Privacy Policy

We collect information in two ways: information you provide directly, and information we collect automatically.

Information you provide:

• Account registration: name, email address, password, and business details (restaurant name, address, phone number, and slug).
• Reservation data: customer names, phone numbers, email addresses, party sizes, special requests, and visit notes entered by restaurant operators or submitted by customers during the booking process.
• Billing information: subscription plan selections and payment processing data. Payment card details are handled directly by our payment processor (Polar) and are never stored on our servers.
• Communications: messages you send us via email or contact forms.

Information collected automatically:

• IP address, browser type, device type, and operating system.
• Pages visited, time spent on pages, and navigation paths within the Platform.
• Referral URLs and search terms used to reach the Platform.
• Session identifiers and authentication tokens.

We use the information we collect to:

• Create and manage your Bookity account and provide access to the Platform.
• Process, store, and display reservation data on behalf of restaurant operators.
• Send automated transactional emails (reservation confirmations, reminders, post-visit surveys) as configured by the restaurant operator.
• Process subscription payments and manage billing.
• Provide customer support and respond to inquiries.
• Improve the Platform through usage analytics, A/B testing, and product development.
• Send product updates and communications to account holders (you can opt out at any time).
• Comply with applicable legal obligations.

We do not sell personal data to third parties, and we do not use customer reservation data for advertising purposes.

We use cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored in your browser. We use the following categories:

• Strictly necessary cookies: Required for authentication, session management, and core Platform functionality. These cannot be disabled.
• Analytical cookies: Used to understand how users interact with the Platform (pages visited, feature usage, error detection). Data is aggregated and anonymized where possible.
• Preference cookies: Store user preferences such as selected language.

You can configure your browser to block or delete cookies. Note that disabling strictly necessary cookies will prevent you from using the Platform. We do not currently use third-party advertising cookies.

We retain account and reservation data for as long as your account is active or as needed to provide the service. If you close your account, we will delete or anonymize your data within 90 days, unless we are required to retain it for legal or regulatory reasons.

We protect your data through:

• Encryption in transit (TLS/HTTPS) for all data exchanged between your browser and our servers.
• Encryption at rest for databases containing personal information.
• Role-based access controls ensuring only authorized personnel can access production data.
• Regular security reviews and vulnerability assessments.

Despite our efforts, no security measure is completely infallible. In the event of a data breach that affects your personal information, we will notify affected users as required by applicable law.

We share personal information only in the following circumstances:

• Service providers: We use trusted third-party providers to operate the Platform, including cloud infrastructure, email delivery, and payment processing. These providers are contractually bound to process data only as directed by us.
• Payment processor: Subscription billing is handled by Polar (polar.sh). Their privacy policy governs how they handle payment data.
• Email delivery: Transactional emails are sent via third-party email services. Recipient addresses are shared solely for the purpose of message delivery.
• Legal requirements: We may disclose data when required by law, court order, or to protect the rights and safety of Bookity or its users.
• Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction. We will notify affected users in advance.

We do not share or sell reservation data (your customers' personal information) to any party other than the restaurant operator who collected it.

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Restriction: Request that we restrict processing in certain circumstances.
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@bookity.io. We will respond within 30 days.

Restaurant operators who use Bookity act as independent data controllers for their customers' reservation data. If you are a restaurant customer and wish to exercise your rights regarding data held by a specific restaurant, please contact that restaurant directly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify account holders by email at least 14 days before changes take effect.
• In cases of significant changes, request renewed consent where required by law.

Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

If you have questions, concerns, or requests related to this Privacy Policy or the handling of your personal data, please contact us: