Privacy

Who we are

Bookable is operated by Bookable. This policy explains how we handle personal information when businesses use the platform, when their clients make bookings, and when someone contacts us.

Information we handle

Depending on how you use the service, this can include:

• account details such as name, email address and organisation membership;
• business settings, services, staff, roster and booking information;
• client contact details, booking history, notes and communication preferences entered by a subscribing business or its clients;
• payment and billing references supplied by payment providers;
• message delivery records, audit information, security logs and technical diagnostics; and
• information you send us when asking for support or a demo.

How we use information

We use information to provide and secure the service, process bookings, send requested communications, support businesses, administer billing, prevent abuse, diagnose faults and improve the product. We do not sell client lists or use one business's client data to promote another business.

Businesses and their clients

A subscribing business controls the client information it collects through its booking site and admin account. We process that information to provide the service on the business's behalf. Questions about a particular booking, client note or marketing preference should usually be directed to the business first.

Marketing messages

A subscribing business can send marketing messages, by email or text, to clients who have agreed to receive them. The business chooses the recipients and the wording, and is responsible for having its clients' consent. We send the messages on its behalf.

To support that, we store:

• when each client gave consent to email or text marketing, and when they withdrew it;
• the consent wording a business has set for its booking form, and a record when that wording is changed; and
• delivery records for campaign messages, such as which message was sent, to which client, when, and whether it was delivered.

Every marketing message carries an unsubscribe link. It works without signing in, and withdrawing consent through it is recorded straight away.

Service providers

We use specialist providers where necessary to operate the platform. These can include hosting and infrastructure providers, Stripe for supported card payment functions, Resend for email delivery and Mobile Message for SMS. If error tracking is turned on, reports of technical errors go to an error-tracking provider (Sentry or a compatible service) with account details other than an internal id, email addresses, phone numbers and request contents removed first. A provider receives only the information needed for the service it performs and handles that information under its own legal and security obligations.

Security and retention

We use access controls, tenant-scoped data access, encryption in transit, restricted operational access and application security controls designed to protect information. No online service can promise absolute security. We keep information for as long as it is needed to provide the service, meet legal or accounting requirements, resolve disputes and maintain appropriate records.

Access, correction and deletion

Businesses can export core client and booking information from the service. You can also contact us to request access to or correction of personal information we hold about you, or to ask a privacy question. Some records may need to be retained where required for security, financial, dispute or legal purposes.

Contact

Privacy questions can be sent to contact@hendersondigital.com.au.