Privacy Policy

For data relating to your Bookso account (your name, email address, business details and billing information), Bookso is the data controller.

For the contact details of your customers that you upload or enter into the Service (names, phone numbers, email addresses, postcodes and job history), you are the data controller and Bookso acts as your data processor. We process that data only on your instructions, to provide the Service.

Account data: name, email address, phone number, business name, trade, and password (stored as a secure hash).

Customer data you provide: your customers' names, phone numbers, email addresses, postcodes, job records and booking history.

Usage data: log information such as IP address, browser type, pages viewed and actions taken, used for security and to improve the Service.

Billing data: payment is handled by our payment provider (Stripe); we do not store full card numbers.

SMS data: where the tradesperson has enabled SMS reminders, we process recipient mobile numbers, message content, delivery status and inbound replies (including STOP and START opt-out keywords) so we can send reminders and honour opt-outs. See the SMS Policy for full details.

We use personal data to: provide and operate the Service; send booking reminders and confirmations to your customers on your behalf; respond to support requests; secure and improve the Service; and meet our legal obligations.

Legal bases under UK GDPR: performance of a contract (providing the Service), legitimate interests (security, service improvement), and consent where required (e.g. marketing emails to you, which you can withdraw at any time).

We use a small number of trusted sub-processors to run the Service:

• Supabase - database and application hosting (EU region).
• Resend - transactional email delivery (reminder and booking emails).
• Stripe - subscription billing and payment processing.

Each processor is bound by a data processing agreement and processes data only to provide their service to us. Where data is transferred outside the UK or EEA, appropriate safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses are used.

We never sell your personal data or your customers' personal data to third parties.

We keep cookies to a minimum. The Service uses only essential cookies and similar technologies (such as local storage) needed to keep you signed in and to make the Service work. We do not use advertising or cross-site tracking cookies.

We keep account data while your account is active. Customer data you upload is retained until you delete it or close your account, after which it is deleted from live systems within 30 days and from backups within 90 days, unless we must keep it to comply with a legal obligation.

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. To exercise any right, email info@bookso.co.uk. If your data was entered into Bookso by a tradesperson you do business with, we may refer your request to them as the data controller.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We use industry-standard safeguards including encryption in transit and at rest, access controls, and row-level data isolation so each account can only access its own data. No system is completely secure; we will notify you and the ICO of any personal data breach where required by law.

We may update this policy from time to time and will post the new version on this page. Questions? Email info@bookso.co.uk.

Bookso is the trading name of James Adams, trading from Nursery Gardens, Waltham Cross, EN7 6RZ. This policy is governed by the laws of England and Wales.