LegalFor everyone

Privacy Policy

What we collect, why we are allowed to, who else sees it, how long we keep it, and how to make us delete it.

Version

v1.0

Effective

In force 8 September 2026

Applies to

PDPA · Malaysia · GDPR · Poland · PDPPL · Qatar

Bokful is in beta, and these terms are a draft

Bokful is in beta. This document is a draft: it will change before launch and after it, and the numbered clauses below are not final.The facts here about data are true of the live system today, checked against the code rather than copied from a template. It is the wording that may change, not what actually happens to your data.By using Bokful during the beta you accept the service as it is. To the fullest extent the law allows, Bokful accepts no responsibility for loss arising from the beta service, from a booking made through it, or from the conduct of a business on it, until a final version of this document is published and accepted.Nothing in this notice removes a right that cannot be excluded: liability for death or personal injury caused by negligence, liability for fraud, and your non-excludable statutory consumer rights. The liability section below carries the same list.The intellectual property and acceptable use section of the Terms of Service is not a draft either. It binds everyone who opens an account, from today.

The short version

A summary, not the agreement

We collect what a booking needs: your contact details and what you booked.
We hold no card number, because Bokful takes no payments at all.
Every use of your data has a named legal basis, and no marketing email is ever sent.
Google Analytics runs on the live site before you are asked. There is no consent gate yet, and this policy says so.
You can see, correct, export or delete your data by writing to us, and complain to your national regulator.

Who is responsible for your data

Bokful is the controller for your account and your use of the platform. The business you book is the controller for its own client records.

This policy covers what Bokful does with personal data as a controller: your account, your bookings and your use of the platform.

A business you book keeps its own client record of you: notes, history, preferences. For that record the business is the controller and Bokful acts on its instructions. Ask the business for its own privacy notice.

1.1

Contact for anything in this policy: info@bokful.com, flagged as a privacy request on arrival.

1.2

Registered company details and the data-protection contact for each market are published before launch. Company registration is in progress, and this policy does not name an entity it cannot yet name.

What we collect

What a booking needs, what an account needs, and what a page view tells us. Never a card number.

Account: your email address, and a password held only by our authentication provider as a hash. If you sign in with Google, the account identifier Google returns, never your Google password.
Profile: username, display name, avatar image, short biography and phone number. Only the username is required.
Booking without an account: your name, email address and phone number, so the business can recognise you and reach you about the appointment, plus when you first and last booked so a returning client is not duplicated.
Bookings: the business, service, staff member, time, price, status and any note you added, plus whether an appointment was completed, cancelled or missed.
Images: anything you upload, such as an avatar or a business photo. These are stored in a public bucket, which means anyone holding the file’s address can view it. Do not upload an image you would not publish.
Searches: what you searched for on Bokful while signed in, so your recent searches can be offered back to you.
Messages: the confirmations and notifications we send you, and the delivery record for each, which includes the address it went to.
Launch notifications: where you asked to be told when Bokful opened in your city, your email address and country. That form is closed and no new address can be added.
Payments: nothing at all. Bokful takes no payments, so there is no card number, expiry date, security code or payment record anywhere in the product.
Your IP address: used in memory to rate-limit requests and stop abuse, and not written to any table. There is no IP column in the database.
Analytics: the pages opened on the site, the device and browser, and the address of the page, with the query string stripped back to an allowlist so a booking link’s token never leaves the site. See section 10.

Why we use it, and on what legal basis

Every use has a named basis. We send no marketing email at all, so there is no consent to give and nothing to unsubscribe from.

Every email Bokful sends is transactional: a booking confirmed, changed, cancelled or missed, a team invitation, an account email such as a password reset. There is no newsletter, no offers email and no marketing list, so nothing here is sent on the basis of consent.

To deliver your booking: the confirmation, the change and the cancellation, each with a calendar invitation. Performance of our contract with you.
To let a business serve you: passing the business the details of the appointment it is about to perform. Performance of our contract with you, and the business’s own lawful basis for its client record.
To keep the platform safe: rate limiting, abuse prevention, security investigation and error logs. Our legitimate interests.
To support you: answering a question, resolving a dispute. Performance of our contract and our legitimate interests.
To understand how the site is used: aggregate page-level measurement, described in section 10, and never a decision about you personally. Our legitimate interests, and the reason section 10 tells you plainly that it runs before you are asked.
To meet obligations: tax, accounting, consumer-protection and lawful requests. Legal obligation.

Who else sees it

The business you booked, and the processors that make a booking work. Never sold, never brokered.

4.1

Bokful does not sell personal data and does not share it for another company’s advertising.

The business you book: your name, contact details, the service and time, and any note you added. It does not see your bookings with other businesses.
Supabase: the database, the authentication and the file storage behind Bokful, on our instructions.
Vercel: application hosting and request logs.
Google: three separate things, and only the first happens to everyone: Google Analytics, described in section 10; the Places service, which sees an address as it is being searched for; and Sign in with Google, only if you choose it.
Our email host: delivers transactional email over SMTP. We do not use a bulk-email platform, so your address is not added to any marketing list by being sent a booking confirmation.
Payment provider: nobody. Bokful uses no payment provider and sends none of your data to one. If that ever changes, the provider is named here before it receives anything.
Professional advisers and authorities: where the law requires it, or to establish or defend a legal claim.

Where your data is processed

With the providers named above. Where one sits outside your market, the transfer relies on a lawful mechanism, and we will tell you which.

The database and file storage are operated by Supabase, hosting by Vercel, and analytics by Google, which is established in the United States. Ask us and we will tell you the region a given provider holds your data in and the transfer mechanism it relies on, which for Poland is the European Commission’s standard contractual clauses or an adequacy decision. This policy does not restate a region it cannot prove from configuration.

How long we keep it

While your account and bookings exist, and until you ask us to delete them. There is no automatic deletion schedule yet, and this page says so rather than promising one.

Account and profile: kept while the account is open. Ask us to close it and what we are not required to keep is deleted.
Bookings and client records: kept while they are useful to you and to the business, and for as long as tax and consumer-protection law requires in the market concerned. There is no job that deletes them on a timer today, so we do not claim one.
Delivery records: the record that a confirmation was sent, and to which address, is kept with the booking it belongs to.
Images: kept until the account or the business that owns them is removed.
Analytics: held by Google under its own retention settings for the property, not by Bokful.

Your rights

See it, correct it, take it, delete it, and complain to a regulator if we get it wrong. Today you exercise all of them by writing to us.

Write to info@bokful.com. That is the route, and it is the only route: there is no self-service data-rights screen in the account and no export button in the dashboard. Their absence changes nothing about the right. Under the GDPR the response period is one month, and we answer every request in that period, free for a first request.

Access and correction: a copy of what we hold, and a fix for anything wrong.
Deletion: removal of what we are not required to keep.
Portability: your data in a machine-readable form.
Objection and restriction: to processing based on our legitimate interests.
Withdraw consent: at any time, for anything we asked consent for.

Poland

Rights under the GDPR, including the right to lodge a complaint with the Polish supervisory authority, the Prezes Urzędu Ochrony Danych Osobowych.

Malaysia

Rights under the Personal Data Protection Act 2010, including access, correction and withdrawal of consent, and the right to complain to the Personal Data Protection Commissioner.

Qatar

Rights under Law No. 13 of 2016 on Personal Data Privacy Protection, including access, correction and erasure, and the right to complain to the Compliance and Data Protection Department at the Ministry of Transport and Communications.

Security, and what happens if something goes wrong

Encrypted in transit, access on a need-to-know basis, and a breach notified rather than buried.

Access to a booking is enforced in the database as well as in the application, so a business sees the clients who booked with it and nobody else’s. A business’s public page shows when it is unavailable but never the reason.

If a breach affects your personal data and creates a real risk to you, we tell you and the relevant authority within the time the law requires, with what happened and what to do about it.

Automated decisions, and children

No decision about you is made by a machine alone, and Bokful is not for children.

9.1

We do not make decisions with a legal or similarly significant effect on you by automated means alone, and we do not profile you for advertising.

9.2

Bokful is not intended for anyone under 16 and we do not knowingly collect their data. Where a service is booked for a child, an adult makes the booking and is responsible for it. Tell us if you believe a child has given us data and we will delete it.

Cookies and analytics

The session that keeps you signed in, a theme preference in your browser, and Google Analytics, which loads without asking. The Cookie Notice names every one.

Bokful sets no advertising cookies and runs no cross-site trackers. Google Analytics 4 does load on bokful.com, www.bokful.com and our staging site dev.bokful.com, on every visit, before anyone is asked: there is no consent gate in the product, and this policy says so rather than implying a choice you do not have.

What Google receives is the page address with its query string stripped back to an allowlist, the referring page, and the device and browser. Your email address, your phone number, your name and your booking identifiers are never sent, and there is no user identifier of ours attached to any of it. The Cookie Notice names the cookies themselves and what you can do about them today.

Changes to this policy

Dated versions. A material change is sent to you before it applies.

Each version carries its number and date at the head of this page. There is no public archive of past versions and no acceptance screen, so neither is promised: a change that materially affects what this policy says is sent to you by email before it applies.

Who to write to

Answered by a person, inside one working day.

All ways to reach us

Questions about your datainfo@bokful.com

Access, correction, deletion and export requests, flagged on arrival.

Registered company name, number and address for each market are published here before launch. Company registration is in progress.

Want your data?

Ask to see it, export it, correct it or delete it by writing to us. There is no self-service screen for it yet. We answer inside a month, free.