Privacy Policy

1. Who we are and our two roles

SMB Booking, [set NEXT_PUBLIC_LEGAL_ADDRESS] (contact: [set NEXT_PUBLIC_LEGAL_EMAIL]) provides booking software to merchants. We act in two roles:

• Controller of merchant account data (the people who sign up to use the service).
• Processor of customer data (the people who book with a merchant). The merchant decides why that data is collected and is the controller; we process it on their instructions. Customers should contact the merchant first about their data.

2. What we collect

• Merchants: name, email address, a password hash or Google account identifier, business details and settings, and the date and version of the terms you accepted.
• Customers: name, email address, optional phone number, and their bookings, payments, waitlist entries and package or gift card purchases with a merchant.
• Technical: a session cookie for logged-in merchants and standard server logs (IP address, request details) for security and debugging.

3. Why we use it

• To provide the service: showing availability, taking bookings and payments, sending confirmations and reminders, and managing clients. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• To keep the service secure, prevent abuse and fix problems. Legal basis: our legitimate interests (Article 6(1)(f)).
• To meet legal and accounting obligations, such as keeping payment records. Legal basis: legal obligation (Article 6(1)(c)).
• Where a merchant processes their customers' data for their own purposes, the merchant is responsible for the legal basis.

We do not sell personal data or use it for advertising, and we do not make decisions about people based solely on automated processing.

4. Who we share it with

Only service providers that help us run the product, under contract (see the subprocessor list):

• Email delivery provider (booking confirmations and account emails).
• Payment provider (to take and refund payments).
• Google, if you choose to sign in with Google.
• Hosting and infrastructure providers.

We may also disclose data where the law requires it.

5. How long we keep it

• Account data is kept while your account is open and deleted or anonymised after you close it, except where we must keep records.
• When a customer's data is deleted, their contact details are removed; booking and payment records remain in anonymised form because merchants need them for accounting and reporting.
• Payment and accounting records are kept for as long as tax and accounting law requires.

6. Your rights

Under the GDPR and similar laws you can ask to access, correct, export or delete your personal data, and to object to or restrict certain uses, and to withdraw consent where processing is based on it. Merchants can export or delete a client's data from the client page in the dashboard. Customers should ask the merchant they booked with; if that isn't possible, contact us and we will help. You may also lodge a complaint with your national data protection authority (for example, in the EU member state where you live or work).

7. International transfers

Our providers may process data outside your country. Where data leaves the EEA or UK we rely on appropriate safeguards such as standard contractual clauses.

8. Cookies

We use one essential cookie to keep merchants logged in. See the Cookie Notice.

9. Changes and contact

We will update this policy when our practices change and show the date at the top. Contact us at [set NEXT_PUBLIC_LEGAL_EMAIL].