Draft, under legal review. This text is not final. Highlighted items are still to be decided.
Appointr privacy policy
Last updated: DECIDE: publication date
This policy explains what personal information Appointr collects, why, who else sees it, how long we keep it, and what you can ask us to do with it.
"Appointr", "we" and "us" mean DECIDE: legal entity name, e.g. "1234567 Ontario Inc., operating as Appointr", DECIDE: mailing address. Appointr is software that salons and other local businesses use to take bookings, send reminders and record payments.
The policy has three parts, because three kinds of people use Appointr:
- Part A is for merchants: business owners and the staff they add.
- Part B is for customers: people who book an appointment with a business that uses Appointr.
- Part C is for visitors to our website who do neither.
Sections 1 to 6 below apply to everyone.
1. Who is responsible for what
A business that uses Appointr decides what it collects about its customers and why. For its customers' booking information, the business is responsible (under PIPEDA it is the organization in control of that information) and Appointr processes it on the business's behalf. We only use that information to run the service for that business.
Appointr is responsible for its own information: merchant accounts, the optional customer account described in Part B, billing for our plans, and the technical logs we need to keep the service secure and working.
2. Legal basis (PIPEDA)
Appointr is based in Ontario and follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
In plain language: PIPEDA says we may collect, use and share personal information only with your consent, only for purposes a reasonable person would expect, and only as much as those purposes need. Some consent is implied. If you book a haircut and give your phone number, you expect a reminder at that number, so you do not tick a box for it. Optional things, like connecting a Google Calendar or creating a customer account, happen only when you choose them.
You can withdraw consent at any time (section 5). If you do, parts of the service may stop working for you. For example, a business cannot send you a reminder without a way to reach you.
DECIDE: confirm with the lawyer that no pilot business is in Quebec. If one is, Quebec's Law 25 adds duties (a named privacy officer is published, a privacy impact assessment before sending data outside Quebec, and more), and this policy needs a Quebec section.
3. Service providers that receive personal information
We do not sell personal information and we do not share it for advertising. We use these providers to run the service. Each one only receives what its job needs. Several are outside Canada, mostly in the United States, so your information may be stored or processed there and may be available to authorities under the laws of those countries.
| Provider | What it does for us | What it receives | Where |
|---|---|---|---|
| Fly.io | Runs our servers (the Appointr API) and our cache | Everything that passes through the service | Toronto, Canada |
| Redis, hosted by us on Fly.io | Short-lived data: rate-limit counters, one-time sign-in tokens, background jobs | IP addresses, the email or phone number being tried, job data | Toronto, Canada |
| Neon | Our main database | Everything we store (sections A1, B1) | DECIDE: confirm production region; staging plan names AWS us-east-2, Ohio, USA |
| Vercel | Hosts the web app and website | IP address, browser details, pages requested | United States and a global network |
| Backblaze B2 | Stores images | Business logos and staff photos that merchants upload | United States |
| Resend | Sends email | Recipient email address, the email's content (for example a booking confirmation with a manage link) | United States |
| Twilio | Sends text messages | Recipient phone number and the message text | United States |
| Stripe | Card payments for businesses that connect Stripe, and billing for Appointr plans | Card details (entered directly into Stripe's form, we never see the card number), the customer's name, email and phone when a card is saved, amounts, a booking reference. For plan billing: the business name and the billing address the owner enters | Canada and United States |
| Square | Card payments for businesses that connect Square instead of Stripe | Same as Stripe for card payments | Canada and United States |
| Optional features: staff Google Calendar sync, the business search used to set up Google reviews, and Sign in with Google | Calendar sync: the service name, customer name and phone, and booking note are written into the staff member's own Google Calendar, and we read back only busy start and end times, never event titles. Business search: the text the merchant types. Sign-in: the Google account id and email | United States | |
| Apple | Sign in with Apple and distribution of our mobile app | The Apple account id and email (which may be an Apple relay address) | United States |
| Expo | Delivers updates to our mobile app | Device IP address and app version | United States |
| Sentry | Error reports, so we can fix bugs | The error, the page or request where it happened, a user id. We strip request bodies, cookies, most headers, and emails. We do not record screens or sessions | United States |
| Axiom | Stores our server logs | IP address, request path with sensitive values removed, response time, error codes | United States |
A business that connects Stripe or Square has its own account with that company. Payments made to the business go into that account and are also governed by Stripe's or Square's own privacy policy.
We may also disclose information when the law requires it (for example a court order), to protect the safety or security of people or the service, or as part of selling or merging the company, in which case the buyer must keep this policy's promises.
4. How long we keep information
| Information | How long |
|---|---|
| Payment, refund and invoice records (amounts, dates, methods, references), including text-pack purchases | 6 years from the end of the tax year they relate to, because the Canada Revenue Agency requires it. If a business closes, customer names and contact details on these records are removed, the amounts stay |
| Merchant account and business data | While the account is open. After a deletion request there is a 30-day grace period, then it is deleted or anonymized, except the financial records above |
| Booking data at a business | As long as the business keeps its Appointr account, because it is the business's record. Customers can ask the business to delete it (Part B) |
| Customer account (Part B) | Until you delete it |
| Sign-in and verification codes | 10 to 15 minutes, then they stop working |
| Server logs (Axiom) | DECIDE: retention window configured in Axiom |
| Error reports (Sentry) | DECIDE: retention window of our Sentry plan |
| Database backups (Neon) | DECIDE: point-in-time restore window. Deleted data disappears from backups when that window passes |
| Payment webhook copies (the notices Stripe and Square send us about a payment) | 13 months. After that we keep only the notice's id and type, so a late duplicate is still recognised, and delete its contents |
| Duplicate-request records (what stops one payment or booking being recorded twice) | 90 days, then deleted |
DECIDE: self-serve account deletion is designed (issues #410 and #411, .planning/delete-account/PLAN.md) but not built yet. Until it ships, deletion is done by us on request through the contact in section 6. Confirm the 30-day grace period before publishing.
5. Your rights
You can ask us to:
- show you the personal information we hold about you,
- correct it if it is wrong,
- delete it, or delete your account,
- stop using it for a purpose you no longer agree to.
Write to the contact in section 6. We may need to confirm your identity first, usually by a code sent to your email. We answer within 30 days.
If your request is about a booking you made with a business, we will usually send you to that business, because it decides what happens to its records (section 1). We will help it answer you.
If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
6. Contact
Privacy questions and requests: DECIDE: privacy email, e.g. privacy@appointr.pro Person responsible for privacy: DECIDE: name of the privacy officer Mail: DECIDE: mailing address
Part A. Merchants (business owners and staff)
A1. What we collect
Your login. Name, email, a password stored only as a one-way hash (argon2id), whether your email is verified, and, if you turn it on, a two-step sign-in secret (encrypted) and recovery codes (hashed). If you sign in with Google or Apple, the account id they give us.
Your business profile. Business name and booking-page address, category, timezone, currency, street address, logo, description, brand color, public contact email and phone numbers, website, Instagram and Facebook links, booking policy, and, if you set up Google reviews, the Google place you picked or the review link you pasted.
Your team. For each staff member: name, phone, photo, public bio, start date, working hours, breaks, time off, the services they do, and their role. If a staff member gets a login, also their email and an invite link (stored only as a hash).
Payment settings. If you connect Stripe, your Stripe account id and its status. Stripe keeps your bank details, we never see them. If you connect Square, your Square merchant and location ids and the access tokens Square gives us, encrypted.
Your Appointr plan. Plan, subscription status, trial dates, and the Stripe ids of your subscription. Stripe keeps the card you pay us with and your billing address.
Google Calendar, if a staff member connects it. The Google account email, the access tokens (encrypted), and the start and end times of busy events. Never event titles or details.
Support requests. Your name, email, the category, subject and message.
What you do in Appointr. A history of changes to each booking (who changed the status or time, who recorded a payment) and, for our own admin actions, an audit log.
Technical data. Your IP address and browser type in our server logs and error reports, and short-lived counters that slow down repeated sign-in attempts.
A2. Why we use it
- To run the service you signed up for: your booking page, calendar, reminders, payments, reports.
- To sign you in and keep your account secure.
- To bill you for a paid plan and send you account emails (for example your trial ending, or your text messages running out).
- To answer support requests.
- To find and fix problems.
We do not send you marketing email without your consent. DECIDE: if we want product-news email to merchants, add an opt-in and an unsubscribe link, CASL applies
A3. Your customers' data
When you use Appointr you collect information about your customers (Part B). You are responsible for having a good reason to collect it and for telling your customers how you use it. In particular, you are responsible for your customers' consent to receive text messages. Appointr gives you a one-page summary to share (Annex below).
Part B. Customers (people who book)
B1. What is collected when you book
A business that uses Appointr collects this when you book with it, or when its staff book for you:
- your name, email and phone number (a walk-in booked by staff may have no email),
- what you booked: services, staff member, date and time, any note you add,
- what happened: whether the booking was accepted, whether you confirmed you are coming, check-in and finish times, cancellations, no-shows,
- payments: amounts, tips, how you paid (cash, card, other), refunds. If you pay by card online or save a card, you type the card into Stripe's or Square's form. The card number goes to them, not to us or the business. We keep only their reference to it,
- if the business asks for your review after a visit: your rating, comment and name,
- if you send the business a message through its booking page: your name, contact details and message.
The business may also keep private notes about you, and mark you as a VIP or block you from booking online. Appointr computes whether your last booking at that business was a no-show, so the business can see it.
Each business only sees its own customers. One business never sees what you booked at another.
B2. What the business uses it for
To hold your appointment, remind you of it, let you change or cancel it, take your payment, send you a receipt, and ask for a review if it chose to. Messages you get:
- a booking confirmation email with a link to manage your booking and a calendar invite,
- a reminder before the appointment, with a one-tap link to confirm you are coming, and sometimes a second reminder if you did not answer,
- notices if the booking is cancelled or moved,
- receipts and refund confirmations,
- text messages as well, if the business turned texting on and you gave a phone number,
- if the business turned it on, one email after your visit asking for a review.
Appointr does not send you marketing, and Appointr has no tool for businesses to send you marketing.
B3. The optional Appointr customer account
You can book as a guest. If you choose to sign in on a booking page, we email you a 5-digit code (no password) and create an Appointr customer account with your email, and, if you give them, your name and phone. This account is Appointr's own, not the business's. It lets you:
- have your details filled in when you book with any business on Appointr,
- see your bookings across businesses,
- turn off automated reminder emails or texts.
Some messages are always sent even if you turn automated ones off: receipts, refund confirmations and payment links.
Deleting the customer account does not delete bookings you made with each business, because those are the business's records (section 1). To remove those, ask the business. DECIDE: self-serve deletion of the customer account is planned, not built. Until then, write to the section 6 contact.
B4. Your rights as a customer
For a booking, ask the business first: it is responsible for its records and can correct or delete them. You can also write to us (section 6) and we will pass your request to the business and help it answer. For the Appointr customer account, ask us directly.
B5. Children
Appointr is not meant for anyone under 18. We do not knowingly create accounts for children. If a business books an appointment for a minor, a parent or guardian should make the booking and give their own contact details. DECIDE: confirm with the lawyer, and with pilot salons that serve minors
Part C. Visitors to our website
If you only visit appointr.pro DECIDE: final domain, our servers and host record your IP address, browser type and the pages you request, for security and to keep the site running. We do not use analytics, advertising or tracking tools. If you email or message us, we keep the message to answer it.
Cookies and browser storage
Appointr uses a small number of cookies, all needed for sign-in or security. None are for advertising or analytics.
| Name | What it does | How long |
|---|---|---|
appointrAppRefresh | Keeps a merchant or staff member signed in to the business portal. Holds a random token, which we store only as a hash | 7 days, renewed as you use it |
appointrCustomerRefresh | Keeps a customer signed in to their optional customer account | 30 days, renewed as you use it |
appointrAdminRefresh | Keeps Appointr's own support staff signed in to our admin tool | 7 days |
appointr_stripe_oauth_state, appointr_square_oauth_state, appointr_gcal_oauth_state | Protects the step where a merchant connects Stripe, Square or Google Calendar, by checking the same browser started and finished it | Up to 1 hour, removed when used |
The portal also saves a few preferences in your browser's local storage, such as which business you last opened, your calendar view, and your name for showing while the page loads. It never stores passwords or sign-in tokens there.
When you pay by card, Stripe's or Square's payment form may set its own cookies to prevent fraud. If you use Sign in with Google, Google may set its own. Their policies cover those.
Changes to this policy
If we make a change that matters, we will email merchants and post a notice in the app at least 30 days before it takes effect. The date at the top shows the last change.
Annex. Data processing summary
A one-page summary a business can print or send to a customer who asks how their booking information is handled.
[Business name] uses Appointr to manage appointments.
Who is responsible. [Business name] is responsible for your booking information. Appointr is the software company that stores and processes it for us, and only uses it to run the booking service for us.
What we keep. Your name, email and phone number, what you booked and when, notes you add, whether you came, and what you paid. If you pay by card, the card number goes to Stripe or Square, our payment processor. We never see it.
Why. To hold your appointment, remind you of it, let you change or cancel it, take payment, and give you a receipt. We do not use it for advertising and we do not sell it.
Messages you get. A confirmation, a reminder with a one-tap link to confirm you are coming, notices if anything changes, and receipts. Texts too, if you gave us your phone number and we text our customers.
Who else sees it. Appointr and the companies it uses to run the service: hosting, email (Resend), text messages (Twilio), payments (Stripe or Square). Some of these are in the United States.
How long. Payment records for 6 years, as Canadian tax law requires. Everything else for as long as we use Appointr, or less if you ask.
Your rights. You can ask us to show you, correct, or delete your information. Ask us at [business contact]. You can also contact Appointr at DECIDE: privacy email. Full policy: DECIDE: URL of this policy.