Privacy Policy

From Providers (service operators):

• Account information: name, email address, business name, phone number, city, and booking link slug.
• Business profile: about section, services offered, pricing, deposit amounts, availability schedule.
• Payment information: we do not store card numbers. Payment method details are held by Stripe, Inc. We store your Stripe connected account ID.
• Subscription data: plan type, billing status, and subscription dates.

From Clients (end customers who book appointments):

• Name, email address, phone number, and any notes submitted at the time of booking.
• Appointment details: service booked, date/time, and payment amounts.

Automatically collected:

• Server logs (IP address, browser type, pages visited) for security and debugging.
• No advertising tracking pixels or third-party analytics scripts are used.

• To operate and improve the Service (provide booking pages, process payments, send confirmations).
• To communicate with you about your account, bookings, and subscription.
• To detect and prevent fraud, security breaches, and violations of our Terms of Service.
• To comply with legal obligations.

We do not sell your personal information. We do not use your data for advertising.

We share personal information only with the following categories of service providers who help us operate the platform:

• Stripe, Inc. (payments) — Client payment data is processed directly by Stripe. Stripe's Privacy Policy applies.
• Resend (email delivery) — Used to send booking confirmations and account emails.
• Supabase, Inc. (database and authentication) — Your data is stored on Supabase's infrastructure (hosted on AWS in US regions). Supabase is SOC 2 Type II certified.
• Vercel, Inc. (hosting) — The Service is hosted on Vercel's edge network.

We may disclose personal information if required by law or to protect the rights, safety, or property of InstantBook, our users, or the public.

• Provider account data is retained for as long as your account is active, plus 90 days after cancellation, after which it is deleted.
• Booking records (client name, email, appointment details) are retained for 2 years to support Provider business records, then deleted.
• You may request earlier deletion by emailing hello@instantbook.ca.

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated data.
• Withdraw consent for non-essential uses (note: withdrawal may prevent use of the Service).

To exercise these rights, contact us at hello@instantbook.ca. We will respond within 30 days.

We use industry-standard security practices including TLS encryption in transit, encrypted database storage, and access controls. However, no method of transmission or storage is 100% secure. In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

We use a minimal session cookie (set by Supabase) to keep you logged in. No third-party advertising or tracking cookies are used. You can disable cookies in your browser, but doing so will prevent you from using the authenticated dashboard.

The Service is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notice. Continued use of the Service after changes take effect constitutes acceptance.

Questions, concerns, or requests? Contact our privacy officer at:

CityCentral Technologies
20 Bay Street, 11th Floor
Toronto, ON M5J 2N8, Canada
hello@instantbook.ca
(647) 873-0738

You may also file a complaint with the Office of the Privacy Commissioner of Canada.