Privacy policy
Draft of 5 November 2026
Draft. This document is being reviewed before Booksure takes paying customers. Highlighted parts are still to be filled in. If anything here is unclear, send us a message.
This policy explains what personal data Booksure collects, why, how long we keep it, who we share it with, and your rights. It covers this website, the Booksure dashboard used by businesses, and the booking pages their customers use.
Who we are
Booksure is run by [Operator’s legal name, for example “AutoZen Ltd”, company number and registered address]. ICO registration number: [number]. You can reach us through our contact form.
Two roles, depending on whose data it is
- Business accounts. For the owners who sign up and run a business on Booksure, we are the controller: we decide how that data is used.
- Customers who book. When you book with a business through its Booksure page, that business is the controller of your data. We are its processor: we store and use your details only to run its bookings, under our data processing agreement. Questions about a booking, or requests to see or delete your data, should go to the business. If you send them to us, we pass them on.
What we collect
If you run a business on Booksure
- Your name, email address and a scrambled (hashed) version of your password.
- Your business details: name, address, phone number, logo, services, prices, opening hours, team members and time off.
- When you accepted these terms, and which version.
- Security records: when you sign in, the IP address and browser of each signed-in session, and a log of important account actions such as password resets and settings changes (the names of the settings, not their values).
- Messages you send us through the contact form.
If you book with a business
- Your name and email address.
- Your phone number and address, when the business asks for them.
- Any note you add to the booking.
- The bookings you make, change or cancel, and the emails sent about them.
You do not create an account to book. We do not collect payment card details: when Booksure starts taking payments online, a payment provider will handle all card data.
Why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing your account and the booking service | Contract |
| Sending booking confirmations, reminders and account emails | Contract |
| Keeping the service secure and preventing abuse | Legitimate interests |
| Answering your messages | Legitimate interests |
| Keeping records the law requires, such as invoices | Legal obligation |
We do not sell personal data, use it for advertising, or build profiles across businesses. A customer’s details are only ever used for the business they booked with.
Who we share it with
We use these companies to run Booksure. They act only on our instructions.
| Company | What for | Where |
|---|---|---|
| Cloudflare | Hosting, database, file storage and the bot check on forms | Western Europe [confirm the database location] |
| Resend | Sending emails | [confirm the sending region; if the United States, name the transfer safeguard] |
We may also share data when the law requires it, or to protect people from harm.
How long we keep it
| Data | Kept for |
|---|---|
| A business’s account, customers and bookings | While the account is open, then 90 days after it is closed |
| A customer’s details | Until the business deletes them or closes its account (then 90 days) |
| The contents of emails we send | 90 days |
| Security log of account actions | 12 months |
| Signed-in sessions | Until they expire (at most 30 days) |
| Backups | Up to 30 days, after which deleted data is gone from them too |
Cookies and browser storage
We do not use advertising or analytics cookies, so there is no cookie banner.
- This website and booking pages set no cookies.
-
The dashboard sets one cookie,
__Host-session, to keep you signed in, for up to 30 days. It is strictly necessary. - The dashboard also remembers three choices in your browser: whether the side menu is folded, the look you picked, and the business you last opened.
- Sign-up, the contact form and the last step of a booking use Cloudflare Turnstile to check that a person, not a bot, is sending the form. Cloudflare does not use it for advertising.
How we protect it
Data is encrypted in transit and kept separate for each business, so one business can never see another’s customers. Passwords are stored hashed. Only the people who run Booksure can reach the systems, and their access is protected by two-step sign-in. If a breach affects your data, we will tell you, and the ICO when the law requires.
Your rights
You can ask to see, correct, delete or download your data, to object to how we use it, or to restrict its use. Business owners can download all of their business’s data, and close their account, from Settings at any time. For anything else, use our contact form. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
Changes
If we change this policy in a way that matters, we will email business owners before the change takes effect. The date at the top shows the latest version.