Privacy Policy

1. Who This Policy Applies To

BookingChat is used by two groups of people, and the data of each is handled differently. It is worth starting from that distinction, because it defines our role in each case.

• The business: the salon, the barbershop or the professional who creates an account, installs the app and organises their own schedule. For that data, BookingChat is the controller.
• The business's customer: the person who opens the booking link, picks a time slot and provides a name and phone number. They do not create an account and install nothing. For that data, the business is the controller and BookingChat acts as processor — we handle that information following the business's instructions, in order to carry out the booking and notify the customer.

If you are a customer of a business that uses BookingChat and want to correct or delete your data, the most direct route is to contact that business. You may still write to us at the email address at the end of this policy, and we will forward or handle the request as appropriate.

2. Information We Collect

From the business, provided by them:

• Account data: email, password and phone number at sign-up. When access is through a Google Account, we receive the name, the email and the account identifier that Google sends us
• Sign in with Apple: when access is through Apple, on iPhone, we ask Apple for the name and email and receive the account identifier. If you choose to hide your email, Apple gives us a private relay address (ending in @privaterelay.appleid.com), and that is the address we store and use for the service's emails. When an account linked to Apple is deleted, we revoke with Apple the authorisation you gave BookingChat
• Business data: name, address, category, opening hours, services with price and duration, and the registered team
• Tax identification number: optional, used only for tax identification in billing
• Photo: optional, the image the business chooses to display on its own booking page

From the business's customers:

• Name and phone number: provided by the customer on the booking page, or typed by the business when registering an appointment through the app
• Answers to the business's questions: when the business sets up questions for booking (for example, the car model or the pet's size), we store the answers the customer provides on the booking page, or that the business records through the app. They stay with the appointment, visible to the business and the customer, and are not sent by WhatsApp
• Booking data: service, professional, date, time, status and history
• Technical signals from the booking page: information used only to tell a person from a robot and prevent automated bulk reservations

Collected automatically:

• Crash and diagnostic reports: when the app hits an error, we receive the technical crash report, the device model, the system version and the app version. These reports include no customer name or phone number
• App usage data: in the Android and iPhone apps, we record usage events through Google Analytics for Firebase — such as sign-up, sign-in, finishing the setup and the business becoming ready to take bookings — together with technical device data such as model, system version and approximate country. These events are not associated with your name, your email or your BookingChat account. On iPhone, the app does not use the advertising identifier (IDFA) and does not ask for tracking permission
• Notification identifier: an identifier that Firebase Cloud Messaging, from Google, generates for the device — on iPhone, from the Apple Push Notification service (APNs) identifier — required to deliver the app's notifications
• Application logs: technical records of requests and errors, used for security and diagnosis

What we do not collect: we have no access to your location, your contact list, your photos beyond the one you choose to upload, or your messages. On Android, the app requests only three permissions: internet access, connection state and sending notifications. On iPhone, it asks only for permission to send notifications; the business photo is chosen through the system's own photo picker, which hands the app only the selected image, and Face ID, when you turn it on to unlock the app, is checked by the iPhone itself — we never receive biometric data.

Card data: the subscription and message packs are charged by the device's store: Google Play, within your Google Account, on Android, and the App Store, within your Apple Account, on iPhone. We do not receive, see or store card numbers. From the store we receive only the purchase confirmation and which plan or pack was bought.

3. How We Use Your Information

We use the information collected for the following purposes:

• Operating the schedule: creating, changing and cancelling appointments, and calculating the availability shown on the booking page
• Notifying the business's customer over WhatsApp about the confirmation, the confirmation request, and changes or cancellations to their appointment
• Notifying the business, by in-app notification and email, about what happens in the schedule and in the subscription
• Processing the subscription and issuing the corresponding billing notices
• Diagnosing app failures and fixing them, and understanding how the app is used in order to improve it
• Providing support and responding to your requests
• Ensuring platform security and curbing abusive automated use
• Complying with applicable legal and regulatory obligations

We do not use your data, or your customers' data, for advertising, and we do not sell it to anyone.

4. Sharing of Information

We do not sell, trade or transfer personal information. We share data only with the providers needed for the service to work, and only what each one needs to perform its function:

• Meta (WhatsApp Business): the customer's name and phone number, to deliver the booking messages. Messages are sent from a BookingChat number, not from the business's number
• Google: Google Play processes subscriptions made on Android; Firebase delivers notifications to the device and receives crash reports and the apps' usage events; and the Google Account, when used, authenticates access
• Apple: the App Store processes subscriptions and packs bought on iPhone; the Apple Push Notification service (APNs) delivers notifications to the iPhone; and Sign in with Apple, when used, authenticates access
• Amazon Web Services: application hosting, image storage, delivery of the service's emails and automated review, by artificial intelligence, of text written by the business (business name and description, link name, services and add-ons, campaigns, questions, recommendations, team names and cancellation reasons) to block scams, advertising and inappropriate content. Customers' answers are not reviewed. You may ask a person to review a refusal made by this automated review
• MongoDB Atlas: the database where the information is stored
• Legal obligations: when required by law, court order or a competent authority
• Protection of rights: when necessary to protect the rights, property or safety of BookingChat or of third parties

These providers act under our instructions and are not authorised to use the data for their own purposes.

5. International Data Transfers

The providers listed above operate servers outside Brazil, mainly in the United States. This means your data and your customers' data are transferred and stored abroad, under article 33 of the Brazilian LGPD, on the basis of the necessity of performing the contract entered into with you and under contractual clauses offered by those providers.

6. Security

We implement appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure or destruction. Among the measures adopted:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Role-based access controls, with isolation between businesses: one account never reaches another's data
• The app session stored encrypted on the device itself, erased when the session ends
• Continuous security monitoring and anomaly detection
• Regular backups and data recovery plans

Although we follow good security practices, no method of transmission over the internet or of electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

Under applicable data protection law, you have the following rights over your personal information:

• Access: request a copy of the information we hold about you
• Correction: request the correction of incorrect or outdated data
• Deletion: request the deletion of your personal data from our platform
• Portability: receive your data in a structured, machine-readable format
• Withdrawal of consent: revoke consent previously given for the processing of your data
• Objection: object to the processing of data in certain circumstances

Part of this you can resolve yourself, without asking anyone: the app lets you correct the business data, delete the photo, delete services and delete schedule blocks, and lets you delete the entire account, with immediate effect. The steps, the deadlines and what is retained by legal obligation are described in Data Deletion.

To exercise any of these rights, contact us at privacidade@bookingchat.com.br.

8. Cookies and Local Storage

In the app, we do not use cookies. Your session is stored encrypted on the device itself, and a local copy of the schedule stays on the device so that you can check the day even without internet. Signing out erases both.

On this website we use cookies and similar analytics technologies (Google Analytics, Microsoft Clarity and Meta Pixel) to understand how people arrive here and what they read, and so improve the pages. That data is statistical and does not identify you by name.

The Meta Pixel and Google Analytics on this website measure BookingChat's own promotional ads. App data and the data of businesses' customers are never used for advertising.

On the booking page your customer opens, there is no advertising cookie. We use Microsoft Clarity only during the steps of choosing the service, professional and time, to understand where people give up; what is typed (name, phone and answers) is hidden and never recorded, and recording stops once the booking is complete. In this use, BookingChat processes that technical data as controller, based on its legitimate interest in improving the page.

You can control the use of cookies through your browser settings.

9. Data Retention

We keep your information for as long as necessary to provide our services and meet our legal obligations:

• Account data: kept for as long as your account exists. Deletion requested in the app is immediate
• Booking data: kept for as long as the account exists, as it is the business's operational history
• Tax and billing data: kept for the period required by tax law, even if the account is deleted earlier
• Application logs: kept for up to 12 months for security and diagnostic purposes
• Crash reports: retained for the period practised by Google's diagnostic service, and never containing customer data
• App usage events: retained for the retention period configured in Google Analytics, and never containing a name, email or phone number

After the retention periods, data is securely deleted or anonymised.

10. Minors

BookingChat is a work tool, intended for people aged 18 and over. We do not intentionally collect data from children and adolescents, and the app is not directed at that audience. If a guardian identifies that a minor has created an account, they can write to us at the email address at the end of this policy and the account will be deleted.

A business may, naturally, serve customers who are minors and record the name and phone number provided by the guardian in order to book the appointment. In that case, it is the business that answers for its own customer base, as controller — as described in section 1.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or through a prominent notice on our site. The date of the last update will always be shown at the start of this policy. Continued use of our services after the changes constitutes acceptance of the new policy.

12. Contact

If you have questions about this Privacy Policy, want to exercise your rights or have concerns about how your data is handled, contact our data protection officer at: privacidade@bookingchat.com.br