Privacy Policy — bookto platform
Version 3.3 — 6 October 2026
1. Who we are
ianka fleerackers Comm. V. (hereafter "we", "us", or "our") is a Belgian limited partnership (commanditaire vennootschap) with registered offices at Nieuwstraat 84, 2880 Bornem, Belgium, and enterprise / VAT number BE 0824.677.865.
We operate the bookto platform: tools for merchants (checkout, audit, and booking) with one account on app.bookto.eu. Our role under the GDPR differs depending on who you are:
- If you are a merchant who signs up to use bookto, we are the data controller of your account, billing, and usage data.
- If you are an end customer of a merchant — buying through a checkout, completing an audit, or booking an appointment — the merchant is the data controller; we act as a data processor under a Data Processing Agreement with that merchant. You should consult the privacy policy of that merchant.
This policy applies to the merchant dashboard at app.bookto.eu and the tool subdomains checkout.bookto.eu, audit.bookto.eu, and booking.bookto.eu. For the privacy policy covering the bookto.eu marketing site, see bookto.eu Privacy Policy.
For any question about your personal data, or to exercise the rights described in section 8, contact us at legal@bookto.eu. You may write in English or Dutch; we will respond in the language you used.
2. Scope
This policy applies to all personal data we process through app.bookto.eu, checkout.bookto.eu, audit.bookto.eu, and booking.bookto.eu, whether as controller (merchant accounts) or as processor (end-customer data in the checkout, audit, and booking tools).
It is organised in two parts: what applies to the platform as a whole — your merchant account, whichever tools you use — and what each tool processes on a merchant's behalf.
It does not cover third-party websites you may reach by following an external link — once you leave, the privacy practices of the destination apply.
If you are an end customer seeking information about how your data is used, please consult the privacy policy of the merchant concerned. If you cannot locate it, you may contact us at legal@bookto.eu and we will help connect you with the correct merchant.
3. What personal data we collect
Platform: your merchant account
Account. When you sign up, we process your email address, first and last name, and, as you fill in your account, your company name, address, and VAT number, plus a role and approval flag that determine what you can do in the dashboard. Authentication is handled via magic links — no password is stored. Your account is hosted in our Supabase environment (see section 5).
Subscription and billing. When you activate a subscription, we process your billing details (name, company, address, VAT number) to charge you and issue invoices. Payments for your bookto subscription are handled by Mollie; we check VAT numbers against the EU VIES service and issue invoices through Onfact. We never see or store your card or bank details.
Trial onboarding emails. When you start a trial, we add your email address and name to our onboarding sequence in Brevo, which sends you emails about getting started with bookto during the trial.
Newsletter (optional). When you sign up for a trial or a merchant account, you may choose to receive the bookto newsletter. Only if you tick the consent box do we add your email address (and first name if you provide it) to our newsletter list, managed through Brevo — the same list described in the bookto.eu Privacy Policy. You can unsubscribe at any time via the link in every email without affecting your account.
Content you create. We store what you build in the tools — products, prices, and payment links; scorecards and their questions and reports; event types and availability. Regardless of whether this data formally qualifies as personal data under GDPR (which depends on your legal form as a merchant), we treat it with the same care and under the same protections described in this policy. If you use Create with AI or the audit AI Builder, what you give it — the text you type, and the public text of the web page you point it to — is sent to an AI model provider to write draft texts for your products, appointment types, or scorecards (see section 5). The screen always shows which model is used. The drafts are saved only after you have reviewed them. The data of your buyers, leads, and bookers is never sent to it.
Integrations you set up. On app.bookto.eu/integrations you can connect bookto to other tools, for example through webhooks, Zapier, or Make. When you do, we send the data of your orders, audit leads, or bookings to the destinations you choose, on your instruction. Those destinations are your own service providers, not ours; their own terms and privacy policies apply.
Usage and security data. Our hosting and backend log technical request data (such as IP address, browser, and time of request) to keep the platform available and to prevent abuse. We use rate limits keyed on IP addresses and a bot check from Cloudflare (Turnstile) on public forms. We measure page views with Vercel Web Analytics, which uses no cookies and does not identify you.
Google user data
When you connect a Google account to bookto, we access the following Google user data, only to provide the booking features you use:
- Your email address and account identifier — to show which Google account is connected.
- Free/busy information of your primary calendar — the time ranges when you are busy, so your booking page only offers times when you are free. We do not access the titles, descriptions, locations, or attendees of your events. Busy ranges are kept for at most 60 seconds in a temporary cache and are not stored otherwise.
- Events that bookto creates — when someone books an appointment with you, bookto creates one event for it in your own calendar, moves it if the booking is moved, and deletes it if the booking is cancelled. For appointment types that use Google Meet, bookto asks Google to attach a Meet link to that event; the meeting is created in your own Google account. We store only the identifier of that event. bookto does not read, change, or delete any other event.
We store a refresh token, encrypted, to keep the connection working. You can disconnect at any time on app.bookto.eu/integrations, which revokes our access at Google and deletes the token. Deleting your bookto account does the same.
We do not sell Google user data, do not use it for advertising, do not use it to train AI or machine-learning models, and do not share it with third parties except our infrastructure providers acting on our behalf (hosting, database, and cache — Vercel, Supabase, and Upstash, see section 5), under a data processing agreement.
bookto's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Infomaniak Calendar
You can also connect an Infomaniak calendar to bookto. You do this with your Infomaniak username and an app password that you create at Infomaniak. We store the app password encrypted and never show it again. bookto then reads only the free/busy information of your calendar, kept at most 60 seconds in a temporary cache, and writes one event per booking, which it moves or deletes together with the booking. bookto does not read, change, or delete any other event.
Infomaniak acts here as your own calendar provider, not as our service provider. You can disconnect at any time on app.bookto.eu/integrations, which deletes the stored app password; you remove the app password itself in your Infomaniak account. Deleting your bookto account also deletes the stored app password.
If you correspond with us by email
If you email us (for example at legal@bookto.eu) about your account or the platform, we receive your email address, your name if included in your signature, and the content of your correspondence. Emails are processed through Infomaniak (see section 5).
Checkout: data of buyers (processor)
When a buyer completes a checkout with a merchant, we store on the merchant's behalf the buyer's name, email address, company name and billing address (street, postal code, city, country, optional address line 2), VAT number and Peppol ID if provided, the answers to any custom fields the merchant adds, and the order details — linked to the order in our Supabase database (see section 5). We use this data to complete the order, send the order confirmation, and show the sale in the merchant's dashboard.
The payment itself is handled by Mollie through the merchant's own Mollie account. Card details, bank account information, and bank authentication are entered directly with Mollie. Neither we nor the merchant see or store the buyer's payment instrument data. We receive only a transaction reference, a status (succeeded, failed, refunded), and the amount — enough to match the payment to the order.
Audit: data of respondents (processor)
When someone completes a merchant's audit (scorecard) on audit.bookto.eu, we store on the merchant's behalf the respondent's first name and email address, an optional last name, any additional fields the merchant asks for on the lead form, their consent choice if the form asks for one, every answer, and the scores and results calculated from those answers — including a result profile and a follow-up route that the merchant defines and that is not shown to the respondent. We also store how the respondent arrived (campaign source, medium, and name from the link) and when they viewed their report.
We use this data to show the respondent their report, email it to them, notify the merchant, and show the result in the merchant's dashboard. The merchant decides what the form asks, whether consent is requested, and which privacy statement is shown on it.
When an audit is sold as a paid product through checkout, we copy the buyer's name and email address from the order into the audit invitation.
Booking: data of bookers (processor)
When someone books an appointment with a merchant through booking.bookto.eu, we store on the merchant's behalf the booker's name, email address, time zone, their answers to the questions the merchant asks on the booking form, the appointment itself (time, type, location or video-meeting link, and how often it was moved), and, if they cancel, the reason they give — linked to the appointment in our Supabase database (see section 5). We use this data to confirm the appointment, send reminders and cancellation notices, add the appointment to the merchant's calendar, and show it in the merchant's dashboard.
Documents. If the merchant allows it for an appointment type, the booker can send documents with their booking so the merchant can prepare — for example the text of a talk. Only PDF, Word, and Pages files of at most 10 MB each are accepted, up to a number the merchant sets. We store each document, with its file name and size, in private file storage in our Supabase project (see section 5), linked to the appointment. Only the merchant can download it, through a link that works for one minute; the booker can remove their own documents until the appointment starts. We do not open, read, or analyse the contents of these documents.
What we do not collect
- No card numbers, CVC codes, or bank account numbers — these never reach our servers or any merchant.
- No analytics or tracking cookies.
- No social media tracking pixels or advertising identifiers.
- No video embed cookies — the platform has no YouTube or Vimeo embeds.
- No special categories of personal data under article 9 GDPR. Merchants must not ask for such data in their custom fields, audit questions, booking questions, or documents they ask bookers to send.
4. Why we process your data and on which legal basis
Under the GDPR (article 6), we may only process personal data if we have a valid legal basis.
Platform
Managing your merchant account. When you create and use a merchant account, we process your account data, the content you create, and your tool activity to provide you access to the service. Legal basis: performance of a contract under article 6(1)(b) GDPR — the contract being your use of bookto under our terms of service.
Billing your subscription. We process your billing details to charge your subscription and issue invoices. Legal basis: performance of a contract under article 6(1)(b) GDPR, and compliance with a legal obligation under article 6(1)(c) GDPR for the invoices we must keep.
Trial onboarding emails. We send these to help you get started during your trial. Legal basis: performance of a contract under article 6(1)(b) GDPR.
Sending you our newsletter (optional). If you opt in when signing up, we process your email address — and first name if provided — to send you the bookto newsletter. Legal basis: your consent under article 6(1)(a) GDPR. You may withdraw your consent at any time by unsubscribing.
Connecting your calendar (optional). If you connect a Google account or an Infomaniak calendar, we process the calendar data described in section 3 to check your availability and add booked appointments to your calendar. Legal basis: performance of a contract under article 6(1)(b) GDPR. You can disconnect at any time.
Meeting our legal obligations. Belgian accounting and tax law (articles III.86 and following of the Belgian Code of Economic Law) requires us to retain invoicing and transaction records for seven years. For this purpose, we process the data necessary — typically names, billing addresses, VAT numbers, and transaction amounts. Legal basis: compliance with a legal obligation under article 6(1)(c) GDPR. This obligation can override an erasure request for the duration of the retention period (see sections 7 and 8).
Responding to your messages. When you contact us, we process your name, email address, and message content to reply. Legal basis: performance of a contract under article 6(1)(b) GDPR for service-related inquiries, or your consent under article 6(1)(a) GDPR for general correspondence.
Keeping the platform secure and functioning. We process technical data, rate-limit keys, and bot-check signals to keep the platform available, prevent abuse, and keep backups. Legal basis: our legitimate interest in operating secure and reliable infrastructure under article 6(1)(f) GDPR.
Tools (checkout, audit, booking)
For the data of buyers, audit respondents, and bookers, we act as a processor on behalf of the merchant. The merchant, as controller, determines the purpose and the legal basis — for example article 6(1)(b) GDPR for a sale or an appointment, or consent or legitimate interest for an audit lead. Our role is governed by a Data Processing Agreement with each merchant, and we process this data only on the merchant's instructions.
5. Who we share your data with
We do not sell, rent, or trade your personal data. We share it only with service providers who process it on our behalf, bound by a data processing agreement.
| Service provider | Purpose | Data processed | Location | Transfer safeguards |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, data storage | Merchant account and billing data, content you create, order data, audit responses, booking data and documents sent by bookers, encrypted calendar credentials and calendar event identifiers | EU region (Frankfurt). US-based parent entity. | Standard Contractual Clauses |
| Vercel Inc. | Application hosting, cookieless page-view analytics, and routing of AI requests (AI Gateway) | Technical request data; the text sent to the AI features | EU region (Frankfurt). US-based parent entity. | Standard Contractual Clauses; EU-US Data Privacy Framework |
| AI model provider — Anthropic, OpenAI, or Google, directly or through the Vercel AI Gateway | Writing draft texts in Create with AI and the audit AI Builder | The text a merchant types and the public text of the page they point to — never buyer, lead, or booker data | United States | Standard Contractual Clauses; EU-US Data Privacy Framework |
| Resend Inc. | Transactional email: order confirmations, sale notifications, audit reports, booking confirmations, reminders, and cancellations | Recipient name and email address, order, report, or appointment details | United States | Standard Contractual Clauses; EU-US Data Privacy Framework |
| Upstash Inc. | Rate limiting and short-lived cache | IP addresses (as rate-limit keys); calendar busy ranges (kept at most 60 seconds) | US-based provider | Standard Contractual Clauses |
| Cloudflare Inc. | Bot check (Turnstile) on public checkout and booking forms | IP address, browser signals | United States | Standard Contractual Clauses; EU-US Data Privacy Framework |
| GitHub Inc. | Daily database backup | Merchant account, subscription, invoice, product, and order records — buyer contact details are excluded | United States | Standard Contractual Clauses; EU-US Data Privacy Framework |
| Brevo — Sendinblue SAS | Trial onboarding emails; newsletter for merchants who opt in | Merchant email address, first and last name | France (EU) | None required |
| Mollie B.V. | Payments for your bookto subscription (independent controller for the payment transaction). Checkout payments run through the merchant's own Mollie account. | Payment details entered directly with Mollie — never reach our servers. Transaction reference, status, and amount returned to us. | Netherlands (EU) | None required |
| Onfact | Invoices for your bookto subscription | Merchant name, company, billing address, VAT number, amounts | Belgium (EU) | None required |
| Infomaniak Network SA | Email content, name, email address | Switzerland | None required (EU adequacy decision for Switzerland) |
Destinations you choose. Services you connect yourself — through webhooks, Zapier, Make, or your own accounts with other providers — receive data on your instruction. They are not our sub-processors; your agreement with them applies.
Public authorities. In exceptional cases we may be required to disclose personal data to public authorities (court order, law enforcement, tax audit). We only do so when legally obliged and limit disclosure to what is strictly required.
6. International transfers of personal data
Where possible, we keep your personal data within the European Economic Area. Vercel EU regions, Supabase EU regions, Mollie, Onfact, and Brevo store your data in the EU by default. Infomaniak stores email in Switzerland, which the European Commission recognises as offering an adequate level of protection.
For services with US-based parent entities — Vercel, Supabase, Resend, Upstash, Cloudflare, GitHub, and the AI model providers — operational routing or processing may involve the United States. We rely on Standard Contractual Clauses (article 46 GDPR) signed with each provider, and on the EU-US Data Privacy Framework certification where the provider is certified. We monitor the status of the framework. If it is invalidated or replaced, we continue to rely on Standard Contractual Clauses.
You have the right to request a copy of the specific safeguards we rely on. Contact us at legal@bookto.eu.
7. How long we keep your data
Platform
Merchant accounts. As long as your account is active, plus 12 months after account deactivation to handle any final billing, support, or legal matters. After that, account data is deleted, except for the parts we are required to keep for accounting (see below).
Unused trial accounts. If a trial ends without a subscription, the account and all its data are deleted 30 days after the trial ends. We warn you by email 7 days before.
Newsletter subscribers. If you opted in to our newsletter, we keep your email address on our newsletter list for as long as your subscription is active. When you unsubscribe, it is removed within 30 days. Brevo may retain anonymised analytics data after removal. This is independent of your merchant account: unsubscribing does not affect your account, and deleting your account does not by itself remove you from the newsletter.
Calendar connection. The encrypted Google refresh token or Infomaniak app password, and the identifiers of events bookto created, are kept as long as your calendar is connected. They are deleted when you disconnect or delete your bookto account. Busy ranges are never stored beyond a temporary cache of at most 60 seconds.
Invoices and transaction records. Retained for 7 years under Belgian accounting and tax law (articles III.86 and following of the Belgian Code of Economic Law). This obligation overrides an earlier erasure request but is strictly limited to names, billing addresses, VAT numbers, transaction amounts, and transaction references.
Email correspondence. Up to 2 years after our last exchange, after which correspondence is deleted unless it relates to an active or anticipated legal matter.
Technical logs. Vercel and Supabase logs are retained for up to 90 days for security, debugging, and abuse prevention.
Tools
Checkout orders. Order data is kept for at least 7 years, as required for accounting (see above).
Audit responses. Kept for 12 months after the audit was completed, then deleted. An invitation for a paid audit that was never used is kept, but the name and email address in it are removed after 12 months.
Booking data. The booker's details and answers, and any documents they sent, are kept for 12 months after the appointment, then deleted. Documents sent with a booking that was never paid for are deleted within two days.
Legal holds
In case of an actual or anticipated legal dispute, regulatory investigation, or law enforcement request, we may retain otherwise-deletable data as long as strictly necessary. You will be informed if the law permits.
8. Your rights
The GDPR gives you strong rights over your personal data. You can exercise any of them free of charge, and we will respond within 30 days. For complex requests we may extend this period by up to two additional months under article 12(3) GDPR; if we do, we will tell you within the first month and explain why.
Right of access (article 15). Ask whether we process data about you and receive a copy with information about purposes, categories, recipients, and retention.
Right to rectification (article 16). Ask us to correct or complete inaccurate or incomplete data.
Right to erasure (article 17). Ask us to delete your personal data. We will do so unless we are required or entitled to keep it — in particular, the 7-year accounting retention described in section 7 will override an erasure request for transaction records for the duration of that period.
Right to restriction of processing (article 18). In certain situations, ask us to pause processing instead of deleting.
Right to data portability (article 20). Receive data you provided, in a structured, commonly used, machine-readable format, or ask us to transmit it to another controller.
Right to object (article 21). Object to processing based on our legitimate interest.
Right to withdraw consent (article 7(3)). Withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Right to lodge a complaint (article 77). File a complaint with the Belgian Gegevensbeschermingsautoriteit (see section 9).
How to exercise your rights
Contact us at legal@bookto.eu. We do not ask for a copy of your ID. We confirm your identity proportionately — usually by replying from the email address we have on file for you, or by asking a limited verification question if we have reasonable doubt. We follow the guidance of the European Data Protection Board: identity verification must be proportionate and must not create unnecessary barriers.
If you are an end customer
Your rights are primarily against the merchant, who is the controller for your data. If you need our help locating the right merchant, contact us at legal@bookto.eu and we will assist.
If we cannot act on your request — for example because we must keep the data under a legal obligation — we will explain why in our response.
9. Supervisory authority, changes, and contact
Supervisory authority
If you believe we have not handled your personal data correctly, you have the right to file a complaint with the Belgian data protection authority:
Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD) Drukpersstraat 35, 1000 Brussels, Belgium Phone: +32 (0)2 274 48 00 Email: contact@apd-gba.be — Website: www.gegevensbeschermingsautoriteit.be
You also retain the right to seek a judicial remedy before the competent civil court.
Changes to this policy
We may update this policy from time to time. When we do, we update the version number and date at the top. For changes that affect how we process your data materially, we notify registered merchants in advance and ask for fresh consent where required.
Contact
For any question about this policy, contact us at legal@bookto.eu in English or Dutch.
ianka fleerackers Comm. V. · Nieuwstraat 84, 2880 Bornem, Belgium · VAT BE 0824.677.865