Privacy Policy

1. Data Collection

We collect personal information that you voluntarily provide, including your name, email address, phone number, business details, and any data necessary to operate the platform. We also collect technical data such as IP addresses, device identifiers, and usage logs through cookies and analytics.

2. Use of Data

We use your data to operate the Appointfy service, process your subscription, send service-related notifications via WhatsApp, Instagram, email, or other channels, prevent fraud, and comply with legal obligations in the United Arab Emirates (where our company is incorporated), the United Kingdom, the European Union (GDPR), and any other jurisdiction where we offer the service. Our lawful bases for processing are: (a) performance of the contract with you, (b) our legitimate interests in operating and securing the platform, (c) your consent where required (e.g. for non-essential analytics), and (d) compliance with legal obligations.

3. Sub-Processors

To operate Appointfy we engage the following sub-processors. Each is bound by their own privacy policy and (where applicable) a data-processing agreement that limits use of personal data to the purposes listed below.

Changes to this list. We will give at least 30 days' prior notice — via in-app notification and an update to the "Last Updated" date at the top of this page — before adding or replacing a sub-processor that handles personal data. If you object, you may terminate your account before the change takes effect.

4. Stripe Connect & End-Customer Data

When a Service Provider (Salon/Barber) connects a Stripe account through Appointfy, payments from end-customers flow directly from the customer to the Service Provider's Stripe account. Appointfy does not hold, custody, or transfer end-customer funds at any stage. Cardholder information is collected solely by Stripe. End-customer personal data (name, phone, email) provided during booking is shared with the relevant Service Provider so they can fulfill the appointment.

5. Data Retention

We retain your data for as long as your account is active or as required by law. Upon account closure, we may retain certain records (such as payment history and audit logs) to comply with tax, accounting, and anti-fraud obligations. You may request deletion of personal data subject to these legal requirements.

6. Security

We apply industry-standard security measures including encryption in transit (TLS), encryption at rest, role-based access controls, and regular monitoring. However, no system is fully secure. You acknowledge that data transmission over the internet carries inherent risks, and Appointfy cannot guarantee absolute security.

7. Your Rights

Subject to applicable law, you may request access to, correction of, portability of, or deletion of your personal data. We do not sell your personal data to third parties.

For residents of the European Union, the United Kingdom, and other GDPR-equivalent jurisdictions: in addition to the rights above, you have the right under the GDPR (EU Regulation 2016/679) and the UK GDPR / Data Protection Act 2018 to object to or restrict processing, to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk), and to withdraw consent at any time without affecting the lawfulness of prior processing.

The most common request — deletion of your account or data — is documented step-by-step on our Data Deletion Instructions page. We respond to verified requests within 30 days.