Privacy Policy — Appointics

How we collect, use and protect personal data across the Appointics booking platform.

This Privacy Policy explains how Appointics ("Appointics", "we", "us" or "our") collects, uses, discloses and safeguards personal data when you use our website, booking platform and related services (the "Service"). By using the Service you agree to the practices described here.

Two roles. When you create an Appointics account, we are the controller of your account data. When a business uses Appointics to take bookings, the personal data that business collects from its own customers is controlled by that business — we act as a processor on its behalf and process that data only to provide the Service.

1. Information we collect

Information you give us

Account data — your name, email address and password (or Google sign-in identifier) when you register.
Business profile — business name, branding, services, staff, working hours and contact details you add to set up your booking page.
Booking data — when an appointment is booked, the customer's name, email, phone number, chosen service, provider, time and any notes.
Payment data — if you enable payments, transactions are handled by Stripe. We never receive or store full card numbers; we store only limited transaction metadata (such as amount, status and a payment reference).
Communications — messages you send us by email or contact form.

Information we collect automatically

Technical data — IP address, browser type, device and pages visited, collected through cookies and similar technologies (see our Cookie Policy).
Calendar data — if you connect Google Calendar, we access free/busy and event data solely to prevent double-bookings and sync appointments, using the permissions you grant.

2. How we use personal data

To provide, operate and maintain the Service and your booking page.
To create and confirm appointments and send confirmations and reminders by email (and, where enabled, WhatsApp or SMS).
To process payments through our payment provider.
To secure accounts, prevent fraud and abuse, and troubleshoot issues.
To respond to your requests and provide support.
To comply with legal obligations.

3. Legal bases

Where the GDPR or similar laws apply, we rely on: performance of a contract (to deliver the Service you request), legitimate interests (to secure and improve the Service), consent (for optional cookies and certain marketing), and legal obligation (to meet regulatory requirements).

4. How we share information

We do not sell personal data. We share it only with:

Service providers that help us run the platform — including Google (authentication and calendar), Stripe (payments), our email and messaging delivery providers, and our hosting and infrastructure providers — bound to process data only on our instructions.
The relevant business — booking data is shared with the business the appointment is made with.
Legal and safety — where required by law, or to protect our rights, users or the public.
Business transfers — in connection with a merger, acquisition or sale of assets, subject to this Policy.

5. International transfers

Your data may be processed in countries other than your own. Where it is transferred internationally, we take steps to ensure it remains protected in line with applicable law, including using appropriate safeguards such as standard contractual clauses.

6. Data retention

We keep personal data for as long as your account is active or as needed to provide the Service, then delete or anonymise it, except where a longer period is required for legal, accounting or dispute-resolution purposes. Businesses may delete their own booking and customer records from within their dashboard.

7. Security

We use technical and organisational measures — including encryption in transit, access controls and hashed passwords — to protect personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise these rights, contact us at privacy@appointics.com. If Appointics processes data on behalf of a business, we will refer your request to that business as the controller.

9. Children

The Service is not directed to children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

10. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the "Last updated" date. Material changes will be communicated where appropriate.

11. Contact us

Questions about this Policy or your data? Email privacy@appointics.com or visit our contact page.