Privacy Policy

1. Who we are

BookedByBeauty Ltd ("BookedByBeauty", "BBB", "we", "us", "our") is a company registered in England and Wales, company number 17381981, registered office 21 Horsfall Drive, Sutton Coldfield, B76 2BT.

BookedByBeauty provides an AI-powered client communication and booking automation platform for beauty industry businesses — salons, makeup artists, lash technicians, PMU artists, nail technicians, and mobile hairdressers (each a "Client"). Our platform connects to a Client's Gmail, Instagram, WhatsApp, and Google Calendar accounts, and uses AI agents to answer enquiries from the Client's own customers ("Customers" or "End Users"), check appointment availability, and manage bookings on the Client's behalf.

This policy explains what personal data we collect, why, how we use it, and the rights available to individuals whose data we process. It applies to our Clients (the beauty businesses who subscribe to BookedByBeauty) and to their Customers (the people who message a Client's business and interact with our AI agent).

Data Controller / Data Processor: For a Client's own account data (business profile, billing information, login credentials), BookedByBeauty acts as the data controller. For a Client's Customer data (the people who message the Client's business), BookedByBeauty acts as a data processor on the Client's behalf — the Client remains the data controller for their own customers' information, and BookedByBeauty processes that data strictly to provide the booking and communication service the Client has configured.

2. What personal data we collect

From our Clients (business subscribers)

• Business contact details (name, email, phone number, business address)
• Login credentials (stored securely, passwords hashed)
• Billing and payment information, processed via Stripe (we do not store full card details ourselves)
• Business configuration data they provide: services offered, pricing, opening hours, booking and cancellation policies, FAQs, and brand voice preferences

From Clients' Customers (end users messaging a beauty business)

When a Customer messages a Client's business through a connected channel, we process:

• Contact information available through that channel: an email address (Gmail), phone number (WhatsApp), or Instagram handle/username (Instagram)
• The customer's name, where provided during a booking conversation
• The content of messages exchanged with the AI agent, to the extent necessary to understand and respond to the enquiry
• Appointment details: service requested, date, time, and (where the Client has enabled deposits) payment status of any deposit

Platform data accessed via connected channels

Where a Client connects a channel to BookedByBeauty, we access only the data required to operate that specific channel's messaging and/or calendar functionality:

• Gmail: inbound emails to the Client's connected mailbox and their content, for the purpose of reading customer enquiries and sending replies on the Client's behalf. Access is via a Client-generated app-specific credential (IMAP), not a general mailbox export — we do not access emails unrelated to customer enquiries, and we do not use Gmail data for any purpose beyond operating the messaging feature the Client has enabled.
• Instagram (via Meta's Instagram Messaging API): direct messages sent to the Client's connected Instagram Business account, for the purpose of reading and responding to customer enquiries on the Client's behalf. We request only the instagram_manage_messages permission, and use it exclusively to read and send messages within active conversations initiated by the Customer messaging the Client's account. We do not access, use, or store any other Instagram data (such as posts, followers, or insights) beyond what is strictly necessary to operate the messaging feature.
• WhatsApp (via Meta's WhatsApp Business Platform): messages sent to the Client's connected WhatsApp Business Account, for the same purpose as above. We request the whatsapp_business_messaging permission specifically because our platform manages messaging on behalf of multiple independent Client businesses, each with their own WhatsApp Business Account — we do not access or mix data between different Clients' accounts.
• Google Calendar: appointment events on the Client's connected calendar, for the purpose of checking availability, importing existing appointments and closures, and keeping the calendar in sync with bookings made through BookedByBeauty.

3. How we use personal data

We use the personal data described above to:

• Operate the AI agent's ability to read, understand, and respond to Customer enquiries on behalf of a Client
• Check real-time appointment availability and create, modify, or cancel bookings
• Send booking confirmations, reminders, and cancellation notices
• Process deposit payments where a Client has enabled this feature, via Stripe Connect (see Section 5)
• Provide Clients with a dashboard view of their conversations, bookings, and leads
• Maintain the security, reliability, and proper functioning of the platform
• Comply with our legal obligations

We do not use Customer or Client data to train third-party AI models beyond what is required to generate a response within that conversation, and we do not sell personal data to any third party.

4. AI processing

Message content is processed using Anthropic's Claude API to generate the AI agent's responses. Message content is sent to Anthropic solely to generate a real-time reply and is subject to Anthropic's own data handling terms as our data processor for this purpose. We do not use conversation content to train our own or third-party AI models.

5. Third parties we share data with

We share personal data only with the following categories of service providers, each acting as our data processor, strictly to provide the Service:

We do not sell, rent, or otherwise disclose personal data to third parties for their own marketing purposes.

6. Data retention

We retain Customer conversation and booking data for as long as the relevant Client's account remains active, and for a reasonable period afterward to allow the Client to access historical records, after which it may be archived or deleted. Clients may request deletion of specific Customer data at any time by contacting us, and Customers may request access to or deletion of their own data through the Client business they interacted with, or by contacting us directly.

7. Data security

We take appropriate technical and organisational measures to protect personal data, including encryption of stored credentials and access tokens, secure hosting infrastructure, and restricted internal access to production data. No connected channel is granted more access than is strictly necessary to operate the specific feature it supports.

8. Your rights

If you are based in the UK or EEA, you have rights under UK GDPR / EU GDPR including the right to access, correct, or request deletion of your personal data, the right to object to or restrict certain processing, and the right to data portability. To exercise these rights regarding data processed by BookedByBeauty as a data controller (Client account data), or to raise a query about how a Client's Customer data has been processed, contact us using the details below.

If your query relates to a specific beauty business's handling of your data as a Customer, we recommend contacting that business directly in the first instance, as they are the data controller for that relationship — we will assist them in fulfilling any request as needed.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled.

9. Meta Platform Data

Where BookedByBeauty accesses data via Instagram or WhatsApp as described in Section 2, we handle that data in accordance with Meta's Platform Terms and Developer Policies, in addition to this Privacy Policy. We use Instagram and WhatsApp data solely to provide the messaging automation feature a Client has explicitly enabled, and do not use this data for advertising, sell it, or share it outside the purposes described in this policy.

10. International data transfers

Where personal data is transferred outside the UK/EEA (for example, to service providers with infrastructure in other jurisdictions), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, in line with UK GDPR requirements.

11. Children's data

BookedByBeauty is intended for use by adult business owners and their adult customers. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page.

13. Contact us

For any question about this Privacy Policy or how we handle personal data, contact:

Email: support@bookedbybeauty.co.uk
Postal address: BookedByBeauty Ltd, 21 Horsfall Drive, Sutton Coldfield, B76 2BT, United Kingdom