Privacy Policy

1. Who This Policy Applies To

BookingChat is used by two groups of people, and the data of each is handled differently. It is worth starting from that distinction, because it defines our role in each case.

• The business: the salon, the barbershop or the professional who creates an account, installs the app and organises their own schedule. For that data, BookingChat is the controller.
• The business's customer: the person who opens the booking link, picks a time slot and provides a name and phone number. They do not create an account and install nothing. For that data, the business is the controller and BookingChat acts as processor — we handle that information following the business's instructions, in order to carry out the booking and notify the customer.

If you are a customer of a business that uses BookingChat and want to correct or delete your data, the most direct route is to contact that business. You may still write to us at the email address at the end of this policy, and we will forward or handle the request as appropriate.

2. Information We Collect

From the business, provided by them:

• Account data: email, password and phone number at sign-up. When access is through a Google Account, we receive the name, the email and the account identifier that Google sends us
• Business data: name, address, category, opening hours, services with price and duration, and the registered team
• Tax identification number: optional, used only for tax identification in billing
• Photo: optional, the image the business chooses to display on its own booking page

From the business's customers:

• Name and phone number: provided by the customer on the booking page, or typed by the business when registering an appointment through the app
• Booking data: service, professional, date, time, status and history
• Technical signals from the booking page: information used only to tell a person from a robot and prevent automated bulk reservations

Collected automatically:

• Crash and diagnostic reports: when the app hits an error, we receive the technical crash report, the device model, the system version and the app version. These reports include no customer name or phone number
• Notification identifier: an identifier Google generates for the device, required to deliver the app's notifications
• Application logs: technical records of requests and errors, used for security and diagnosis

What we do not collect: we have no access to your location, your contact list, your photos beyond the one you choose to upload, or your messages. The app requests only three permissions: internet access, connection state and sending notifications.

Card data: the subscription is charged by Google Play, within your Google Account. We do not receive, see or store card numbers. From the store we receive only the purchase confirmation and which plan was bought.

3. How We Use Your Information

We use the information collected for the following purposes:

• Operating the schedule: creating, changing and cancelling appointments, and calculating the availability shown on the booking page
• Notifying the business's customer over WhatsApp about the confirmation, the confirmation request, and changes or cancellations to their appointment
• Notifying the business, by in-app notification and email, about what happens in the schedule and in the subscription
• Processing the subscription and issuing the corresponding billing notices
• Diagnosing app failures and fixing them
• Providing support and responding to your requests
• Ensuring platform security and curbing abusive automated use
• Complying with applicable legal and regulatory obligations

We do not use your data, or your customers' data, for advertising, and we do not sell it to anyone.

4. Sharing of Information

We do not sell, trade or transfer personal information. We share data only with the providers needed for the service to work, and only what each one needs to perform its function:

• Meta (WhatsApp Business): the customer's name and phone number, to deliver the booking messages. Messages are sent from a BookingChat number, not from the business's number
• Google: Google Play processes the subscription; Firebase delivers notifications to the device and receives crash reports; and the Google Account, when used, authenticates access
• Amazon Web Services: application hosting, image storage and delivery of the service's emails
• MongoDB Atlas: the database where the information is stored
• Legal obligations: when required by law, court order or a competent authority
• Protection of rights: when necessary to protect the rights, property or safety of BookingChat or of third parties

These providers act under our instructions and are not authorised to use the data for their own purposes.

5. International Data Transfers

The providers listed above operate servers outside Brazil, mainly in the United States. This means your data and your customers' data are transferred and stored abroad, under article 33 of the Brazilian LGPD, on the basis of the necessity of performing the contract entered into with you and under contractual clauses offered by those providers.

6. Security

We implement appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure or destruction. Among the measures adopted:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Role-based access controls, with isolation between businesses: one account never reaches another's data
• The app session stored encrypted on the device itself, erased when the session ends
• Continuous security monitoring and anomaly detection
• Regular backups and data recovery plans

Although we follow good security practices, no method of transmission over the internet or of electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

Under applicable data protection law, you have the following rights over your personal information:

• Access: request a copy of the information we hold about you
• Correction: request the correction of incorrect or outdated data
• Deletion: request the deletion of your personal data from our platform
• Portability: receive your data in a structured, machine-readable format
• Withdrawal of consent: revoke consent previously given for the processing of your data
• Objection: object to the processing of data in certain circumstances

Part of this you can resolve yourself, without asking anyone: the app lets you correct the business data, delete the photo, delete services and delete schedule blocks, and lets you delete the entire account, with immediate effect. The steps, the deadlines and what is retained by legal obligation are described in Data Deletion.

To exercise any of these rights, contact us at privacidade@bookingchat.com.br.

8. Cookies and Local Storage

In the app, we do not use cookies. Your session is stored encrypted on the device itself, and a local copy of the schedule stays on the device so that you can check the day even without internet. Signing out erases both.

On this website we use cookies and similar analytics technologies (Google Analytics, Microsoft Clarity and Meta Pixel) to understand how people arrive here and what they read, and so improve the pages. That data is statistical and does not identify you by name.

On the booking page your customer opens, there is no analytics cookie and no third-party tracker — it loads only what is needed to book the appointment.

You can control the use of cookies through your browser settings.

9. Data Retention

We keep your information for as long as necessary to provide our services and meet our legal obligations:

• Account data: kept for as long as your account exists. Deletion requested in the app is immediate
• Booking data: kept for as long as the account exists, as it is the business's operational history
• Tax and billing data: kept for the period required by tax law, even if the account is deleted earlier
• Application logs: kept for up to 12 months for security and diagnostic purposes
• Crash reports: retained for the period practised by Google's diagnostic service, and never containing customer data

After the retention periods, data is securely deleted or anonymised.

10. Minors

BookingChat is a work tool, intended for people aged 18 and over. We do not intentionally collect data from children and adolescents, and the app is not directed at that audience. If a guardian identifies that a minor has created an account, they can write to us at the email address at the end of this policy and the account will be deleted.

A business may, naturally, serve customers who are minors and record the name and phone number provided by the guardian in order to book the appointment. In that case, it is the business that answers for its own customer base, as controller — as described in section 1.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or through a prominent notice on our site. The date of the last update will always be shown at the start of this policy. Continued use of our services after the changes constitutes acceptance of the new policy.

12. Contact

If you have questions about this Privacy Policy, want to exercise your rights or have concerns about how your data is handled, contact our data protection officer at: privacidade@bookingchat.com.br