Privacy Policy — bookto platform
Version 2.3 — 4 October 2026
1. Who we are
ianka fleerackers Comm. V. (hereafter "we", "us", or "our") is a Belgian limited partnership (commanditaire vennootschap) with registered offices at Nieuwstraat 84, 2880 Bornem, Belgium, and enterprise / VAT number BE 0824.677.865.
We operate the bookto platform: tools for merchants (checkout, audit, and booking) with one account on app.bookto.eu. Our role under the GDPR differs depending on who you are:
- If you are a merchant who signs up to use our tool, we are the data controller of your account and tool usage data.
- If you are an end customer completing a checkout or booking an appointment through a merchant using our tool, the merchant is the data controller; we act as a data processor under a Data Processing Agreement with that merchant. You should consult the privacy policy of the merchant you are purchasing from.
This policy applies to the merchant dashboard at app.bookto.eu and the tool subdomains checkout.bookto.eu, audit.bookto.eu, and booking.bookto.eu. For the privacy policy covering the bookto.eu marketing site, see bookto.eu Privacy Policy.
For any question about your personal data, or to exercise the rights described in section 8, contact us at legal@bookto.eu. You may write in English or Dutch; we will respond in the language you used.
2. Scope
This policy applies to all personal data we process through app.bookto.eu, checkout.bookto.eu, audit.bookto.eu, and booking.bookto.eu, whether as controller (merchant accounts) or as processor (end-customer data during checkouts and bookings).
It does not cover third-party websites you may reach by following an external link — once you leave, the privacy practices of the destination apply.
If you are an end customer seeking information about how your data is used, please consult the privacy policy of the merchant you purchased from. If you cannot locate it, you may contact us at legal@bookto.eu and we will help connect you with the correct merchant.
3. What personal data we collect
If you are a merchant (account holder on the tool)
When you sign up for a merchant account, we process your email address, a role and approval flag that determine what you can do in the dashboard, and any additional profile information you choose to provide. Authentication is handled via magic links — no password is stored. Your account is hosted in our Supabase environment (see section 5).
We also store any product information you create — product names, descriptions, prices, and the payment links you generate. Regardless of whether this data formally qualifies as personal data under GDPR (which depends on your legal form as a merchant), we treat it with the same care and under the same protections described in this policy.
Newsletter (optional). When you sign up for a trial or a merchant account, you may choose to receive the bookto newsletter. Only if you tick the optional consent box do we add your email address (and first name if you provide it) to our mailing list, managed through Brevo — the same list described in the bookto.eu Privacy Policy. This is entirely separate from your account: subscribing is never required to use the tool, and you can unsubscribe at any time via the link in every email without affecting your account.
Google user data
When you connect a Google account to bookto, we access the following Google user data, only to provide the booking features you use:
- Your email address and account identifier — to show which Google account is connected.
- Free/busy information of your primary calendar — the time ranges when you are busy, so your booking page only offers times when you are free. We do not access the titles, descriptions, locations, or attendees of your events. Busy ranges are kept for at most 60 seconds in a temporary cache and are not stored otherwise.
- Events that bookto creates — when someone books an appointment with you, bookto creates one event for it in your own calendar and deletes it if the booking is cancelled. We store only the identifier of that event. bookto does not read, change, or delete any other event.
We store a refresh token, encrypted, to keep the connection working. You can disconnect at any time on app.bookto.eu/integrations, which revokes our access at Google and deletes the token. Deleting your bookto account does the same.
We do not sell Google user data, do not use it for advertising, do not use it to train AI or machine-learning models, and do not share it with third parties except our infrastructure providers acting on our behalf (hosting, database, and cache — Vercel, Supabase, and Upstash, see section 5), under a data processing agreement.
bookto's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
If you correspond with us by email
If you email us (for example at legal@bookto.eu) about your account or the tool, we receive your email address, your name if included in your signature, and the content of your correspondence. Emails are processed through Infomaniak (see section 5).
Processor note: end-customer data during checkouts
When an end customer completes a checkout via a merchant using our tool, we store on the merchant's behalf the customer's name, email address, billing address (street, postal code, city, country, optional address line 2), and VAT number if provided — linked to the specific order in our Supabase database (see section 5). The merchant is the data controller for this data; we process it only on their instructions under our DPA.
The payment transaction itself — card details, bank account information, bank authentication — is handled directly by Mollie, our payment processor (see section 5). Neither we nor the merchant see or store the customer's payment instrument data. We receive only a transaction reference, a status (succeeded, failed, refunded), and the amount — enough to match the payment to the order.
Processor note: booking data
When someone books an appointment with a merchant through booking.bookto.eu, we store on the merchant's behalf the booker's name, email address, and their answers to the questions the merchant asks on the booking form, linked to the appointment in our Supabase database (see section 5). We use this data to confirm the appointment, send reminders and cancellation notices, and show the appointment in the merchant's dashboard. The merchant is the data controller for this data; we process it only on their instructions under our DPA.
What we do not collect on this site
- No card numbers, CVC codes, or bank account numbers — these never reach our servers or any merchant.
- No analytics or tracking cookies — the bookto platform is an application, not a public marketing site.
- No social media tracking pixels or advertising identifiers.
- No video embed cookies — this site has no YouTube or Vimeo embeds.
- No special categories of personal data under article 9 GDPR.
4. Why we process your data and on which legal basis
Under the GDPR (article 6), we may only process personal data if we have a valid legal basis.
Managing your merchant account. When you create and use a merchant account, we process your email address, profile information, and tool activity to provide you access to the service. Legal basis: performance of a contract under article 6(1)(b) GDPR — the contract being your use of the tool under our terms of service.
Processing payments on behalf of merchants. We process end-customer name, email, billing address, VAT number, and payment transaction data as a processor on behalf of the merchant who is selling. The merchant, as controller, relies on article 6(1)(b) GDPR (performance of the sale contract with their customer). Our role is governed by a Data Processing Agreement with each merchant. Payment data (card numbers, CVC, bank credentials) is always handled directly by Mollie — never by us.
Handling bookings on behalf of merchants. We process the booker's name, email address, and answers as a processor on behalf of the merchant whose appointment is booked. The merchant, as controller, determines the legal basis — typically article 6(1)(b) GDPR (steps taken at the booker's request before or under a contract). Our role is governed by a Data Processing Agreement with each merchant.
Connecting your Google Calendar (optional). If you connect a Google account, we process the Google user data described in section 3 to check your availability and add booked appointments to your calendar. Legal basis: performance of a contract under article 6(1)(b) GDPR. You can disconnect at any time.
Sending you our newsletter (optional). If you opt in when signing up for a trial or account, we process your email address — and first name if provided — to send you the bookto newsletter. Legal basis: your consent under article 6(1)(a) GDPR, given by ticking the optional box at signup. Subscribing is never a condition of using the Services, and you may withdraw your consent at any time by unsubscribing.
Meeting our legal obligations. Belgian accounting and tax law (articles III.86 and following of the Belgian Code of Economic Law) requires us to retain invoicing and transaction records for seven years. For this purpose, we process the data necessary — typically names, billing addresses, VAT numbers, and transaction amounts. Legal basis: compliance with a legal obligation under article 6(1)(c) GDPR. This obligation can override an erasure request for the duration of the retention period (see sections 7 and 8).
Responding to your messages. When you contact us, we process your name, email address, and message content to reply. Legal basis: performance of a contract under article 6(1)(b) GDPR for service-related inquiries, or your consent under article 6(1)(a) GDPR for general correspondence.
Keeping the site secure and functioning. Our hosting provider (Vercel) and backend (Supabase) process technical data to keep the tool available and prevent abuse. Legal basis: our legitimate interest in operating secure infrastructure under article 6(1)(f) GDPR.
5. Who we share your data with
We do not sell, rent, or trade your personal data. We share it only with service providers who process it on our behalf, bound by a data processing agreement.
| Service provider | Purpose | Data processed | Location | Transfer safeguards |
|---|---|---|---|---|
| Infomaniak Network SA | Email content, name, email address | Switzerland | None required (EU adequacy decision for Switzerland) | |
| Vercel Inc. | Application hosting | Technical request data | EU region (Frankfurt). US-based parent entity. | Standard Contractual Clauses; EU-US Data Privacy Framework |
| Supabase Inc. | Database, authentication, data storage | Merchant account data (email, role, profile), product information, order data (name, email, billing address, VAT number, transaction references), booking data (booker name, email, answers), encrypted Google refresh token and calendar event identifiers | EU region (Frankfurt). US-based parent entity. | Standard Contractual Clauses |
| Mollie B.V. | Payment processing (independent controller for the payment transaction) | Payment details entered directly with Mollie (card number, CVC, bank credentials) — never reach our servers. Transaction reference, status, and amount returned to us. | Netherlands (EU) | None required |
| Resend Inc. | Transactional email (order confirmations, sale notifications, booking confirmations, reminders, and cancellations) | Buyer and booker name, email address, order and appointment details | United States | Standard Contractual Clauses; EU-US Data Privacy Framework |
| Brevo — Sendinblue SAS | Newsletter email for merchants who opt in; post-payment email automations (when activated by merchant) | Merchant email address and first name (newsletter); buyer email address and product tags (automations) | France (EU) | None required |
| Upstash Inc. | Rate limiting and short-lived cache | IP addresses (as rate-limit keys); Google Calendar busy ranges (kept at most 60 seconds) | US-based provider | Standard Contractual Clauses |
| Onfact | Invoice generation (when activated by merchant) | Buyer name, billing address, VAT number, transaction amount | Belgium (EU) | None required |
Public authorities. In exceptional cases we may be required to disclose personal data to public authorities (court order, law enforcement, tax audit). We only do so when legally obliged and limit disclosure to what is strictly required.
6. International transfers of personal data
Where possible, we keep your personal data within the European Economic Area. Vercel EU regions, Supabase EU regions, Mollie, Onfact, and Brevo store your data in the EU by default. Infomaniak stores email in Switzerland, which the European Commission recognises as offering an adequate level of protection.
For services with US-based parent entities — Vercel, Supabase, Resend, Upstash — operational routing may involve the United States. We rely on Standard Contractual Clauses (article 46 GDPR) signed with each provider, and on the EU-US Data Privacy Framework certification where the provider is certified. We monitor the status of the framework. If it is invalidated or replaced, we continue to rely on Standard Contractual Clauses.
You have the right to request a copy of the specific safeguards we rely on. Contact us at legal@bookto.eu.
7. How long we keep your data
Merchant accounts. As long as your account is active, plus 12 months after account deactivation to handle any final billing, support, or legal matters. After that, account data is deleted, except for the parts we are required to keep for accounting (see below).
Newsletter subscribers. If you opted in to our newsletter, we keep your email address on our mailing list for as long as your subscription is active. When you unsubscribe, it is removed within 30 days. Brevo may retain anonymised analytics data after removal. This is independent of your merchant account: unsubscribing does not affect your account, and deleting your account does not by itself remove you from the newsletter.
Order and transaction data. Retained for 7 years under Belgian accounting and tax law (articles III.86 and following of the Belgian Code of Economic Law). This obligation overrides an earlier erasure request for transaction records but is strictly limited to names, billing addresses, VAT numbers, transaction amounts, and transaction references.
Booking data. The booker's name, email address, and answers are kept for 12 months after the appointment, then deleted.
Google connection. The encrypted refresh token and the identifiers of events bookto created are kept as long as your Google account is connected. They are deleted when you disconnect or delete your bookto account. Busy ranges are never stored beyond a temporary cache of at most 60 seconds.
Email correspondence. Up to 2 years after our last exchange, after which correspondence is deleted unless it relates to an active or anticipated legal matter.
Technical logs. Vercel and Supabase logs are retained for up to 90 days for security, debugging, and abuse prevention.
Legal holds. In case of an actual or anticipated legal dispute, regulatory investigation, or law enforcement request, we may retain otherwise-deletable data as long as strictly necessary. You will be informed if the law permits.
8. Your rights
The GDPR gives you strong rights over your personal data. You can exercise any of them free of charge, and we will respond within 30 days. For complex requests we may extend this period by up to two additional months under article 12(3) GDPR; if we do, we will tell you within the first month and explain why.
Right of access (article 15). Ask whether we process data about you and receive a copy with information about purposes, categories, recipients, and retention.
Right to rectification (article 16). Ask us to correct or complete inaccurate or incomplete data.
Right to erasure (article 17). Ask us to delete your personal data. We will do so unless we are required or entitled to keep it — in particular, the 7-year accounting retention described in section 7 will override an erasure request for transaction records for the duration of that period.
Right to restriction of processing (article 18). In certain situations, ask us to pause processing instead of deleting.
Right to data portability (article 20). Receive data you provided, in a structured, commonly used, machine-readable format, or ask us to transmit it to another controller.
Right to object (article 21). Object to processing based on our legitimate interest.
Right to withdraw consent (article 7(3)). Withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Right to lodge a complaint (article 77). File a complaint with the Belgian Gegevensbeschermingsautoriteit (see section 9).
How to exercise your rights
Contact us at legal@bookto.eu. We do not ask for a copy of your ID. We confirm your identity proportionately — usually by replying from the email address we have on file for you, or by asking a limited verification question if we have reasonable doubt. We follow the guidance of the European Data Protection Board: identity verification must be proportionate and must not create unnecessary barriers.
If you are an end customer
Your rights are primarily against the merchant, who is the controller for your data. If you need our help locating the right merchant, contact us at legal@bookto.eu and we will assist.
If we cannot act on your request — for example because we must keep the data under a legal obligation — we will explain why in our response.
9. Supervisory authority, changes, and contact
Supervisory authority
If you believe we have not handled your personal data correctly, you have the right to file a complaint with the Belgian data protection authority:
Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD) Drukpersstraat 35, 1000 Brussels, Belgium Phone: +32 (0)2 274 48 00 Email: contact@apd-gba.be — Website: www.gegevensbeschermingsautoriteit.be
You also retain the right to seek a judicial remedy before the competent civil court.
Changes to this policy
We may update this policy from time to time. When we do, we update the version number and date at the top. For changes that affect how we process your data materially, we notify registered merchants in advance and ask for fresh consent where required.
Contact
For any question about this policy, contact us at legal@bookto.eu in English or Dutch.
ianka fleerackers Comm. V. · Nieuwstraat 84, 2880 Bornem, Belgium · VAT BE 0824.677.865