This privacy policy explains how Bookahead Limited (“Bookahead”, “we”, “us” or “our”), registered in England and Wales with company number 17525675, handles personal information when businesses and their customers use our websites, booking tools and business-management platform.
1. Who is responsible for your information?
Bookahead Limited operates the Bookahead platform and is responsible for personal information used to provide accounts, secure the service, process subscriptions, improve our products and communicate with users.
When you book with a business using Bookahead, that business decides why it needs your booking information and is normally the data controller. Bookahead processes that information on the business’s behalf. Questions about a specific appointment, treatment record, refund or the business’s own marketing should be directed to that business first.
For privacy questions about Bookahead, email privacy@bookahead.co.uk.
2. Information we collect
- Account and profile data: name, email address, telephone number, profile image, role and authentication identifiers.
- Business data: business name, locations, team members, services, working hours, policies, websites and domain settings.
- Domain-registration data: the registered holder’s legal name, organisation (if supplied), email address, telephone number and postal address, together with the domain, registration status, price, renewal choice and record of accepting the applicable terms.
- Booking data: appointments, selected services, staff member, location, time, notes, status and customer contact details.
- Payment data: payment status, amount, currency, payment or refund method, limited card metadata such as brand, expiry and last four digits where supplied by Stripe, Stripe customer and transaction identifiers, subscription details, connected-account details, and records of cash, bank-transfer or external-terminal payments. Card details are collected and handled by Stripe; Bookahead does not store complete card numbers or card security codes.
- Payment authorisation data: the saved-card and no-show wording accepted for a booking, the applicable policy, maximum charge, policy version, date and time of acceptance, booking and account identifiers, and technical evidence such as IP address or device information where collected for security or dispute handling.
- Calendar data: calendar identifiers, availability and events needed to provide calendar synchronisation when a user connects Google Calendar or Microsoft Calendar.
- Technical data: IP address, browser and device information, security events, diagnostic logs and usage information.
- Communications: support requests, notification preferences and emails relating to accounts and bookings.
3. Information from Google, Apple and Microsoft
If you sign in with Google or Apple, we receive the basic account information you authorise, such as your provider identifier, name, email address and profile image. We use it only to authenticate you, create or link your Bookahead profile, secure your account and provide the service.
If a business user connects Google Calendar or Microsoft Calendar, we access the calendar information needed to display availability, detect conflicts and synchronise Bookahead appointments. We do not sell provider data or use Google Workspace API data to develop, improve or train generalised artificial-intelligence or machine-learning models.
4. How and why we use information
- To create accounts, authenticate users and provide bookings, websites, calendars, payments and business-management features.
- To perform our contract with business customers and take steps requested before entering a contract.
- To process customer bookings on a business’s instructions.
- To check domain availability, register and configure a domain requested by a business, administer renewal, and provide evidence of the registration instructions and terms accepted.
- To save payment methods through Stripe, process authorised payments and no-show charges, record offline payments and refunds, send receipts, reconcile balances, and respond to payment disputes.
- To meet legal, tax, accounting, fraud-prevention and security obligations.
- For our legitimate interests in protecting, operating and improving Bookahead, provided those interests are not overridden by individual rights.
- With consent where required, including certain optional integrations, cookies or marketing communications. Consent can be withdrawn at any time.
5. Who we share information with
We share information only as needed with the business receiving a booking, authorised members of that business, and suppliers that help us operate Bookahead. These currently include Supabase for database and authentication services, Vercel for hosting, Stripe for payments and subscriptions, Resend for transactional email, Upstash for rate limiting, Sentry for error monitoring, Cloudflare for requested domain registration and DNS, and Google, Apple or Microsoft when you choose their authentication or calendar services.
We may also disclose information where required by law, to protect users and the service, or as part of a corporate transaction subject to appropriate safeguards. We do not sell personal information.
6. International transfers
Some suppliers may process information outside the United Kingdom. Where required, we rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard. You can request further information using the contact details above.
7. How long we keep information
We retain information only for as long as needed for the purposes described above. Account and business data is generally kept while an account is active and for a reasonable period afterward. Booking, payment, refund and saved-card authorisation records—including the wording and policy accepted—may be retained longer where reasonably required for legal, accounting, tax, chargeback, dispute or fraud-prevention purposes. Registrant contact details awaiting submission are encrypted and normally removed from Bookahead after the registrar accepts the registration request; abandoned checkout details expire automatically. The registrar retains registration data under its own legal and contractual obligations. We do not keep payment credentials merely in case they might be useful later, and businesses should release saved payment methods when there is no continuing lawful purpose. Security logs and unsuccessful authentication records are retained for shorter operational periods. Businesses may set or apply their own retention requirements for customer records.
8. Security
We use technical and organisational safeguards designed to protect information, including access controls, encrypted connections, row-level database security, monitoring and restricted administrative access. No online service can guarantee absolute security.
9. Your rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict or object to processing of your information, and to receive portable copies of certain information. Where processing relies on consent, you may withdraw it at any time. You also have the right to object to direct marketing at any time.
For information controlled by a business you booked with, contact that business. For information controlled by Bookahead, email privacy@bookahead.co.uk. We may need to verify your identity.
10. Complaints
Please contact us first so we can try to resolve your concern. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
11. Children
Bookahead business accounts are not intended for children. Businesses are responsible for ensuring they have an appropriate lawful basis and any necessary parental authority when accepting bookings involving children.
12. Changes to this policy
We may update this policy as our products, suppliers or legal obligations change. We will publish the revised version here and update the date above. We will provide additional notice where a change materially affects users’ rights.