Privacy Policy

BookingHub is an online booking platform operated by BookingHub Inc., a company based in Montreal, Quebec, Canada. In this policy, "BookingHub", "we", "us" and "our" refer to BookingHub Inc.

This policy applies to everyone who uses BookingHub: visitors to our website, people who book appointments ("clients"), businesses and their team members, and people who apply for a job with us.

When you create an account, use our website, contact our support team or apply for a job, BookingHub decides how your information is used and is responsible for it under this policy.

When a business uses BookingHub to take bookings, the business decides what it asks its clients (for example, through an intake form) and is responsible for that client information. In that case, BookingHub handles the information on the business's behalf, only to provide the service the business has asked for, and under this policy. If you have a question about information a business holds about you, please contact that business first. We will help it respond.

We collect only the information we need to operate BookingHub.

• Account information: your name, email address, password (stored in protected, hashed form by our authentication provider) or your Google sign-in identity, your preferred language and, if you choose to add them, your phone number and profile photo.
• Booking information: the appointments, classes, reservations and services you book, their dates and times, party size, notes, cancellations and reschedules, and your reminder preferences.
• Intake form answers: the answers you give to questions a business asks before your appointment. Some businesses, such as health clinics, may ask about your health. Those questions are set by the business, and your answers are shared only with that business.
• Messages: the messages you exchange with a business through BookingHub.
• Business information: for business accounts, the business name, address, description, photos, team member profiles, services, prices, hours, availability and settings.
• Payment information: when you pay a business through BookingHub, the payment is processed by Stripe. We receive the amount, the status of the payment, the platform fee BookingHub keeps on it (1% of the payment, as set out in our Terms of Service) and limited details needed to manage refunds and records. We never see or store your full card number.
• Calendar information: if a member of a business connects Google Calendar, Apple Calendar, Outlook or another calendar by its sharing link, or creates a calendar subscription link, the information described in section 7.
• Support conversations: what you write to our website assistant or our team, the page you were on, and, if you ask to speak with a person, your name and email address.
• Job applications: the information and files you submit when you apply for a role, such as your name, email address, phone number, location, profile links, resume, cover letter and answers to our questions.
• Rewards and newsletter: your points balance and history with each business that runs a rewards program, and your email address if you subscribe to our updates.
• Website and technical information: the pages you visit, the date and time, a general device type, your country, the campaign details in the link you followed (such as utm_source or utm_campaign) and the website that referred you. We also receive technical reports when an error occurs on the site. Our hosting and security providers process IP addresses to deliver and protect the website; we do not store IP addresses in our own analytics.

• To provide BookingHub: create and manage accounts, take and manage bookings, show availability, and process payments and refunds.
• To send service messages: booking confirmations, reminders, waitlist alerts, cancellation notices and replies to messages, by email and, if you choose, by text message.
• To run the features a business turns on, such as the cancellation waitlist, client messaging, rewards, intake forms and Google Meet links for virtual appointments.
• To support you: answer your questions, investigate problems and, when you ask for help, access your account as described in section 8.
• To review job applications and contact applicants.
• To keep BookingHub secure: prevent fraud and abuse, enforce our Terms of Service and keep logs of access to personal information.
• To understand and improve BookingHub, using statistics that do not identify you.
• To send our newsletter, only if you have subscribed.
• To meet our legal obligations.

We do not sell personal information, and we do not use it for advertising on other websites.

Our website assistant is automated and rule-based: it selects pre-written answers to common questions. It does not make decisions about you. A member of our team is always available on request.

We collect and use personal information with your consent. For some uses, your consent is implied by your request: for example, when you book an appointment, we use your contact details to confirm it and remind you. For optional uses, such as text message reminders, the analytics cookie described in section 13 and our newsletter, we ask for your express consent.

You can withdraw your consent at any time, subject to legal or contractual limits. Withdrawing consent may prevent us from providing some features.

We share personal information only in the following situations:

• With the business you book with: your booking details, contact information, intake answers and messages are shared with that business so it can provide your appointment.
• With our service providers, who process information on our behalf and only for the purposes listed in section 9.
• With your consent or at your direction, for example when you connect Google Calendar.
• When required by law, such as to respond to a valid court order, or to protect the rights, safety or property of our users or of BookingHub.
• As part of a merger, acquisition or sale of assets, in which case the receiving party must protect your information under terms at least as protective as this policy.

Connecting a calendar is optional and available to business accounts. When a member of a business connects Google Calendar:

• We request access to the calendar.events scope.
• We read the start time, end time and busy or free status of events so that busy times block availability on BookingHub. If the owner turns on the optional setting to show event details, we also read event titles to display them on the owner's own private calendar.
• If the business offers virtual appointments, we create, update and delete a calendar event for each such booking in order to generate a Google Meet link and send the client an invitation.
• We do not read event descriptions, attendee lists or other event content, except the events we create ourselves for virtual bookings.
• Calendar data is never shown to clients, never used for advertising and never shared with third parties, except as needed to provide the features above.
• The member can disconnect Google Calendar at any time from BookingHub settings. We then stop accessing the calendar and delete the busy times we imported from it.

BookingHub's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When a member of a business connects Apple Calendar (iCloud), they sign in with their Apple ID and an app-specific password that they create in their Apple account. We never receive their main Apple ID password. The app-specific password is encrypted before it is stored and is used only to read the start time, end time and busy or free status of events in the calendars the member selects, and event titles if the optional setting above is on. We never add, change or delete anything in Apple Calendar. Disconnecting from BookingHub deletes the stored password and the busy times we imported, and the member can also revoke the password from their Apple account at any time.

When a member of a business connects Outlook, they sign in with their Microsoft account and grant the Calendars.Read permission, which is read only. We read the start time, end time and free or busy status of events in their default calendar, and event titles if the optional setting above is on. We never add, change or delete anything in Outlook. The access Microsoft grants us is encrypted before it is stored. Disconnecting from BookingHub deletes it and the busy times we imported, and the member can also remove BookingHub from the apps connected to their Microsoft account at any time.

A member can also connect any other calendar by pasting its sharing link (an .ics or webcal address), for example from Proton, Fastmail, Yahoo or a published Outlook calendar. We fetch that link to read the start time, end time and free or busy status of its events, and event titles if the optional setting above is on. The link is encrypted before it is stored and is never shown again or shared. Removing it from BookingHub deletes it and the busy times we imported.

A member can also create a private calendar subscription link so that their own calendar app, such as Apple Calendar, Google Calendar or Outlook, displays their BookingHub bookings, including client names, services, times and phone numbers. Anyone who holds the link can see that information. The link is shown only to the member and the managers of their business, and it can be reset at any time, which stops the old link from working.

Our team may access a business account to provide technical support when the business asks for help, or when it is necessary to maintain or secure the platform. Each access session is logged, and the business receives an email summary of any changes made. We do not access client information for any other purpose.

We rely on the following providers to operate BookingHub. Each is bound by its own privacy commitments and processes information only to provide its service to us.

• Supabase: database, authentication and file storage, hosted in Canada.
• Vercel: website hosting and performance measurement.
• Resend: delivery of transactional email.
• Twilio: delivery of text messages.
• Stripe: payment processing. Businesses connect their own Stripe account.
• Google: optional sign-in with Google, Google Calendar and Google Meet.
• Apple: optional connection to Apple Calendar through iCloud.
• Microsoft: optional connection to Outlook calendars.
• Sentry: technical error reports, so we can fix problems.

Our main database and the files you upload are stored in Canada. Some of our service providers may process personal information outside Quebec and outside Canada, mainly in the United States. Before information is communicated outside Quebec, we assess whether it will receive adequate protection, and we rely on contractual safeguards with our providers. Information processed in another country may be subject to the laws of that country.

• Account and booking information: for as long as your account is active. When you delete your account, your profile is de-identified right away. Booking records that a business needs to keep remain with that business, without your profile details.
• Support conversations: up to 24 months, then deleted.
• Job applications: for as long as needed to consider you for the role and similar roles, and no longer than 24 months after the role closes, unless you ask us to delete them sooner.
• Payment records: for as long as tax and accounting laws require.
• Calendar connections: until the member disconnects the calendar. The stored credentials and the busy times we imported are deleted at that time.
• Website statistics: kept in a form that does not identify you.
• Security logs: for as long as needed to protect the platform and meet our legal obligations.

When information is no longer needed, we delete it or make it anonymous.

We protect personal information with security measures suited to its sensitivity. These include encryption in transit and at rest, access controls that limit each person and business to the information they are authorized to see, logging of access to personal information, private storage for uploaded files with time-limited download links, and access for our staff only when it is needed.

No system is perfectly secure. If a confidentiality incident occurs, we take steps to reduce the risk of harm, keep a record of the incident, and notify the Commission d'accès à l'information and the people affected when the incident presents a risk of serious injury.

We use a small number of first-party cookies and similar browser storage. We do not use third-party advertising cookies or cross-site tracking.

• Essential cookies keep you signed in, remember your language and preferences, and protect the site. They are required for BookingHub to work.
• A session cookie (bh_sess) lasts 30 minutes from your last activity. It holds a random session identifier and, if you arrived from an ad, the campaign details in that link. It does not identify you personally.
• An analytics cookie (bh_vid) is off unless you turn it on. It holds a random identifier for up to 90 days so we can recognize a returning browser. Turning it off deletes it immediately.
• Our website assistant keeps the current conversation in your browser's session storage. It is cleared when you close the tab, sign out or end the chat.
• Our hosting provider's performance measurement does not use cookies.

You can change your cookie choices at any time from the Cookie preferences link at the bottom of every page. When you create a business account or join a waitlist, we keep the campaign details from your session with that record so we know how you found us.

Subject to the law, you have the right to:

• access the personal information we hold about you;
• have inaccurate, incomplete or outdated information corrected;
• have your information deleted;
• withdraw your consent;
• receive the personal information you provided to us in a structured, commonly used technological format, and have it sent to another organization;
• ask us to stop disseminating your information or to de-index it where the law allows;
• be informed of any decision about you made exclusively by automated processing. BookingHub does not make such decisions.

You can download or delete your information yourself from your account settings. You can also email us at contact@bookinghub.ca with the subject line "Privacy request". We may ask you to confirm your identity. We respond within 30 days, and these requests are free.

If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

BookingHub is not intended for children under 14, and we do not knowingly collect their personal information without the consent of a parent or guardian. A parent or guardian may book an appointment on behalf of a child.

Our Privacy Officer is responsible for the protection of personal information at BookingHub and for this policy. You can reach the Privacy Officer at contact@bookinghub.ca with the subject line "Privacy Officer", or by mail at BookingHub Inc., Montreal, Quebec, Canada.

We may update this policy to reflect changes to BookingHub or to the law. When we make a material change, we will notify registered users by email before it takes effect. The effective date at the top of this page shows when the policy was last updated.