Privacy Policy

1. Company Information

11111221 Canada INC., operating as Book8, has its principal place of business in Ottawa, Ontario, Canada. Our services are accessible globally to users worldwide.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Name, email address, password (encrypted), profile picture
• Business Information: Business name, description, booking preferences, availability settings
• Booking Data: Appointment details, customer names, contact information, notes, and scheduling preferences
• Payment Information: Billing address and payment method details (processed securely by Stripe)
• Communications: Messages, support requests, and feedback you send to us

2.2 Information Collected Through Third-Party Integrations

• Google Calendar: Calendar events, availability, and scheduling data when you connect your Google account
• Microsoft Outlook: Calendar events and scheduling data when you connect your Microsoft account
• OAuth Authentication: Basic profile information (name, email, profile picture) when you sign in with Google or Microsoft

2.3 Information Collected Automatically

• Device Information: Browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, time spent on the platform
• Log Data: IP address, access times, referring URLs
• Location Data: General geographic location based on IP address (not precise location)

2.4 Voice AI Features

When you use our Voice AI features for phone bookings:

• Voice recordings may be processed to understand booking requests
• Transcriptions are generated for booking confirmation
• Call metadata (duration, timestamp) is collected
• Voice data is processed in accordance with applicable laws and is not sold to third parties

2.5 SMS and Email Communications

When you book an appointment through a Book8-powered business and provide your contact information:

• Your phone number is used to send booking confirmation and appointment reminder SMS messages via Twilio
• Your email address (if provided) is used to send booking confirmation and reminder emails via Resend
• SMS reminders are sent at 24 hours, 1 hour, and 30 minutes before your appointment
• You can reply CANCEL BOOKING to cancel your appointment
• You can reply STOP to opt out of all SMS messages
• Message and data rates may apply
• Your contact information is not sold to third parties

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our booking and scheduling services
• Process and manage bookings and appointments
• Sync your calendar across connected platforms
• Process payments and manage subscriptions
• Send booking confirmations, reminders, and service notifications
• Provide customer support and respond to inquiries
• Analyze usage patterns to improve our platform
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations
• Send marketing communications (with your consent)

Data Retention

We retain different types of data for different periods to balance service delivery with your right to erasure:

• Account data (name, email, business info): Retained while your account is active. Deleted within 30 days of account closure unless legally required.
• Booking records: Retained for 7 years after booking date for tax and legal compliance, then deleted.
• Call recordings & transcripts: Retained for 90 days, then automatically deleted, unless you request immediate deletion.
• Billing records: Retained for 7 years per applicable tax law.
• Application logs: Retained for 30 days.
• Audit logs (security events): Retained for 12 months.

You may request earlier deletion of any data category by contacting privacy@book8.io. Some retention periods are mandated by law and cannot be shortened.

Encryption & Security

All customer data is encrypted at rest using AES-256 (provided by MongoDB Atlas) and in transit using TLS 1.2 or higher. Authentication credentials are stored using industry-standard hashing (bcrypt). Access to production data is restricted to authorized personnel and logged.

Sub-Processors

We use third-party sub-processors to deliver our service. The full current list is available at book8.io/sub-processors.

4. Data Sharing and Third-Party Services

We share your information with the following categories of third parties:

4.1 Payment Processing

4.2 Calendar Integrations

4.3 Voice and Communication Services

4.4 Other Disclosures

We may also share your information:

• With service providers who assist in operating our platform (hosting, analytics, support)
• To comply with legal obligations, court orders, or government requests
• To protect our rights, privacy, safety, or property
• In connection with a merger, acquisition, or sale of assets
• With your consent or at your direction

4.5 Email Services

5. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Keep you signed in to your account
• Remember your preferences and settings
• Understand how you use our platform
• Improve our services based on usage patterns

Types of Cookies We Use

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our platform.

6. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy. Specifically:

• Account Data: Retained while your account is active and for up to 30 days after deletion request
• Booking Data: Retained for 7 years for business and legal compliance purposes
• Payment Records: Retained as required by tax and financial regulations (typically 7 years)
• Voice Recordings: Retained for up to 90 days unless required for dispute resolution
• Log Data: Retained for up to 12 months

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication mechanisms including OAuth 2.0
• Regular security assessments and monitoring
• Access controls and employee training
• Secure data centers with physical security measures

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

8. International Data Transfers

As a Canadian company serving users worldwide, your information may be transferred to and processed in countries other than your country of residence, including Canada and the United States.

When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by relevant authorities
• Adequacy decisions where applicable
• Binding Corporate Rules for transfers within our organization
• Your explicit consent where required

9. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a machine-readable format
• Restriction: Request restriction of processing of your data
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at privacy@book8.io. We will respond to your request within 30 days.

10. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on: contract performance, legitimate interests, consent, or legal obligations
• Data Protection Officer: Contact our DPO at dpo@book8.io
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority
• Automated Decision-Making: We do not make solely automated decisions that significantly affect you

11. CCPA Compliance (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to Know: What personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights

To exercise your CCPA rights, contact us at privacy@book8.io or call us at the number provided in the Contact section.

12. PIPEDA Compliance (Canadian Users)

As a Canadian company, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA):

• Accountability: We are responsible for personal information under our control
• Consent: We obtain meaningful consent for the collection, use, and disclosure of personal information
• Limiting Collection: We collect only information necessary for identified purposes
• Accuracy: We keep personal information accurate, complete, and up-to-date
• Access: You can request access to your personal information held by us

You may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

13. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information as quickly as possible. If you believe we have collected information from a child under 16, please contact us at privacy@book8.io.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending you an email notification (for significant changes)
• Displaying a notice within our platform

We encourage you to review this policy periodically. Your continued use of our services after changes are posted constitutes your acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Book8 is a trade name of 11111221 Canada INC.