Privacy Policy

When we are a controller and when we are a processor

For account management, support, billing, platform security, Rebooko marketing and service administration, Rebooko acts as a data controller.

For customer booking data submitted to a specific business, Rebooko usually acts as a processor for that business. The business decides which services it offers, which data it asks for and how long it needs to keep it.

Data we process

• Account data: name, email, phone, team role, company, location, address, language, settings, password hash for email/password accounts, and data needed for magic-link or OAuth sign-in.
• Booking data: customer name, contact details, selected service, time slot, staff member, notes, status, consents and change history.
• Business data: service catalog, pricing, availability, team, imports, onboarding answers, public profile and notification settings.
• Billing data: plan, invoice data, subscription status and payment-provider identifiers. Rebooko does not store full payment card numbers.
• Technical data: IP address, browser, device, access time, security logs, error events and information needed to protect the service.

How we use data

• to create and manage accounts, businesses, teams and access rights,
• to run public booking pages and accept bookings, requests, courses or classes,
• to send service emails, confirmations, reminders, cancellations and security messages,
• for billing, accounting, support, data migration, imports, integrations and platform protection,
• for Rebooko marketing only where we have a legal basis or your consent.

Legal bases

• Contract or pre-contract steps: account, bookings, onboarding, support and billing.
• Legitimate interests: security, abuse prevention, basic product measurement, service communication and product improvement.
• Legal obligation: accounting, tax records and responses to valid legal requests.
• Consent: marketing messages, optional analytics/marketing cookies and specific data types where a business needs them for a service.

Who we share data with

We share data only as needed to operate the service. This includes hosting, database, email and SMS, payment, security, support, consent-based analytics and integrations enabled by the business.

If a business connects an external calendar, payment provider, marketing tool, webhook or import source, data may be transferred to that service under its own terms.

Retention

We keep account data while Rebooko is used and for a reasonable period afterwards where needed for security, accounting or legal claims.

Booking and customer data is kept according to the business settings, legal obligations and the purpose of the service.

Your rights

• you may have rights of access, correction, deletion, restriction, portability and objection,
• where processing relies on consent, you can withdraw it,
• customers of businesses may ask the business or Rebooko support for help with exports or deletion requests,
• you may lodge a complaint with the relevant data protection authority.

Children, sensitive data and security

Rebooko is not intended for children to use independently. If a business offers services for children or processes sensitive data, it must have its own legal basis and appropriate service settings.

We use encrypted transport, tenant-separated data, auditable access controls, booking management tokens and technical measures against unauthorized access.

Transfers outside the EEA and changes

Some providers may process data outside the EEA. Where this happens, we use available legal mechanisms such as adequacy decisions or standard contractual clauses.

We may update this page as Rebooko, applicable law or the providers involved in the service change.