Privacy policy

1. Who is responsible

Miłosz Oleksiński controls Bookido’s account and service administration, subscriptions, support and platform security. Businesses generally control their client, staff and appointment records; Bookido processes these on their instructions under data-processing terms. Each business is responsible for its services, lawful use of those records and privacy information. Section 13 explains who to contact about your rights.

2. Accounts and business workspaces

Account identifiers, names, email and verification status, optional phone numbers, profile images, preferences and timestamps support access and account administration. Authentication uses credentials and sessions. Workspaces include business and location contacts, addresses and coordinates, websites, staff profiles, invitations, roles, permissions, schedules and service assignments. You supply data directly, or businesses and their authorised staff provide it about you. Authentication and payment providers supply verification and transaction information. Required fields are identified in the relevant flow; without them, that feature may be unavailable.

3. Clients, appointments and sales

Businesses use client contacts and notes, services, assigned staff, appointment dates and history, status, cancellation details, prices, discounts, tips, refunds and payment summaries for scheduling, service delivery and reporting. Workspace permissions determine staff access. Booking and sales records preserve contact and location details from the transaction; deleting a client card does not automatically erase historical records. Their retention and erasure are assessed separately.

4. Public information and sensitive data

Public business and staff profiles display names, descriptions, services, availability, contacts, locations and images selected for publication. Public images can be accessible by direct URL. Uploads also include filename, type, size, dimensions and uploader information. Do not put confidential client information, identity documents or card details in public content.

Ordinary notes and uploads are not intended for medical records. Service names and history can nevertheless reveal health information: the responsible business must establish an Article 6 GDPR basis and Article 9 condition, provide information and apply safeguards. Registration is not explicit health-data consent; contact us before purposes requiring additional sensitive-data arrangements.

5. Subscriptions and payments

Stripe collects subscription payment details through its payment components. Bookido receives subscription and transaction references, plans, billing periods, statuses, invoice information and payment-method summaries, not full card numbers or security codes. Stripe’s privacy information explains its processor and independent-controller roles. Business sales records are separate: recording an appointment as paid does not mean Stripe processed that payment.

6. Service notifications

Where enabled, verification, invitations, booking confirmations, reminders, changes and subscription notices can use in-app messages, email or SMS. Recipient addresses or numbers, content, sending times and delivery and error records support delivery and troubleshooting. Service messages are separate from marketing; promotional content requires the relevant permissions. Marketing withdrawal does not itself cancel appointments or necessary service notifications.

When you contact Bookido, we use your contact details and message content to respond and provide support.

7. Purposes and legal bases

For processing Bookido controls, necessary account, booking and subscription services rely on a contract with you or steps you request before one (Article 6(1)(b) GDPR). Operating the service for business representatives and invited staff, support, abuse prevention, security, troubleshooting and defending claims can rely on legitimate interests (Article 6(1)(f)), where your rights do not override them. Applicable accounting, tax and data-protection duties rely on Article 6(1)(c). Consent-based optional communications and tracking rely on Article 6(1)(a).

Businesses determine their records’ bases; their contract with Bookido is not automatically a contract basis for processing client or employee data.

8. Optional communications and marketing

Announcements, promotions, newsletters and research invitations are limited to the agreed purpose, sender and channel. Email and SMS direct marketing requires prior consent where Polish law applies (Article 398 of the Electronic Communications Law). Booking contact details do not authorise promotions; availability notifications do not authorise ongoing newsletters or research. Business permissions do not authorise Bookido marketing. Withdraw through the channel’s unsubscribe mechanism or our contact email, as easily as giving consent, without affecting earlier lawful processing or ordinary service use. We retain relevant consent and withdrawal evidence. Tracking email opens or link clicks requires its own applicable information and permissions. This policy itself is not consent.

9. Technical data and device storage

IP addresses, request times, browser and device information, errors and session identifiers support operation and security. Authentication and CSRF cookies protect access; local storage remembers interface, language and workspace preferences. Native authentication uses secure device storage. Browser settings let you clear or block storage, which may affect login. Photon receives address-search queries; OpenFreeMap and Google Fonts receive connection and request information when maps or fonts load. Optional analytics, advertising and engagement tracking require the applicable information and consent controls.

10. Who receives data

Relevant records are available to the business involved and its authorised users. Bookido’s application server is hosted by OVHcloud in Warsaw, Poland. Other providers include Supabase for files, Stripe for subscriptions, Brevo for signups and announcements and Resend for email.

Maps and fonts use the services in section 9. SMS providers and carriers, where enabled, handle recipient numbers, content and routing and delivery records; the actual provider is disclosed before use. Providers may use subprocessors under processing terms. Advisers and authorities receive data where necessary for a legal duty or justified claim. We do not sell personal data or publish private client records.

11. International transfers

Polish application hosting does not mean all data stays in Poland or the EEA. Brevo states its contact databases are hosted in the EU. Resend stores messages and logs in the US even with an EU sending region; its arrangements include EU Standard Contractual Clauses and the EU–US Data Privacy Framework. Supabase and Stripe describe international processing in their agreements. Transfers outside the EEA use an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses. Contact us for arrangements relevant to your data and a copy of applicable safeguards.

12. How long we keep data

Account data is kept while needed for the service. Business-controlled client, staff, booking and sales records follow documented business instructions and lawful retention needs. Accounting duties and specific claims can justify longer retention for the applicable statutory period or dispute.

Optional signup details are removed when requested communications are complete, their purpose ends or consent is withdrawn; we review whether the purpose remains active. Bookido support correspondence is kept up to six months after resolution unless law or a dispute requires longer. Delivery and technical logs are limited to operational, security and diagnostic needs; backups expire under applicable schedules. Minimal consent and opt-out evidence may remain to demonstrate compliance and prevent further marketing. Withdrawal does not automatically erase unrelated appointment or sales records.

13. Security and your rights

Bookido uses authenticated access, workspace permissions, session controls and file-access rules; no system guarantees absolute security.

Under GDPR conditions, request access, correction, erasure, restriction or portability, withdraw consent, or object to legitimate-interest processing; direct marketing objections can be made at any time. Contact info@bookido.app for Bookido-controlled data or the business for its records; we can route requests and handle the part we control. We may proportionately verify identity. We respond without undue delay and within one month, explaining any permitted extension within that period. Erasure covers relevant providers and historical records; we explain legal retention exceptions. You may complain to Prezes UODO in Poland or another competent authority. Bookido makes no solely automated decisions with legal or similarly significant effects; independent payment-provider checks are described by that provider.

14. Policy changes

We update this page and its revision date when processing changes, supplying additional information in features where needed. New purposes requiring consent are presented before processing begins. Updating the policy does not expand existing consent.