Privacy notice
The short version Not a substitute for the full notice
- We collect only what bookings need: names, mobile numbers, emails, booking details and payments.
- Your customers' data belongs to your business. We process it for you, and nothing else.
- We never sell personal data, and we don't run ads on booking pages.
- Marketing texts and emails go only to people who said yes. Every one has a way to opt out.
- We follow the Data Privacy Act of 2012. You can ask to see, correct or delete your data.
- Clinics: we don't store diagnoses or medical records.
Who we are
booked.run is online booking and front-desk software for small businesses. It is run by [Company name], Inc., a corporation registered in the Philippines with SEC registration no. [SEC no.], at [registered address]. In this notice, "we" and "us" mean booked.run.
This notice covers booked.run, the booking sites and links businesses publish with it, and booked.run's own website.
DRAFT · Legal entity, SEC number and NPC registration number to be filled in.
Two kinds of people
We handle data for two groups, and our role is different for each.
- Business owners and their teams who sign up for booked.run. For your account data, we are the personal information controller.
- Their customers, who book through a business's booking site, link or website button. For this data, the business is the personal information controller and we are its personal information processor. We follow the business's instructions and our agreement with them.
What we collect
- Account details: name, work email, mobile number, sign-in details, business name, address, opening hours, services, team members and their roles.
- Booking details: customer name, mobile number, optional email, the service, time, staff, space or equipment, and any note the customer adds in the free-text note field.
- Payment details: amounts, status, transfer references and receipt images uploaded for GCash or bank transfers. When online card and e-wallet payments launch, card details will be handled by our payment provider; we will never see full card numbers.
- Messages: the confirmations, reminders and campaign messages sent through booked.run, and whether they were delivered, opened or reported as spam.
- Usage data: device, browser, pages visited and errors, so we can keep the service working and secure.
- Booking-site visits: booking sites count visits anonymously and without cookies, so a business can see how many people visit and book. A random id kept in the visitor's browser, which changes every day, means we count each visitor once a day. We keep only daily totals by source (like Instagram or Google), phone or desktop, and page. We don't store IP addresses or anything that identifies the visitor or links the visit to a booking customer, and the random ids are deleted within two days.
- Contact form: your name, business, how you want us to reply and your message, when you write to us from booked.run/contact.
We do not ask for, and businesses should not enter, sensitive personal information such as health diagnoses, government ID numbers or financial account numbers beyond a transfer reference.
Why we use it
To run bookings, send confirmations and reminders, record deposits, show reports, keep accounts secure, bill subscriptions and support you.
Our lawful bases under the Data Privacy Act are the contract with the business, our legitimate interest in keeping the service secure and working, compliance with legal obligations, and consent for marketing messages.
We don't use customers' data for our own marketing, and we don't sell or rent personal data to anyone.
Texts, emails and campaigns
Booking messages, such as confirmations, reminders and links to change a booking, are part of the service.
Marketing messages from a business go only to customers who agreed to receive news from that business. Every campaign message includes a way to opt out, and a spam report stops that business's news to that person. Opting out of one business's news doesn't affect booking messages or other businesses.
Where it is stored
Some providers store data outside the Philippines. When they do, we use contracts and security measures that keep your data protected to the standard the Data Privacy Act requires.
How long we keep it
While a business uses booked.run, and for [90 days] after it closes its account, so it can export its data. Then we delete it or make it anonymous.
Some records, like invoices and payment records, we keep longer when tax or other laws require it. Contact form messages we keep for [12 months].
Your rights
Under the Data Privacy Act of 2012 you have the right to be informed, to access, to object, to correct, to erasure or blocking, to data portability, to damages, and to file a complaint with the National Privacy Commission.
Business owners can see, correct and export most of their data in the app. Customers of a business should contact that business; if you write to us, we'll pass your request on and help them answer.
How we protect it
Data is encrypted in transit and at rest. Each team member sees only what their role allows. Receipt images are private files, never public links. We review access and fix security issues promptly, and we will notify the National Privacy Commission and affected people of a personal data breach as the law requires.
Changes to this notice
If we change this notice in a way that matters, we'll email account owners at least 30 days before it takes effect. The date at the top always shows the latest version.
Contact us or the NPC
Data Protection Officer: [DPO name], [email protected], [postal address]. If you are not satisfied with our answer, you can contact the National Privacy Commission at privacy.gov.ph.