Privacy policy

Who is responsible for your data

Fairlybook ("we", "us") is responsible for the personal data of people who use our website and of business owners and staff who have a Fairlybook account.

When you book with a business through its Fairlybook booking page, that business decides how your booking details are used. The business is the controller of that data and Fairlybook processes it on the business's behalf, under a data processing agreement. For questions about a booking, contact the business first. We will help them answer you.

What we collect

• Account details: name, email address, sign-in method, two-step verification settings and the businesses you belong to. If you sign in with Google, we also copy your Google name and profile photo link at each sign-in; we only read them and never change your Google account. The photo is loaded from Google when you view the dashboard.
• Business details: business name, booking link, address and map location, time zone, languages, services, opening hours, booking rules and policy, the contact details the business chooses to show (phone, WhatsApp, email, Instagram), staff names and logo.
• Booking details, on behalf of businesses: the customer's name, email address, phone number if given, notes, the service, time and time zone, and the booking's history.
• Reviews: after a visit the business marked as completed, the customer may rate it from 1 to 5 stars and add a comment. Reviews are shown publicly on the business's booking page with the customer's first name and last initial, and are deleted when the customer's details are erased.
• Calendar connections: if a staff member connects Google or Outlook, we store an encrypted access token and the busy times from that calendar. We don't store event titles or attendees.
• Billing details: our payment provider, Lemon Squeezy, collects payment information for Fairlybook plans. We receive the plan, status and invoice references, never full card numbers.
• Technical data: IP address and browser information, used for security, rate limiting and bot checks; and error reports with personal data removed.

Why we use it

• To provide the service you signed up for: booking pages, calendars, reminders, team accounts and billing (performance of a contract).
• To keep Fairlybook secure and prevent abuse, for example rate limits, bot checks and audit logs (legitimate interests).
• To understand which features are used, with pseudonymous counts such as "a booking was created", without advertising trackers (legitimate interests).
• To record dashboard sessions to fix problems, only if you turn this on in your settings (consent, which you can withdraw at any time).
• To meet legal obligations such as tax records, which our payment provider keeps as merchant of record.

We never sell personal data and we don't use it for advertising.

Cookies

We use only cookies that the service needs to work, so no cookie banner is shown:

• sign-in session cookies, for the dashboard and the admin console;
• your chosen language;
• the time zone you picked on a booking page, for one year;
• which business you are viewing, if you belong to several;
• the business type you picked on our website, for one day, to pre-fill setup;
• your choice about session recording.

We don't use advertising or cross-site tracking cookies.

Who we share it with

We share personal data only with the service providers that run Fairlybook for us ("subprocessors"), such as hosting, the database, email delivery, billing, calendar sync, bot checks, error tracking and analytics. Each one is bound by a data processing agreement. The current list, with what each provider does and where, is on our subprocessors page.

Maps: a booking page loads a map only after a visitor taps "Show map". The map comes from Google Maps (Google LLC), or from the OpenStreetMap Foundation where Google Maps isn't set up; the visitor's browser then connects to that provider, which sees its IP address and, for Google, may set its own cookies inside the map. When a business taps "Find on map" in its settings, our servers send the address it typed to Google's address search, or OpenStreetMap's address search (Nominatim) as the fallback, without saying who sent it. Directions open in Google Maps.

We may also disclose data when the law requires it, or to protect the rights and safety of our users.

Where your data is stored

Our database and servers run in the United States. Some providers, such as email delivery, calendar sync or push notifications, may process data in other countries. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to the United States or another country, we rely on safeguards such as the European Commission's standard contractual clauses.

How long we keep it

• Customer details are erased automatically 24 months after a customer's last booking, unless the business deletes them sooner.
• When a business deletes its account, it can be restored for 30 days. After that, its data, including its customers' data and uploaded images, is permanently deleted.
• Records we must keep for legal or security reasons are kept only as long as needed, without unnecessary personal data.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to withdraw consent.

• Business owners can export all business data and delete the business from Settings → Data and privacy.
• Customers of a business should contact that business, or email us and we will pass the request on.
• You can also complain to your local data protection authority.

We answer requests within one month.

How we protect it

Each business's data is isolated from every other business at the database level. Connection tokens are encrypted, two-step verification is available to every user and required for our own staff, and access by our support team is time-limited, read-only by default and logged.

Children

Fairlybook accounts are for businesses and are not meant for anyone under 16. A business may take bookings for children, for example a tutor; in that case the business is responsible for having the right permission from a parent or guardian.

Changes to this policy

If we change this policy in a way that matters, we will tell account owners by email or in the dashboard before the change applies. The date at the top always shows the latest version.