Bookalo
ESEN

Privacy policy

Last updated:

This policy explains what data Bookalo handles, why, and what you can do about it, whether you run a business on Bookalo or booked an appointment with one.

1. Who we are

Bookalo is operated by RicardoHQ LLC, a Florida limited liability company based in Miami, Florida, USA. You can reach us at [email protected].

For business account data (owners and their businesses), RicardoHQ LLC is the controller. For the data of each business's clients, that business is the controller, and Bookalo processes it on the business's behalf under the “Data processing” section of our Terms.

2. What we collect

If you run a business on Bookalo:

  • your name, email, language, and password (stored only as a hash, never in plain text);
  • if you sign in with Google: your Google account ID and the email Google confirms to us (never your Google password);
  • your business details: name, phone, email, address, description, services, prices, hours, policies, and branding;
  • your plan and subscription status, plus the IDs Stripe gives us (never your card details);
  • a log of key account events, like appointments created, canceled, or paid, and time zone or currency changes;
  • if you arrived from a campaign link, its tags (utm_source and similar), saved once when your account is created. We use no cookies for this.

For your team, we keep what the business enters: display name, a short bio, schedules, and time off.

If you booked with a business: your name, email, phone number if you give it, any notes you write when booking, and your appointment details. The business may also keep payments and receipts, packages, and internal notes about you.

If the business asks for a deposit, full payment, or a card to hold the booking, you enter your card details directly into Stripe. Bookalo only keeps the references Stripe sends back, and shares your name, email, and phone with the business's Stripe account to record the charge.

If you visit Bookalo: we don't use analytics tools. We use your IP address briefly, in memory, to stop abuse (for example, too many sign-ups from one connection), and we don't store it in our database. Cloudflare processes connection data to deliver and protect the site.

3. How we use it

We use data only to run Bookalo: showing booking pages, managing appointments, processing payments, billing subscriptions, providing support, and keeping the service secure. We don't sell data, we don't share it with advertisers, and we don't send ads.

The emails we send are part of the service. Clients who book get:

  • a booking confirmation and updates when it changes, with a link to cancel or reschedule;
  • a reminder before the appointment, with the same link;
  • request received, approved, or declined, when the business approves each booking;
  • a cancellation notice;
  • payment receipts, and a receipt for any no-show fee.

Business owners get: a notice for each new booking or request waiting for approval, password resets, email verification, and notices when their trial is about to end or has ended.

Emails to clients show the business's name as the sender, and replies go to the business's email.

4. Legal bases

In plain terms, we use your data:

  • to provide the service you asked for: your account, your bookings, and the emails for each appointment;
  • for our legitimate interest in keeping Bookalo secure, preventing abuse and fraud, and fixing bugs;
  • when the law requires it, for example keeping billing records.

For a business's client data, the business decides the legal basis, because it is the controller of that data.

5. Cookies

Bookalo only uses cookies the service needs to work:

  • bookalo_session: keeps you signed in to your account. It's httpOnly (scripts on the page can't read it) and lasts up to 30 days or until you sign out.
  • bookalo_lang: remembers the language you picked (Spanish or English). It lasts one year.
  • Stripe cookies: if a business asks for a payment or a card at booking, Stripe's payment form sets its own cookies to prevent fraud.

We don't use analytics or advertising cookies.

6. Subprocessors

These providers process data for us, each only for its own job:

  • Cloudflare: network, DNS, and the secure connection to our servers.
  • Google (RicardoHQ LLC's Google Workspace): stores our off-site backups. They're encrypted before they leave our server, so Google can't read them.
  • Resend: delivering the service's emails.
  • Stripe: billing for Bookalo subscriptions. If a business connects its Stripe account, also deposits, prepayments, no-show fees, and saved cards, which run on the business's own Stripe account. For those charges, the business and Stripe have their own relationship, and Stripe's privacy policy applies.
  • Google Fonts: only on the booking pages of a business that picked a custom font, and in the font picker in a business's settings. Your browser downloads the font from Google, which receives your IP address.

Other data leaves Bookalo only when a business chooses: if it shows a logo hosted elsewhere, your browser loads it from that address, and if it subscribes to its Bookalo calendar from another calendar app, that app receives the service and client name for each appointment.

7. Where data is processed

Bookalo runs on servers we operate in the United States, reached through Cloudflare. If you use Bookalo from another country, your data is transferred to and processed in the United States, where data protection laws may differ from those where you live.

8. How long we keep it

We keep data while the business account is active. The contents of password reset and email verification messages are deleted as soon as they're delivered, and links to manage an appointment are removed from stored emails once they're sent or canceled.

When a business deletes a client's data, their personal details leave the live database right away, including stored copies of the emails about them, and any emails not yet sent are canceled. Appointments and sales stay, without personal details, for the business's reports.

When an account is closed, we delete its data from the live database. In every case, deleted data can remain in our encrypted backups for up to 30 days, then it's gone.

Stripe keeps payment data under its own policy.

9. Security

Traffic is encrypted (HTTPS) through Cloudflare. Passwords are stored with bcrypt, and sessions and the links in account and appointment emails are stored only as hashes, except inside an email still waiting to be sent. Backups are encrypted. Each business can only see its own data, and access to our systems is limited.

10. Your rights

You can ask to see your data, correct it, take a copy, or delete it.

If you run a business on Bookalo, email [email protected] for any of these, including closing your account. We'll respond within 30 days. You can change your password yourself from your account.

If you booked with a business, ask that business first: in Bookalo it can export or delete your data. If you can't reach them, email us and we'll help.

11. Children

Bookalo is for businesses, and accounts are only for people 18 and older. If a business works with minors (tutoring or lessons, for example), the business handles the data for those appointments as the controller.

12. Changes

The date at the top shows the current version of this policy. If we change it in a significant way, we'll tell you by email or inside the product.

13. Contact

RicardoHQ LLC, Miami, Florida, USA. Email us at [email protected].

Terms of service