Privacy Policy

Account data: your name, email address, phone number and password (stored only as a hash, never in readable form).

Booking data: the services you book, when, with which provider and business, plus any notes or intake-form answers you submit as part of that booking.

Payment data: the amount, status and reference of a transaction. Card and mobile-money credentials are handled by our payment provider and do not reach our servers.

Business data: if you run a business, the listing details, services, staff and availability you publish.

Technical data: IP address, device and browser information, and logs of requests to our service — used for security, rate limiting and debugging.

To create and secure your account, to take and confirm bookings, to process payments, to send booking confirmations and reminders, to show businesses their own schedules and reports, and to detect abuse.

We do not sell your personal data, and we do not use your booking history to target you with third-party advertising.

The business you book with sees your booking, your contact details and anything you submitted with that booking. It sees nothing about your bookings with other businesses — tenant separation is enforced at the database level on every query.

Our payment provider receives the data needed to take the payment.

If you connect Google Calendar, booking times and titles are written to the calendar you authorise. You can disconnect it at any time.

Infrastructure providers (hosting, email delivery, push notifications) process data on our instructions to run the service.

We may disclose data where the law requires it.

We send transactional messages — booking confirmations, reminders, cancellations, receipts — because they are part of the service you asked for.

Marketing messages, where we send them, are separate and you can opt out of them without losing transactional messages.

Account data is kept while your account is open. Booking and payment records are kept afterwards where we need them for accounting, tax or dispute-resolution purposes.

Technical logs are kept for a short operational period and then discarded.

Passwords are hashed with a modern algorithm. Traffic is encrypted in transit. Access to production data is restricted and audited, and backups are encrypted.

No system is perfectly secure. If a breach affects your data we will notify you and the relevant authority as required.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to a particular use. Most of this you can do yourself from your account settings.

Where a business is the controller of the data — for example your booking history with that business — we will pass your request on to them and help them answer it.

To make a request, use the contact details below.

BookChain is not intended for children. We do not knowingly collect data from a child without the consent of a parent or guardian. A business booking on behalf of a minor is responsible for having that consent.

We may update this policy. Material changes will be announced in the app or by email before they take effect, and the date above will change.