Privacy Policy

1. Who we are

Ybr Bookings (“we”, “us”) provides the booking platform at ybrbookings.com. For the personal data described in this policy we act as the data controller. Questions, requests or complaints about privacy can be sent to [email protected].

2. What this policy covers

This policy explains how we collect and use personal data when you use the Service as a business owner (“you”), and when a member of the public books with a shop that uses our Service (“your clients”). It sits alongside our Terms of Service and Cookie Policy.

Your clients’ booking data: when a client books an appointment with a shop, that shop is the controller of the client’s personal data and we act as its data processor, handling the data only to provide the Service on the shop’s instructions.

3. The data we collect

• Account data: your name, email address, and login identifiers when you sign in.
• Shop data: your business details, services, prices, opening hours, images you upload, and reviews you publish.
• Team data: details of staff you add, including any photos you upload for them.
• Booking data: appointments and, for them, the client name, contact details and notes entered by a client or by you.
• Payment data: subscription and deposit transactions are handled by Stripe. We store transaction identifiers and status, never full card numbers.
• Technical data: limited server logs (for example, request metadata) used to operate and secure the Service.

4. How we use it and our lawful basis

• To provide the Service — performance of a contract (booking pages, diary, notifications, payments).
• To process payments and manage your subscription — performance of a contract, and our legal obligations.
• To keep the Service secure and prevent abuse — our legitimate interests.
• To email you booking confirmations and reminders — performance of a contract and your consent where required.
• To send product news or offers — only with your consent, and you can opt out at any time.
• To comply with the law — legal obligation (for example, tax records).

5. Who we share data with

We do not sell personal data. We share it only with the service providers who help us run the platform:

• Supabase — database and file storage (hosting).
• Stripe — payment processing.
• Stytch — authentication and identity.
• Resend — transactional email.
• Vercel — web hosting for the app and marketing site.

Each provider is bound by a data-processing agreement. We may also disclose data if required by law or to protect our rights.

6. International transfers

Some of our providers process data outside the United Kingdom and European Economic Area. Where we rely on such providers, transfers are protected by appropriate safeguards such as the UK IDTA/Addendum or EU Standard Contractual Clauses, together with technical measures.

7. How long we keep data

We keep personal data only as long as you have an active account, or as long as needed to provide the Service. Business records tied to payments are retained where the law requires (for example, tax). When you delete your shop from Settings, its bookings, clients, services and uploads are removed. Some data may be retained in backup or for legal purposes, after which it is deleted.

8. Your rights

You (and, in respect of their own data, your clients) have the right to:

• Access the personal data we hold;
• Have inaccurate data corrected;
• Request erasure of data (“right to be forgotten”);
• Receive your data in a portable format, or restrict how it is processed;
• Object to processing based on legitimate interests, and withdraw consent at any time;
• Opt out of marketing.

Account holders can delete their data directly from Settings. To exercise any other right, email [email protected]. We respond within one month. If you are a client of a shop, contact that shop first for requests about your booking data.

9. Security

We use technical and organisational measures to protect data — including encryption in transit, strict access controls, and per-tenant isolation so that one shop’s data is never visible to another. No method of transmission or storage is completely secure, but we work to protect your data appropriately.

10. Children

The Service is not directed at children under 18, and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy. Material changes will be announced by email or in the app, and the “last updated” date will change.

12. Complaints

If you are unhappy with how we handle your data you can complain to us at [email protected]. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, or your local data-protection authority.