Privacy policy

For a business's own account, like your sign-in email, daybooked decides how the data is used, as this policy describes.

Guests' data belongs to the business they book with. We process it on the business's behalf, only to run their bookings, and the business's own privacy notice applies to it. If you're a guest, the quickest way to your data is through the business. If you write to us, we'll pass your request on and help them answer it.

From businesses:

• your email address, to sign you in;
• your business details: name, booking page address, time zone and currency;
• what you set up: offerings, hours, sessions, prices, webhook URLs and API keys (we store only a hash of each key);
• Pro billing details, handled by Stripe (we never see your card number);
• technical data such as IP address, browser and logs, to keep daybooked secure and working.

From guests, on the business's behalf:

• name, email and, if given, phone number;
• what they booked: offering, time, quantity, price and any notes they write;
• if they ask a business for texts as they book, a record of that consent: the mobile number, when, where (the booking page or the business's site), the words they agreed to, and the IP address and browser it came from;
• if a business asks them to sign its waiver, each signature: the signer's name, a child's name when a parent or guardian signs for one, when they signed, and the IP address and browser it came from;
• payment status, when the business takes payments. Card details go straight to Stripe; daybooked never sees or stores them.

• to run daybooked: bookings, availability, sign-in and booking emails, and the events and webhooks sent to the business's own systems;
• to keep daybooked secure, prevent abuse and fix problems;
• to bill Pro subscriptions;
• to tell businesses about their account and about important changes.

We don't sell personal data, we don't share it for advertising, and we don't use guests' data for our own purposes.

Mobile numbers and text-message opt-in data and consent are not shared with or sold to any third parties, except the service providers that deliver the texts.

A few services run parts of daybooked for us, under contracts that protect the data:

• Supabase: database and sign-in (United States);
• Vercel: hosting, private file storage for message attachments, and Vercel Web Analytics for page views, which is cookieless, aggregated and never stores anything personal (United States); if you turn on push notifications we store that device's push address so we can send them;
• Stripe: Pro billing, and guest payments on the business's own Stripe account;
• Resend: sending emails, and receiving mail sent to daybooked.io addresses, including guests' replies to messages and mail forwarded to our support inbox;
• Twilio: delivering text messages between businesses and their guests;
• Anthropic, through Vercel AI Gateway: drafting a reply when a business asks for one, from only what that reply needs (the business's details and saved replies, the guest's first name, their booking's offering, time, quantity and payment status, and the conversation's last ten messages with emails and phone numbers removed), under zero data retention, so neither keeps it nor trains on it. When a business sets up from its website, the same service reads the public text of that website's pages to draft its offerings, on the same terms.

When a business sets where an offering meets, the map, the places suggested as they type and the address of a spot they pick come from Google Maps, in their browser. Guests get a link to that place on Google Maps, and Google's own privacy policy applies if they follow it.

Businesses can also send data onward themselves, through the API keys, AI agents and webhooks they connect. Where that data goes is up to them.

We'll disclose data when the law requires it. If daybooked is ever sold, this policy stays with the data.

We only set the cookies that keep businesses signed in to the dashboard. There are no advertising or tracking cookies. When a guest pays, Stripe may set its own cookies to prevent fraud, and on the map a business searches in the dashboard Google may set its own.

daybooked runs in the United States, on servers in California. If you use it from elsewhere, your data is transferred to and processed in the US.

We keep a business's data while its account exists.

A business can erase a guest's name, email, phone and notes at any time. The bookings stay as anonymous records, so the business's history and numbers stay right. Entries already in the business's event log are kept until the organization is deleted.

Waiver signatures are the business's record. They're kept until the business's account is deleted and are included in the business's export. They aren't removed when a guest asks to be erased, because they are the evidence of what was agreed if a claim is ever made.

If texts were sent under a guest's consent, its record (the number, when and where it was given, the words agreed to and the IP address) is kept for four years after the last text even when the guest is erased, as proof of that consent, then deleted; a number's request to stop texts is kept so it stays honoured.

Deleting an organization removes its offerings, bookings, customers, waivers and their signatures, API keys, webhooks and events from our database straight away. Backups may keep a copy for up to 30 days until they roll over.

Businesses can export everything as JSON (Settings → Download your data), correct it in the dashboard and delete their organization in Settings. Email us for anything else.

Guests can ask the business they booked with to show, correct, export or erase their data. The business can do all of that in daybooked.

Depending on where you live, for example California, the EU or the UK, you may have the right to access, correct, delete or port your data and to object to how it's used. We honor those rights as the law requires and won't treat you differently for using them. If you need a data processing agreement, ask us.

Data is encrypted in transit and at rest. Browsers can't read the database directly; only our server can, and every query is limited to one organization. API keys are stored only as hashes, and webhooks are signed.

No system is perfect. If a breach affects your data, we'll tell you promptly, as the law requires.

daybooked is made for businesses. Guests under 16 should have a parent or guardian book for them.

If we change this policy, we'll update the date at the top. For material changes, we'll email businesses before they take effect.

Questions or requests about privacy: hello@daybooked.io.