Privacy notice

This notice explains what BookingGoose collects, why, how long it is kept and what you can ask us to do with it. It covers business owners who use BookingGoose to run a booking page, and customers who book through one.

Draft for review. Text marked TO FILL must be completed by the operator before launch.

Who we are

BookingGoose is operated by TO FILL: company legal name, TO FILL: registered address, company code TO FILL: registration number ("we", "us").

• For owners' data, we are the controller. We decide how it is used to provide BookingGoose.
• For customers' data, the business owner whose page you book on is the controller. We process your details on their behalf, only to run their booking page and send booking notices. To use your rights as a customer, contact the business owner first. We help them answer.

Contact: contact details to be added.

What we collect

From owners

• Google account: your Google account email and Google account ID, used to sign you in. We never see your Google password.
• Booking page: your display name, handle, bio, location, contact email, phone, website and Instagram link, as you enter them, and your page design.
• Business settings: your services (names, descriptions, durations, prices, rules), working hours, time off, time zone and change policy.
• Calendar connection: when you connect Google Calendar, the Google account email and ID you connected, an encrypted access token, and the ID of the BookingGoose calendar we create. From that calendar we read event times and whether they are busy. We do not read your other calendars.
• Bookings: the bookings made on your page and the ones you add, change or cancel.

From customers

• Booking details: your name, email, and, if you give them, your phone number and a note to the business owner.
• Booking: the service, time, status and the price the page showed.
• Abuse protection: your IP address and a one-way hash of your email address when you send a booking, to limit repeated attempts.
• Email records: which booking emails were sent to you and whether delivery succeeded.

On every visit

Our hosting provider records technical logs (IP address, browser, pages requested) to keep the service running and secure.

Why we use it

• To provide the service (performing our contract with owners): sign-in, publishing booking pages, showing free times, taking and changing bookings, and adding them to the owner's Google Calendar.
• To send booking emails to owners and customers: confirmations, changes and cancellations.
• To keep BookingGoose secure (our legitimate interest): rate limits, abuse prevention and error logs.
• To meet legal obligations, when the law requires us to keep or disclose information.

We do not sell personal data, show advertising, or use booking data to build profiles.

Google user data

BookingGoose asks Google for your email address and for access to calendars that BookingGoose itself creates. We use this access only to create the BookingGoose calendar, add, change and remove booking events in it, and read its busy times so that customers only see times you are free.

Google Calendar data is used only to provide booking features. It is not transferred to others except as needed to provide those features, to comply with the law, or as part of a merger or sale with your notice; it is not used for advertising; and it is not read by people except with your permission, for security, or to comply with the law.

BookingGoose's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Calendar at any time in Settings, or remove BookingGoose's access in your Google account permissions.

How long we keep it

• Owner data is kept while your account exists. When you delete your account, we delete your data, including your bookings and calendar connection, within 48 hours.
• Customer details (name, email, phone and note) are removed 24 months after the booking ends. The booking itself (service, time, status and price) stays in the owner's history.
• Abuse protection records are kept TO FILL: retention period for booking attempt records.
• Technical logs are kept by our hosting provider for TO FILL: log retention period.

Who we share it with

We use these providers (subprocessors) to run BookingGoose. Each processes data only on our instructions.

• Supabase: database and sign-in. TO FILL: hosting region.
• Vercel: hosting and technical logs.
• Resend: sending booking emails.
• Google: sign-in with Google, and Google Calendar when an owner connects it.

When you book, your details are shared with the business owner of that booking page so they can manage your booking. Some providers may process data outside the European Economic Area; where they do, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.

Cookies

BookingGoose sets only cookies that are strictly necessary:

• a sign-in session cookie for owners;
• a short-lived cookie that protects the Google Calendar connection step;
• a cookie that remembers your light or dark theme choice.

We use no analytics, advertising or tracking cookies, so we do not ask for cookie consent. If that ever changes, we will ask first.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. Owners can correct their details in the dashboard and delete their account in Settings. To make any request, write to contact details to be added. We answer within one month.

You can also complain to your data protection authority. In Lithuania, that is the State Data Protection Inspectorate (vdai.lrv.lt).

Changes

We will update this notice when what we collect or how we use it changes, and change the date at the top. For significant changes, we will tell owners by email before they apply.