Privacy Policy
Last updated:
Draft — to be reviewed by a lawyer before launch. This policy is not in force yet.
This policy explains what we do with personal data when you use WhenBy: the app, the web app, our website and the booking pages of the businesses that use us. It applies to clients who book, to business owners and staff, and to visitors of our website. It follows the EU General Data Protection Regulation (GDPR) and the UK GDPR.
1. Who we are
The controller is [COMPANY NAME], [REGISTERED ADDRESS], company number [COMPANY NUMBER] ("WhenBy", "we", "us"). For anything about your data, write to [CONTACT EMAIL]. We have not appointed a data protection officer, because the law doesn't require one for us; the same address reaches the person responsible for privacy. Our UK representative is [UK REPRESENTATIVE].
2. Two roles: ours and the business's
- We are the controller for your WhenBy account, your own bookings and settings, the accounts of business owners and staff, billing, our website, and analytics.
- Each business is the controller of its own client records: the notes, allergies, photos and visit history it keeps about its clients, and any contact list it imports. We store and process them only on the business's instructions, as its processor, under our Data Processing Addendum. For that data, the business's own privacy notice applies, and requests should go to the business (we help it answer them).
- When you book, the business receives your name, contact details and booking, and keeps them in its records under its own responsibility.
3. What we collect
If you book (clients and guests)
- Account: email address, name, phone number (optional), language, and the date you signed up. We never use passwords: you sign in with a code sent to your email.
- Bookings: the business, location, services, staff member, time, price, status, your note to the business, and whether you cancelled.
- For home visits: the address you give and its point on the map.
- Favourite businesses, and your reminder and notification settings.
- As a guest: name, email, phone number (optional) and language, with the booking.
If you run a business or work for one
- Owner and staff accounts: email, name shown to clients, role, profile photo (optional), the calendar colour you pick.
- The business: name, description, category, logo and photos, locations and their addresses, services, prices, tax rates, working hours, time off, booking rules, links to WhatsApp or Instagram.
- Billing: legal name, billing address, VAT number, tax code (codice fiscale), SDI code, PEC address, billing email, your Plan and its history. Card details are taken by Stripe and never reach us.
About the business's clients (as a processor)
- Client records: name, email, phone, notes, allergies, tags, no-shows, marketing consent, before-and-after photos, and what was paid at the visit.
From your device and browser
- Push notification tokens, if you allow notifications.
- Technical data our providers log for security: IP address, browser or device type, time of the request. We don't use them to identify you.
- Analytics, only if you agree (section 5).
We don't collect payment card numbers, we don't use advertising identifiers, and we don't sell or rent your data.
4. Why we use it, and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create your account and sign you in | Account data | Contract (GDPR Art. 6(1)(b)) |
| Make, change and cancel bookings; pass them to the business | Account, bookings, address for home visits | Contract |
| Send confirmations, reminders and changes by email and push | Email, push token, booking | Contract |
| Run the business's calendar, page and client records | Business data, client records | Contract with the business; for client records, the business's own basis |
| Bill Plans and keep invoices | Billing data | Contract; legal obligation (Art. 6(1)(c)) for tax records |
| Keep WhenBy secure, stop fraud and abuse, fix errors | Technical data, bookings | Legitimate interests (Art. 6(1)(f)) |
| Understand how WhenBy is used, to improve it | Analytics data | Consent (Art. 6(1)(a)) |
| Answer your messages and requests | What you send us | Contract or legitimate interests |
| Meet legal duties and defend legal claims | Any relevant data | Legal obligation; legitimate interests |
Health information. Some businesses note allergies or skin conditions in their client records. That is health data. The business is responsible for asking your explicit consent; we keep it inside that business's records only, and never use it for analytics or put it in notifications.
5. Analytics, only with your consent
We use Google Analytics 4 on our website, booking pages and web app, and Google Analytics for Firebase in the iPhone and Android apps, to count visits and see which features are used. Both are made by Google Ireland Limited.
- They are off until you say yes: on the web through our cookie banner, in the apps through the privacy choice. Saying no changes nothing else.
- When they are on, Google receives your IP address (which Google Analytics does not store), device and browser details, the pages and screens you view, and a random identifier. We don't send your name, email, phone, client records or booking notes.
- We switch off Google signals, ad personalisation and advertising features, and we keep analytics data for 14 months.
- You can change your mind at any time: Cookie settings at the bottom of every web page, or the privacy settings in the app. Details are in our Cookie Policy.
6. Who we share data with
- The business you book with receives your booking and contact details, and keeps them in its records.
- Service providers who process data for us, under contract and only on our instructions: hosting and database, email, push notifications, maps and travel times, payments, analytics. They are listed, with what they do and where, on our sub-processors page.
- Stripe processes payments for Plans and, where a business asks for it, prepayments and deposits. For some purposes, such as fraud prevention and legal duties, Stripe is a controller in its own right (Stripe privacy policy).
- Authorities, when the law requires it.
- A buyer, if our company is sold or merged; this policy keeps applying to your data.
7. International transfers
Our database and files are stored in the EU (Ireland). Some providers are based in, or have staff or systems in, the United States or elsewhere. When data leaves the EU or the UK, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, for certified companies), or on the European Commission's Standard Contractual Clauses with the UK Addendum, plus extra safeguards where needed. You can ask us for a copy.
8. How long we keep data
| Data | How long |
|---|---|
| Your client account | Until you delete it. Then we delete it at once, and your name and contact details are removed from the bookings we keep. |
| Bookings | Kept for the business's records while the business uses WhenBy; anonymised on your side when you delete your account. |
| Home visit address | Deleted 30 days after the visit. |
| Guest booking contact details | Anonymised 24 months after the last booking. |
| Notification log (what we sent, when) | 90 days. |
| Push token | Until you sign out, turn off notifications, or the token stops working. |
| Business data and client records | Until the business deletes its account, then a 30-day grace period. |
| Invoices and billing records | As long as tax law requires (up to 10 years). |
| Analytics data | 14 months. |
| Security logs at our providers | A few days to a few weeks. |
| Backups | Up to 30 days. |
9. Security
Data is encrypted in transit and at rest. Each business's data is kept apart from every other business's by rules in the database, client photos are stored privately and shown only through short-lived links, and access is limited to people who need it. No system is perfectly secure: if a breach puts your data at risk, we tell you and the authority as the law requires.
10. Your rights
You can ask us to:
- give you a copy of your data, or send it to another service (in the app: Account → Download my data);
- correct it (most of it you can change yourself in the app);
- delete it (in the app: Account → Delete account);
- restrict or object to how we use it, including anything based on legitimate interests;
- withdraw your consent at any time, for example to analytics, without affecting what we did before.
Write to [CONTACT EMAIL]. We answer within one month. We may ask you to confirm who you are. If you are a business owner or staff member, you can't delete your own account while you own or work for a business: write to us and we will help.
For a business's client records, ask the business directly. If you ask us, we pass your request to the business and help it answer.
11. Complaints
If you are unhappy with how we handle your data, tell us first. You can also complain to a supervisory authority, in particular where you live or work:
- Ireland: Data Protection Commission
- Italy: Garante per la protezione dei dati personali
- United Kingdom: Information Commissioner's Office
12. Children
WhenBy accounts are for people aged 16 and over. A parent or guardian can book for a child. If you think a child under 16 has an account, tell us and we will delete it.
13. Changes to this policy
When we change this policy, we update the date at the top. If a change matters, we tell you by email or in the app before it applies.