Privacy Notice

This notice explains what personal information BookUp collects, why, who we share it with, and your rights. It covers our website (bookup.online), the business website (biz.bookup.online), the BookUp Biz app, and our help site.

1. Who we are

BookUp is run by Double-Tap Development Ltd, a company registered in Scotland (company number SC635454), at 17 Gatehead Drive, Bishopton, PA7 5QQ.

For anything about your privacy, email info@bookup.online.

2. Who is responsible for your information

Who is responsible depends on the information.

• Businesses are responsible for their client records. When you book with a business on BookUp, that business decides what it collects about you and why. This covers things like notes, consultation forms, photos and marketing. For that information, we act on the business's behalf as its "processor", and the business's own privacy notice applies. Questions about it are best sent to the business, and we will pass on any we receive.
• We are responsible for everything else. This covers your BookUp account, the BookUp booking fee, business subscriptions, our website and apps, support, and our own marketing. This notice covers that information.

3. What we collect

If you book or buy through BookUp:

• your name, email address and mobile number;
• your login details, or your name, email address and profile photo from Google if you sign in with Google;
• your bookings, purchases, memberships, credits, gift cards, cancellations and no-shows;
• payment details: Stripe holds your card, and we only see its brand, last four digits and expiry date;
• details of family members you book for, such as their name, date of birth and how they are related to you;
• enquiries and the photos you send with them;
• your reviews, and the profile photo shown with them;
• forms you complete for a business, including signatures (held for the business, see section 2); and
• whether you have opened or clicked emails we send.

If you run or work for a business on BookUp:

• your name, email address and phone number, and your business's name, address and details;
• your answers to optional sign-up questions, such as how you heard about us and which booking system you used before;
• which version of our terms you accepted, and when;
• subscription, billing and fee details, and your Stripe account details;
• Staff schedules, shifts and holidays;
• messages you send our support team; and
• information about how your business uses BookUp.

If you use the BookUp Biz app, we also collect:

• a notification token, so we can send you alerts;
• your location while you take card payments, because Stripe requires it to prevent fraud; and
• a connection to nearby card readers over Bluetooth.

Face ID stays on your phone, and we never receive it.

If you visit our websites or use our apps: your device and browser type, IP address, pages visited, and error reports. Our Cookie Notice explains more.

If you run a business we think might like BookUp: your business contact details from public sources, such as your website or social media pages.

4. Why we use it, and our legal basis

What we do	Legal basis
Run your account and process your bookings and payments	Contract
Charge the BookUp booking fee and business subscriptions	Contract
Send booking confirmations, reminders, receipts and account emails	Contract
Send app notifications to business staff	Contract
Provide support, including our AI help assistant, and Cadger, the AI assistant businesses use in BookUp	Contract and legitimate interests (helping you quickly)
Keep BookUp secure and prevent fraud	Legitimate interests and legal obligation
Fix errors, including recordings of the screen (session replays) on our websites when an error happens	Legitimate interests (keeping BookUp working)
Understand how businesses use BookUp, to improve it and spot businesses that might need help	Legitimate interests
Show reviews	Legitimate interests (helping customers choose)
Tell businesses about BookUp, including prospective businesses	Legitimate interests, or consent where the law requires it
Keep financial and tax records, and records of terms accepted	Legal obligation and legitimate interests

Where we rely on legitimate interests, we have checked that they are not outweighed by your rights. You can object at any time (see section 12).

5. Sensitive information

Businesses may ask you for health information, for example in a consultation form, or take photos for your treatment record. That information is held for the business, which is responsible for having a lawful reason to collect it, usually your explicit consent. We don't use it for our own purposes.

6. Children

You must be 18 or over to have a BookUp account. Parents and guardians can book for children and add their name and date of birth, so the business can check age limits. We don't market to children.

7. Marketing

7.1 From businesses. A business you have booked with may send you marketing emails through BookUp. Every one has an unsubscribe link. If you unsubscribe, you may stop getting marketing emails from every business on BookUp, not just that one. Booking messages, such as confirmations and reminders, still arrive.

7.2 From BookUp. We send businesses emails about their account and BookUp features. They can unsubscribe from marketing at any time. We don't send marketing to customers.

8. Who we share information with

• The businesses you book with, so they can provide their services. Your details are added to their client list.
• Stripe, to process payments, and Apple, when a business takes a Tap to Pay payment.
• Service providers who run parts of BookUp for us: Google (hosting, database, sign-in, notifications and maps), Twilio SendGrid (email), Meta (WhatsApp), Algolia (search), Supabase (message records), Sentry (error monitoring), Chatwoot (support chat and AI help assistant), Anthropic (Cadger, the AI assistant businesses use in BookUp, which can look up the business's bookings and clients to answer their questions) and Slack (messages from businesses to the BookUp founders). They can only use your information to provide their service to us, and Anthropic doesn't use it to train AI models.
• Professional advisers, such as lawyers and accountants.
• Police, regulators and courts, when the law requires it.
• A buyer of our business, if BookUp is sold. They would have to respect this notice.

We never sell your personal information.

9. Information sent outside the UK

We store most information in the UK and the EU. Some service providers, including Stripe, SendGrid, Meta, Anthropic and Slack, handle information in the US. We only send it there with a lawful safeguard: the UK Extension to the EU-US Data Privacy Framework, or the UK's approved contract clauses.

10. How long we keep it

Information	How long
Your customer account	Until you ask us to close it. We then delete or anonymise it within 30 days
Booking and payment records	6 years, for tax and accounting
Business accounts and client records	While the subscription lasts, then up to 120 days (see the Data Processing Agreement)
Records of terms accepted	6 years after the business account closes
Enquiries that don't go ahead	About 30 days
Error reports and session replays	90 days
Support conversations	As long as we need them to support you
Unsubscribe records	Kept, so we can keep honouring your choice

11. Keeping it safe

We encrypt information in transit and at rest, limit who can access it, and never store full card numbers. No system is perfectly secure. If a breach puts you at high risk, we will tell you.

12. Your rights

12.1 You have the right to:

• get a copy of your information;
• correct it;
• have it deleted;
• restrict how we use it;
• object to us using it for legitimate interests or marketing;
• move it to another service; and
• withdraw consent you have given.

12.2 To use any of these rights, email info@bookup.online. We will reply within one month. For information a business holds about you, contact the business, or tell us and we will pass it on.

12.3 If you are unhappy with how we have handled your information, please complain to us first at info@bookup.online. We will acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

13. Automated decisions

We don't make decisions about you that have legal or similarly significant effects using only automated means.

14. Changes to this notice

We will update this notice when BookUp or the law changes. If a change is significant, we will tell you by email or in BookUp.

15. Contact

Double-Tap Development Ltd, 17 Gatehead Drive, Bishopton, PA7 5QQ. Email info@bookup.online.