Privacy notice.

The data controller is the company that operates the Booka service, whose details (legal name, registered office, VAT number, certified email) are listed on the Legal notice page. For any privacy request write to info@booka-app.it.

Booka is software used by appointment-based businesses (salons, barber shops, beauty centres and similar, hereinafter "Business").

Booka is the controller of the data of website visitors, of people who contact us, of Business accounts and of end clients' personal accounts.

The data a Business enters or collects on Booka to run its activity (calendar, its clients' records, notes, payments) is processed by Booka as a processor under Art. 28 GDPR, on behalf of the Business, which remains the controller. For that data, end clients can contact the Business they book with directly; Booka supports the Business in handling the request.

Website browsing: IP address, browser and device type, pages visited and technical logs; your cookie choices; usage statistics only if you consented (see the Cookie policy).

Contact requests and applications: name, email, phone if provided, business name and type, number of people on the calendar, current tool, message, language and source page.

Business accounts: contact person's name, email, phone, business and location details, billing details, subscription status. Card details are handled directly by the payment provider and never pass through our systems.

End clients: name, phone, email, bookings and appointment history, preferences, consents given and, if you use the app, the push notification token. The Business may add notes about the service provided: we ask Businesses not to enter health or other special-category data unless strictly necessary and with an appropriate legal basis.

Providing the service (accounts, bookings, calendar, reminders, support): performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).

Answering contact requests and applications: pre-contractual steps at your request (Art. 6(1)(b)) and, where the form provides for it, your consent (Art. 6(1)(a)).

Invoicing, tax and accounting obligations: legal obligation (Art. 6(1)(c)).

Service security, prevention of abuse and fraud, legal defence: the controller's legitimate interest (Art. 6(1)(f)).

Booka marketing communications and newsletters, website usage statistics through analytics cookies: consent (Art. 6(1)(a)), which you can withdraw at any time without affecting the lawfulness of prior processing.

We use selected providers, appointed as processors under Art. 28 GDPR:

Supabase (database, authentication and storage; data hosted in the European Union, Paris region); Vercel (hosting of the website and web applications, cookieless aggregate visit statistics); Stripe (subscription payments); Resend (service emails); PostHog, EU instance (usage statistics, only with your consent); Expo (delivery of app push notifications).

Some of these providers are based in the United States. Any transfer outside the EU relies on the EU-US Data Privacy Framework adequacy decision or on the Standard Contractual Clauses approved by the European Commission. Data is never sold or shared with third parties for marketing purposes.

Account data and data uploaded by the Business: for the whole term of the contract; after the account is closed it is deleted within 90 days, except for backups, which are overwritten in the following cycles.

Billing data: 10 years, as required by Italian civil and tax law.

Contact requests and applications: up to 12 months from the last exchange, unless a contract follows.

Data processed on the basis of consent: until consent is withdrawn. Technical logs: for the time strictly needed for security and troubleshooting.

You can at any time request access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest (Arts. 15-22 GDPR). You can withdraw consents, also from your account area or the "Cookie preferences" link in the footer.

To exercise your rights write to info@booka-app.it: we reply within 30 days. If you believe the processing breaks the law you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

We protect data with encryption in transit and at rest, per-business access control (row-level security), multi-factor authentication for platform administrators and logging of sensitive operations.

The service is not intended for children under 14: if you believe a minor has given us data without parental consent, write to us and we will delete it.

We may update this notice when the service or the law changes. The date of the last update is shown at the top of the page; material changes are communicated to registered users.