Draft, under legal review. This text is not final. Highlighted items are still to be decided.
Appointr privacy policy
Last updated: DECIDE: publication date
Appointr is online booking software for salons and other businesses that work by appointment. This policy explains what personal information we collect through our website, apps and booking pages (together, the "Services"), why we use it, who we share it with, and the choices you have.
"Appointr", "we" and "us" mean DECIDE: legal entity name, e.g. "1234567 Ontario Inc., operating as Appointr", DECIDE: mailing address. We are based in Ontario and follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). This policy is part of our terms of service.
DECIDE: confirm with the lawyer that no pilot business is in Quebec. If one is, Quebec's Law 25 adds duties (a published privacy officer, an assessment before sending data outside Quebec, and more), and this policy needs a Quebec section.
Who this policy covers
Three groups of people use the Services. Businesses are the owners who sign up for Appointr and the staff they add. Customers are people who book an appointment with a business that uses Appointr. Visitors browse our website or apply to our pilot without doing either.
A business decides what it collects about its customers and why. Under PIPEDA the business is responsible for its customers' booking information, and Appointr handles that information on the business's behalf, only to provide the Services to that business. Appointr is responsible for its own information: business accounts, the optional customer account, billing for our plans, pilot applications, and the technical records we need to keep the Services secure.
Most of what we collect is given with implied consent. A customer who books a haircut and gives a phone number expects a reminder at that number. Optional things, such as connecting a Google Calendar or creating a customer account, happen only when you choose them.
Information you give us
Account information. When a business signs up, we collect the owner's name, email address and password. We store the password only as a one-way hash. If you sign in with Google or Apple, we receive the account id and email address they share with us. Staff members who get a login give us the same.
Business information. The details a business publishes on its booking page, such as its name, address, contact details, services, prices, opening hours, logo and policies, and the names, photos and working hours of its staff.
Customer information. When someone books, the business collects their name, email address and phone number, what they booked and when, and any note they add. A walk-in booked by staff may have no email address. The business also records what happens next, such as confirmations, check-ins, cancellations, no-shows and payments, and may keep its own notes about a customer. A customer may also leave a review or send the business a message through its booking page. Each business sees only its own customers.
Payment information. Card payments go through Stripe or Square, on the business's own account with them. Customers type their card details into Stripe's or Square's form, so the card number goes to them and never to us or the business. We keep the amounts, dates and payment methods, and the processor's reference to each payment. When a business pays for an Appointr plan, Stripe processes that payment for us and keeps the card and billing address.
Connected services. If a business connects Stripe or Square, we keep the identifiers of that account, and any access tokens it gives us are stored encrypted. If a staff member connects Google Calendar, we write their appointments into that calendar, including the service, the customer's name and phone number and the booking note, and we read back only the start and end times of their other events, never the titles or details.
Customer accounts. Customers can book as guests. A customer who signs in on a booking page gets an emailed code instead of a password, and we create an Appointr customer account with their email address and, if they give them, their name and phone number. The account fills in their details when they book and shows their appointments across businesses. It belongs to Appointr, not to any business.
Pilot applications and support requests. If you apply to our pilot or contact support, we keep your name, contact details, business details and your answers or message, so we can review your application or reply to you.
Information collected automatically
Device and log data. Our servers record your IP address, browser or device type, the pages and requests you make, and an error report when something breaks. We use this to keep the Services secure, to slow down repeated sign-in attempts, and to fix problems. We do not record screens or sessions.
Cookies. We use a small number of cookies, all needed to keep you signed in or to protect the step where a business connects Stripe, Square or Google Calendar. The business portal also saves a few preferences in your browser, such as your calendar view, but never passwords or sign-in tokens. We do not use advertising or analytics cookies. Stripe, Square, Google and Apple may set their own cookies when you use their payment forms or sign-in buttons, under their own policies.
How we use information
Running the Services. We provide the booking pages, calendars, reminders, payment tools, reports and everything else a business uses Appointr for.
Appointment messages. On a business's behalf, we send customers booking confirmations with a link to manage the booking, reminders with a link to confirm they are coming, notices when a booking changes or is cancelled, receipts, and, if the business turned it on, one email after a visit asking for a review. Text messages are sent only when the business has turned texting on and the customer gave a phone number.
Account messages and billing. We send businesses sign-in codes, trial and billing notices and notices about changes to the Services, and we bill paid plans.
Security and fixing problems. We protect accounts, detect fraud and abuse, and find and fix errors.
Support and the pilot. We answer support requests and review pilot applications.
Legal obligations. We keep the records the law requires, such as tax records.
We do not sell personal information and we do not use it for advertising. We never share phone numbers, or anyone's consent to receive texts, with other companies for their marketing. Appointr does not send marketing to customers and has no tool for businesses to do so. We do not send marketing email to businesses without their consent. DECIDE: if we want product-news email to businesses, add an opt-in and an unsubscribe link, since CASL applies
How we share information
The business you book with. Your booking information goes to that business. It never goes to another business on Appointr.
Service providers. Other companies help us run the Services: Fly.io runs our servers, Neon hosts our database, Vercel hosts our website, Backblaze stores images, Resend sends email, Twilio sends text messages, Stripe and Square process payments, Expo delivers mobile app updates, and Sentry and Axiom keep our error reports and server logs. Each receives only what it needs to do its job for us.
Services you choose to connect. When a business connects Stripe or Square, a staff member connects Google Calendar, or you sign in with Google or Apple, information passes to that company and is also governed by its own privacy policy. A business that connects Stripe or Square has its own account there, and the payments its customers make go into that account.
Legal requests and safety. We disclose information when the law requires it, for example under a court order, or when we need to protect the safety or security of people or the Services.
Sale or merger. If Appointr is sold or merged with another company, personal information may pass to the buyer, who must keep the promises in this policy.
Where information is stored
Our servers are in Toronto, Canada. Several of our service providers, such as Vercel, Resend, Twilio and Sentry, store or process information in the United States. DECIDE: confirm Neon's production region; staging uses AWS us-east-2, Ohio, USA Information stored outside Canada is subject to the laws of that country and may be available to its courts and authorities.
How long we keep information
We keep personal information only as long as we need it for the purposes in this policy. A business's booking records stay for as long as the business keeps its Appointr account, because they are the business's records. When an owner deletes their account, we delete or anonymize their data after a 30-day grace period. A customer account is deleted as soon as the customer deletes it.
Payment, refund and invoice records are kept for six years from the end of the tax year they relate to, because the Canada Revenue Agency requires it. If a business closes, we remove customer names and contact details from those records and keep only the amounts.
Server logs, error reports and backups are kept for a limited time and then deleted. DECIDE: confirm the Axiom, Sentry and Neon retention windows, and state the longest one here
Security
We protect personal information with encryption in transit, one-way hashing for passwords and sign-in tokens, encrypted storage for access tokens, and access limited to the people who need it. No system is perfectly secure. If a breach creates a real risk of significant harm, we will tell the people affected and the Office of the Privacy Commissioner of Canada, as PIPEDA requires, and help any affected business tell its customers.
Your rights and choices
Access and correction. You can ask to see the personal information we hold about you, and to correct it if it is wrong.
Deletion. A business owner or staff member can delete their login from their account settings. A customer can delete their Appointr customer account from the account itself. Deleting a customer account does not delete the bookings made with each business, because those are the business's records.
Withdrawing consent. You can withdraw your consent at any time. Some parts of the Services may stop working for you. For example, a business cannot remind you of an appointment without a way to reach you.
Texts and reminders. Reply STOP to any text from Appointr to stop receiving texts at that number. Customers with an account can also turn off automated reminder emails and texts. Receipts, refund confirmations and payment links are still sent.
Booking records. For a booking you made with a business, ask the business first, since it decides what happens to its records. If you write to us instead, we will pass your request to the business and help it answer you.
To make a request, write to the contact below. We may confirm your identity first, usually with a code sent to your email, and we answer within 30 days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Children
The Services are not meant for anyone under 18, and we do not knowingly create accounts for children. When a minor has an appointment, a parent or guardian should book it and give their own contact details. DECIDE: confirm with the lawyer, and with pilot salons that serve minors
Changes to this policy
If we make a change that matters, we will email businesses and post a notice in the app at least 30 days before it takes effect. The date at the top shows the last change.
Contact us
Privacy questions and requests: DECIDE: privacy email, e.g. privacy@appointr.pro. Person responsible for privacy: DECIDE: name of the privacy officer. Mail: DECIDE: mailing address.