Privacy Policy

Booknesta ("we", "us", "our") operates the Booknesta platform — an online booking and scheduling service for businesses. This Privacy Policy explains how we collect, use, share, and protect information about you.

For questions about this policy, contact us at privacy@booknesta.com.

2.1 Information you provide directly

• Account data: name, email address, password (stored as a bcrypt hash — we never store plain-text passwords)
• Business data: business name, location address, service descriptions
• Booking data: customer names, email addresses, phone numbers, appointment details
• Payment data: billing cycle and tier — we do not store payment card details (handled by Paddle)

2.2 Information collected automatically

• Server logs: IP address, browser type, pages visited, timestamps
• Authentication tokens stored in your browser

• To provide and operate the Booknesta service
• To send transactional emails (booking confirmations, account verification, password resets)
• To process subscription payments via Paddle
• To monitor service health and investigate abuse
• To comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising profiling.

We share your data only with the following sub-processors, each bound by a Data Processing Agreement (DPA):

• Paddle — subscription payment processing. Paddle acts as Merchant of Record and is subject to its own Privacy Policy. We share only the data necessary to complete transactions (name, email, billing country).
• SendGrid (Twilio) — transactional email delivery (booking confirmations, password resets, account notifications). We share recipient email addresses and personalised message content solely for sending.
• PostgreSQL database hosting provider — secure storage of all application data on EU-based servers under a signed DPA.
• Legal authorities — when required by applicable law, regulation, or valid court order.

We do not sell your data or share it with advertising networks.

Our primary data storage is located within the European Economic Area (EEA). Where any sub-processor is located outside the EEA (e.g., SendGrid infrastructure in the United States), we ensure adequate safeguards are in place through the European Commission's Standard Contractual Clauses (SCCs) or equivalent approved transfer mechanisms.

You can request a copy of the applicable transfer safeguards by contacting us at privacy@booknesta.com.

We retain your account data for as long as your account is active. If you close your account, we delete or anonymise your personal data within 30 days, except where we are required by law to retain it longer (e.g., financial records for 7 years).

If you are located in the European Economic Area, you have the following rights:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — limit how we process your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, contact privacy@booknesta.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

We protect your data using industry-standard measures including:

• Passwords hashed with bcrypt (10 rounds)
• Password reset tokens stored as SHA-256 hashes — never in plaintext
• HTTPS-only data transmission
• Regular security reviews

No method of transmission over the Internet is 100% secure. We encourage you to use a strong, unique password.

Booknesta uses cookies and similar technologies for:

• Authentication (keeping you logged in)
• Session security

We do not use third-party advertising cookies or tracking cookies. Your cookie consent is not required for the service to function.

Booknesta is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us immediately at privacy@booknesta.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by a prominent notice on the platform. The "Last updated" date at the top of this page indicates when the policy was last revised.