterward to comply with tax, accounting, and legal obligations. A Vendor may request deletion of their account and associated data at any time by contacting us below; we will delete it except where we're required to keep records by law (for example, payment records).

6. Your rights

Vendors can access, correct, export, or delete their account data from Settings, or by contacting us. Customers who want to stop receiving messages from a Vendor can reply STOP, or contact that Vendor directly; Customers who want to know what a specific Vendor has stored about them should contact that Vendor, who controls their own customer records.

7. Children's privacy

The Service is intended for business use by adults. We do not knowingly collect information from children under 13.

8. Security

We use industry-standard safeguards, including encryption in transit, database-level access controls, and least-privilege access to production systems. No method of transmission or storage is 100% secure.

9. Changes to this policy

We may update this policy from time to time. We'll post the new effective date at the top of this page when we do.

10. Contact us

Questions about this policy or your data: support@getbookflows.com