DRAFT — for review by a licensed attorney before acceptance by any paying customer.
Bookd provides software to service businesses ("Tenants"). We handle personal information in two distinct roles:
Tenant account data: name, email, phone, business details, password (stored hashed), plan and billing status, settings and configuration.
Client Data (on behalf of Tenants): contact information, event/booking details, messages exchanged with the Tenant's chatbot and forms, agreement contents and electronic signatures (including signature timestamps and IP addresses for signing verification), and payment metadata.
Payment information: processed by Stripe. Card numbers are entered directly with Stripe and never touch our servers. We receive transaction metadata (amounts, status, last-4) needed to operate the service.
Automatically collected: log data, device/browser information, and locally stored session data (localStorage) needed for login and preferences. We use minimal operational cookies/storage; we do not run third-party advertising trackers on tenant dashboards. Tenant public websites may include analytics or advertising pixels configured by the Tenant, which are the Tenant's responsibility to disclose.
To provide and operate the service (hosting sites, processing bookings, generating and delivering agreements, sending transactional emails, facilitating payments); to secure the platform (authentication, fraud and abuse prevention, audit records); to support and communicate with Tenants; to improve the service, including reviewing system performance and failures; and to comply with law. We do not sell personal information. We do not use Client Data to market to Clients.
Parts of the service use artificial intelligence (including chat assistants) powered by third-party AI providers (currently Anthropic). Message content necessary to generate responses is transmitted to the AI provider for processing. AI interactions may be logged to operate, debug, and improve the service. We do not permit our AI providers to use this data to train their general models under our commercial terms. AI-generated content can be inaccurate; Tenants are responsible for the information their configured assistants present.
We use vetted providers to run the platform, each processing only what their function requires:
We may update this list; material changes will be reflected in this policy.
We share personal information only: with the subprocessors above; between a Tenant and their own Clients as inherent to the service (e.g., delivering a Client's booking to the Tenant); to comply with law or valid legal process; to protect rights, safety, and the integrity of the service; or in connection with a business transfer (with notice). Never sold.
Tenant account data is retained while the account is active and for a reasonable period after closure for legal, billing, and dispute purposes. Client Data is retained per the Tenant's use of the service; when a Tenant account is terminated, data is available for export for 30 days and then scheduled for deletion, except records we must retain by law (e.g., signed agreement audit records, payment records).
We use industry-standard measures: encryption in transit, hashed passwords, tenant data isolation enforced at the query and middleware level, access controls, and audit practices. No system is perfectly secure; we will notify affected parties of a breach as required by law.
Tenants may access, correct, export, or delete their account information by contacting us; some data may be retained as described above.
California residents (CCPA/CPRA): you have rights to know, delete, correct, and opt out of sale/sharing (we do not sell or share for cross-context advertising). We do not discriminate for exercising rights. Requests: via your onboarding representative. For Client Data we act as a service provider; we will route or support requests via the relevant Tenant.
The service is not directed to children under 13, and we do not knowingly collect their information. Tenants are responsible for lawful handling of any minor-related information in their own client relationships (e.g., a parent signing on behalf of a minor in a media release).
We may update this policy; material changes will be notified via the service or email. The "Last updated" date reflects the current version.
Privacy questions and requests: via your onboarding representative.