Privacy policy

Last updated 15 October 2026

This policy explains what personal data Bookupy collects, why, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Bookupy is an online booking service run by Daniel Dyer in the UK ("Bookupy", "we", "us"). Contact: hello@bookupy.com.

For the accounts of businesses that sign up, we are the controller. For the booking data a business collects from its own customers through Bookupy, the business is the controller and we act as its processor, handling that data on its instructions to provide the service.

Data we collect from businesses

Account details: business name, owner name, email address, phone number, business address and password (stored only as a secure hash).
Set-up details: services, prices, opening hours, and staff names, titles and working hours.
Team logins: the name and email address of any staff the owner invites.
Billing: subscription status and Stripe customer references. Card details are taken and held by Stripe; we never see or store full card numbers.

Data we collect from customers who book

Your email address, and your name and mobile number if the business asks for them or you choose to give them.
Booking details: the service, date, time, staff member and any notes.
Basic technical data such as IP address, used briefly for security and to prevent abuse (for example rate limiting).

How and why we use it

To provide the service: taking bookings, showing them in the business's diary, and sending confirmations, reminders and change notices (performance of a contract, and the business's legitimate interests in running its appointments).
To bill businesses for their subscription (performance of a contract).
To keep Bookupy secure and working, and to provide support (legitimate interests).
To meet legal obligations, such as keeping financial records.

We don't sell personal data, and we don't use it for advertising.

Who we share it with

We use a small number of service providers to run Bookupy, under contracts that require them to protect the data:

Cloudflare: hosting, database, file storage and security.
Stripe: subscription payments from businesses.
Email provider (such as Resend): sending confirmation and reminder emails.
SMS provider (such as Twilio or ClickSend): sending text reminders, only where a business has turned on text reminders and a customer has given a mobile number.

Customer booking details are of course shared with the business you book with. Some providers may process data outside the UK; where they do, we rely on appropriate safeguards such as UK adequacy regulations or the UK International Data Transfer Addendum.

How long we keep it

Business accounts: for as long as the account is open, then deleted or anonymised within 90 days of closure, except records we must keep by law.
Bookings: kept for the business while its account is open so it has a booking history; deleted when the account is deleted, or sooner at the business's request.
Billing records: kept for up to 6 years for tax and accounting purposes.
Login sessions: expire after 30 days. Security logs are kept only as long as needed.

Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to how it's used, and to data portability. If you booked with a business, you can contact that business directly, or email us and we'll pass your request on. To use any of these rights, email hello@bookupy.com.

If you're unhappy with how we handle your data, please contact us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

We only use essential cookies. See our cookie policy.

Changes

We may update this policy. The date at the top shows when it last changed.