Legal
Privacy policy
1. Who we are
Bookancy is a booking agency that provides businesses with software to manage bookings, schedules and floor plans. For enquiries sent through our contact form and for the personal data of business staff (your account), Bookancy is the data controller. For the personal data of customers that a business enters or receives through Bookancy, the business is the data controller and Bookancy processes that data on the business's behalf under a data processing agreement.
[legal name to be confirmed], Belgium. Data protection contact: privacy@bookancy.online.
2. What we collect
- Contact form enquiries
- Your name, e-mail address, business name, city, the kind of business you run, roughly how many reservations you take, and the message you write. We also record the IP address the message came from, your browser's user agent, and the page you came from.
- Staff accounts
- Name, work e-mail address, role, business, a salted hash of your password (never the password itself), sign-in and sign-out events, and the device preferences you choose (theme, menu layout).
- Customer bookings (on behalf of the business)
- Name, phone number, e-mail address, number of people, date and time, what was booked (for example a table, chair or room), booking status, arrival and departure times, the message a customer left, internal notes written by staff, and visit history.
- Technical data
- The request logs kept by our hosting provider (IP address, time, requested page) for security and availability.
3. Why we use it and on what legal basis
- To answer an enquiry you sent us and, if it goes further, to discuss working together (legitimate interest, GDPR art. 6(1)(f) — you asked us to get in touch).
- To stop automated abuse of the contact form (legitimate interest, art. 6(1)(f)). This is the only reason we keep the IP address.
- To run the booking service you or your business contracted (performance of a contract, art. 6(1)(b)).
- To keep the service secure, detect abuse and keep it available (legitimate interest, art. 6(1)(f)).
- To send customers booking confirmations or reminders the business asks us to send (contract with the business; customers' own contract with the business).
- Marketing to customers only with the customer's consent, managed by the business (art. 6(1)(a)); a customer can withdraw consent at any time.
We do not sell personal data, we do not build advertising profiles, and we do not use tracking cookies.
4. How long we keep it
- Contact enquiries: as long as the conversation is live, and up to 24 months afterwards so we remember who we have spoken to. Ask us and we delete yours sooner.
- The IP address and user agent on an enquiry: 30 days, then automatically erased from the record. A nightly job does this; it is not something we remember to run.
- Bookings and customer details: 24 months after the booking date, then anonymised for statistics, unless the business sets a shorter period.
- Staff accounts: for as long as the account exists, then 12 months of security logs before deletion.
- Hosting request logs: 30 days.
5. Who receives the data
Only Bookancy staff who need it, and — for booking data — the business's own authorised staff. We use these sub-processors:
| Provider | What for | Where |
|---|---|---|
| Vercel | hosting and delivery of the website | [region to be confirmed] |
| Supabase | database for contact-form enquiries | EU (eu-west-1, Ireland) |
| Resend | delivering the e-mail we send you | EU |
Data is not transferred outside the European Economic Area. Where a transfer would ever be needed, we would rely on the European Commission's standard contractual clauses.
6. How we protect it
- Connections are encrypted in transit (HTTPS). Passwords are stored only as salted hashes.
- Enquiries are stored in a database that rejects every request except our own server's.
- Repeated failed sign-in attempts are slowed down and temporarily refused, and sessions expire automatically (12 hours, or 30 days when you choose to stay signed in).
- Access follows the least-privilege principle and is logged. Backups are encrypted.
- The application sends strict browser security headers (content security policy, no framing by other sites, no referrer leakage).
7. Your rights
You can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to privacy@bookancy.online and we answer within one month. Customers exercise these rights with the business they booked with; we help the business answer within the legal deadline.
You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be, or with the authority of your own country.
8. Cookies, local storage and statistics
Bookancy uses no advertising cookies and no cross-site tracking. We use Vercel Analytics to count page views on this website; it sets no cookies and does not identify you or follow you to other sites.
The browser's local storage keeps only what the service needs to work: your session, your day/night choice, the menu layout and whether you dismissed a tip. Clearing your browser data removes them.
9. Children
The staff workspace is intended for adults working at a business. Customer bookings for minors are entered by an adult.
10. Changes
We will announce material changes to this policy at least 14 days before they take effect. The date at the top shows the current version.