This Privacy Policy explains how [Legal entity name], [Address] (“we”, “us”), handles personal data in connection with Daybookly. Questions and requests: [Email].
1 Our two roles
Controller: we decide how to process the data of business owners and their team members who use Daybookly, and of visitors of daybookly.com.
Processor: when a client books with a business through its site, the business is the controller of that client’s data and we process it on the business’s behalf and on its instructions. If you booked with a business, please contact that business first about your data; we help businesses respond to such requests.
2 Data we get from businesses
- Account: name, email, password (stored only as a secure hash), basic Google profile data if you sign in with Google.
- Business and site: business name, address, contacts and social links, logo and photos, services and prices, opening hours, names, photos and descriptions of specialists.
- Billing: plan, subscription status and identifiers from the payment provider. Card details are handled by Paddle or WayForPay and never reach us.
- Communication: support messages and feedback, and the Telegram chat ID if you connect booking notifications in Telegram.
3 Data clients give when booking
Name, phone number, email, an optional comment, the chosen service, specialist and time, the language of the booking, the time consent was given, and the booking history with that business.
We do not collect medical data. Booking forms do not ask about complaints or diagnoses, and the comment field reminds clients not to include medical information.
4 Technical data
When you visit our sites, our servers log your IP address, browser and device type, the pages requested and the time. If an error occurs, a technical error report may be sent to our monitoring service. We use only the cookies described in our Cookie Policy.
5 Why we use data and on what legal basis
- To provide the Service, create and publish your site, and process bookings and notifications — performance of our contract with the business (GDPR Art. 6(1)(b)).
- To bill subscriptions and keep accounting records — legal obligation (Art. 6(1)(c)).
- To keep the Service secure, prevent spam and abuse, fix errors and improve the product — our legitimate interests (Art. 6(1)(f)).
- To send service emails (account, booking and payment notices) — contract. We send marketing emails only with your consent, and you can unsubscribe at any time.
- Clients’ booking data is processed on the business’s instructions; the business determines its legal basis.
6 Service providers (processors)
We use trusted providers that process data on our behalf. We do not sell personal data.
- Supabase — database and file storage. Data is stored in the EU (Frankfurt, Germany).
- Vercel — hosting and content delivery network.
- Resend — sending transactional emails.
- Paddle — payments for Europe and Canada. Paddle is the Merchant of Record and processes payment data as an independent controller under its own privacy policy.
- WayForPay — payments in Ukraine.
- Sentry — error monitoring.
- Google — sign-in with Google, if you choose it.
- Google — Google Analytics (statistics about the use of daybookly.com and the dashboard), only with your consent; data is collected in the EU and may be processed in the United States. Advertising features are switched off.
- Telegram — booking notifications, if a business connects them.
- Cloudflare — spam protection (Turnstile) on forms.
7 International transfers
Our main database is in the EU. Some providers process data outside the EU or your country, including in the United States, the United Kingdom and Ukraine. We rely on adequacy decisions where they exist, and otherwise on the European Commission’s Standard Contractual Clauses and equivalent safeguards.
8 How long we keep data
- Account, business and site data — while the account exists, and deleted within 30 days after the account is deleted.
- Clients’ booking data — as long as the business keeps it. A business can delete a client’s data at any time; it is deleted together with the business account.
- Billing records — as long as tax and accounting laws require.
- Server logs — up to 30 days; error reports — up to 90 days.
- Backups are overwritten on a rolling basis within 30 days.
9 Your rights
Depending on where you live, you can ask us to access, correct, delete or export your data, to restrict or object to its processing, and withdraw consent at any time. Write to [Email]; we answer within one month.
You can also complain to a data protection authority: in the EU, the authority of your country; in Canada, the Office of the Privacy Commissioner of Canada; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights.
If you are a client of a business on Daybookly, the business handles your requests; businesses can export and delete client data in their dashboard.
10 Security
All our sites use HTTPS. Passwords are stored hashed, access to data is restricted, and our providers encrypt data at rest. When our support team accesses a business account to help, every action is recorded in an audit log.
11 Children
The Service is intended for businesses and adults. Bookings for children should be made by a parent or guardian.
12 Changes
We may update this policy. We will post the new version here and notify businesses of material changes by email or in the dashboard.