Privacy policy Privacy policy

This policy explains what personal information TidyBookings handles, why, and what you can do about it. It applies to business owners and staff who use TidyBookings, to their clients who book through a booking page, and to visitors of this website.

Who we are

TidyBookings is run by [Company legal name], [Registered address], [Country] ("we" or "us"). For most of the information in this policy we are the controller, which means we decide why and how it is used. The exception is information about the clients of businesses that use TidyBookings, explained under Your clients' information.

Privacy questions: [Contact email]. EU representative: [EU representative, if required]. Data protection officer: [Data protection officer, if appointed].

Who this policy covers

• People who create a TidyBookings account to run a business, and staff who log in to one.
• Clients who book, move or cancel an appointment through a business's booking page.
• Anyone who visits this website or sends us a message.

This policy doesn't cover what a business does with its clients' information outside TidyBookings. Each business has its own duties to its clients and may have its own privacy notice.

What we collect

When you create an account

Your name, email address and password. Passwords are stored hashed, so nobody can read them back. If you turn on two-factor login, we store the secret and recovery codes it needs. Staff logins that an owner creates hold the staff member's name, email address and working hours.

When you set up a business

The business name, the trade you picked, your timezone, services with their durations, prices and capacity, opening hours, booking rules, and your booking page content: title, description, logo, background image, brand color and search engine fields. Most of this is shown on your public booking page.

When a client books through a booking page

The client's name and email address, and their phone number if they give it. The service, date, time and staff member they choose, and any later changes or cancellation. Waitlist entries with the preferred date and time. Notes the business adds to the client's record.

When a booking is made, moved or canceled, we record the IP address and browser details of the request, so there is a record of who changed what.

When you send us a message

Your name, email address, the subject and your message. We also use your IP address for up to an hour to limit how many messages can be sent from one address.

When you visit this site or a booking page

We count visits to this website and to public booking pages with Umami, an analytics tool that doesn't use cookies. It records visits in aggregate: pages viewed, the referring site, browser, operating system, device type and country. We don't use it to identify you, and it doesn't run in the signed-in dashboard.

Cookies

We only use the cookies needed to run the site: a session cookie that keeps you logged in, a security token that protects forms from forgery, and a "remember me" cookie if you choose that when you log in. These are strictly necessary, so we don't ask for consent to them. We don't use advertising or tracking cookies.

Server logs

Our servers may keep technical logs, such as IP addresses, times and pages requested, to run the service and investigate problems.

How we use it, and why

Data protection law, including the EU and UK GDPR, requires a legal basis for each use.

• To provide TidyBookings: running your account, showing your booking page, taking bookings and sending booking emails. Basis: our contract with you. For clients' information, we act on the business's instructions.
• To send service emails: email verification, password resets and booking notices to staff. Basis: our contract with you.
• To keep the service secure and prevent abuse: two-factor login, limits on repeated attempts, booking change records and logs. Basis: our legitimate interest in keeping TidyBookings and its users safe.
• To answer your messages: replying to what you send through the contact form. Basis: our legitimate interest in replying, or steps you ask for before entering a contract with us.
• To improve the site: counting visits in aggregate. Basis: our legitimate interest in running a useful website.
• To meet legal obligations: keeping required records and answering lawful requests from authorities. Basis: legal obligation.

We don't sell personal information or use it for advertising. We don't send marketing emails; if that changes, we'll ask for your consent first where the law requires it.

Your clients' information

When a client books with a business through TidyBookings, the business is the controller of that client's information, and we are its processor.

• The business decides what it collects and how it uses it. It is responsible for having a legal basis and for telling its clients how their information is used.
• We use clients' information only to provide TidyBookings to that business: showing free times, recording bookings and sending emails on the business's behalf. Those emails are the confirmation, reschedule and cancellation emails, a reminder a day before the appointment (or a day before online changes close if the business's cutoff is a day or longer), a waitlist alert when a full day frees up, and a reminder to book again if the business turns that on for a service.
• We don't use one business's client information for another business or for our own purposes, apart from keeping the service secure and meeting legal obligations.
• TidyBookings is built for appointments, not health records. Businesses shouldn't put medical or other sensitive details in client notes.

If you booked with a business and want to see, correct or delete your information, contact that business. We'll help it respond, and if you write to us instead, we'll pass your request on.

[Data processing agreement: where businesses can read and accept it]

Who we share it with

• The business you book with sees the booking information you give it.
• Service providers that run parts of TidyBookings for us, under contracts that limit how they may use the information:
  • Hosting: [Hosting provider and data location]
  • Email delivery: [Email delivery provider and data location]
  • Analytics: [Umami host and data location]
  • [Other sub-processors]
• Authorities or others when the law requires it, or to protect the rights and safety of people.
• A buyer or successor if [Company legal name] is sold or merged, who must keep to this policy.

International transfers

[Where information is stored and processed, and the safeguards used when it moves out of the EU, the UK or the US, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.]

How long we keep it

• Accounts and businesses: while your account is open. When you delete your account from your settings, we delete it together with the businesses you own and their services, bookings and client records. [How long deleted data stays in backups]
• Clients' information: kept for the business while it uses TidyBookings and deleted with the business. [Retention period for client information, if any]
• Demo bookings: bookings made with the demo businesses at the demo page are deleted when the demos reset each day.
• Messages to us: [Retention period for contact messages]
• Booking change records and server logs: [Retention period for records and logs]

Your rights

If you're in the EU, the UK or a country with similar laws, you have the right to:

• see the personal information we hold about you and get a copy;
• have it corrected if it's wrong;
• have it deleted;
• restrict or object to how we use it, including where we rely on legitimate interests;
• receive it in a portable format;
• withdraw consent where we rely on it;
• complain to your data protection authority. [Lead supervisory authority, if any]

If you live in a US state with a privacy law, such as California, you may have similar rights to know, correct and delete your information, and not to be treated differently for using them. We don't sell or share personal information for targeted advertising.

You can change your name and email address in your profile settings and delete your account from your settings at any time. For anything else, email [Contact email]. We may need to confirm your identity first, and we'll answer within the time the law allows, usually one month.

Security

• Every account can turn on two-factor login.
• Passwords are stored hashed.
• Each booking has its own private manage link. Anyone with the link can change that booking, so clients shouldn't forward their booking emails.
• [Hosting security measures: encryption in transit and at rest, backups, access controls]

No system is perfectly secure. If a breach affects your information, we'll tell you and the authorities where the law requires it.

Children

TidyBookings is for businesses and isn't meant for children to use on their own. We don't knowingly collect information from children under [Minimum age]. Some businesses, such as tutors and family doctors, take bookings for children. A parent or guardian should then book with their own details, and the business is responsible for that information.

Changes to this policy

We'll update this policy as TidyBookings changes. When a change is significant, we'll post it here with a new date and, if you have an account, tell you by email.

Contact

[Company legal name], [Registered address], [Country]. Email [Contact email], or use the contact form.