Privacy Policy

1. Who this applies to and who we are

This policy covers everyone whose personal data TrimBooking processes: business owners and staff who use TrimBooking to run their booking page, and customers who book an appointment through one.

TrimBooking is operated by Paul Graham, trading as TrimBooking, a sole trader based in the United Kingdom (“TrimBooking”, “we”, “us”). For data protection purposes, TrimBooking is the controller of the account and billing data described in Section 2, and generally a processor acting on behalf of each business for the booking data of that business's own customers (see Section 3).

2. Data we collect about business owners and staff

When a business signs up and runs its booking page, we collect:

• Account details — name, email address, password (stored hashed, never in plain text), and the business's chosen web address.
• Business details — business name, branding (logo, colour), opening hours, services and prices.
• Staff details — name, role, bio, and (if given a login) email address.
• Billing details — handled by Stripe on our behalf; see Section 4. We store only a Stripe customer/subscription reference, never a card number.
• Payout details — if a staff member connects a Stripe account to receive no-show fee payouts, Stripe collects and verifies their bank/identity details directly; we only store a reference ID confirming the connection.

3. Data we process on a business's behalf about its customers

When a customer books an appointment, we process on behalf of the business they're booking with:

• Name, email address and phone number, as given at the time of booking.
• Appointment details — service, staff member, date/time, and status.
• Anything the customer chooses to add when booking: a note, a “quiet appointment” preference, and an optional photo or document. Attachments are stored privately and can only be opened by the business's owner, its admins and the staff member the booking is with.
• Booking history, used to show the business its customers' visit history and to send rebook reminders.
• If no-show protection is enabled for that business, a reference to a card held securely by Stripe (see Section 4) — never the card number itself.

This data is used only to provide the booking service to that business and its customers, and is visible to that business's own owner and staff. We don't use it for our own marketing, and we don't share one business's customer data with another business.

4. Payment data and Stripe

All card payments are handled directly by Stripe, a PCI DSS Level 1 certified payment processor. Card numbers, expiry dates and security codes are entered directly into Stripe's secure, hosted payment fields and never pass through TrimBooking's own servers or database — we only ever hold a Stripe-issued reference token, which cannot be used to reconstruct a card number.

Where TrimBooking facilitates payouts to a business's staff (for no-show fees) via Stripe Connect, Stripe separately collects and verifies the information needed to run those payouts and comply with its own legal and anti-fraud obligations. See Stripe's own privacy policy for details of what Stripe does with that information.

5. Other services we use

• Supabase — hosts our database and handles account logins, encrypted in transit and at rest.
• Resend — sends transactional emails (booking confirmations, reminders, invoices). We don't send marketing email through this without consent.
• Vercel — hosts the application and runs scheduled jobs (reminders, invoicing).
• Stripe — payment processing and payouts, as described in Section 4.

Each of these providers processes data only as needed to provide their part of the service, under their own data processing terms.

6. How long we keep data

We keep account and booking data for as long as a business's account is active, plus a reasonable period afterwards to deal with any billing, legal or dispute matters. If a business asks us to delete their account, we delete or anonymise the data associated with it, except where we're required to keep billing records for tax purposes (currently up to 6 years under UK law).

7. Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy of it.
• Ask us to correct inaccurate data.
• Ask us to delete your data, where we're not required to keep it.
• Object to or restrict certain processing.
• Ask for your data in a portable format.

If your query is about a specific booking or business, it's usually fastest to contact that business directly, since they control their own customer data day to day. For anything else, email pagraham144@gmail.com. If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

8. Cookies

TrimBooking uses only the cookies strictly necessary to keep you logged in and to remember your session while using the booking page or dashboard. We don't use advertising or cross-site tracking cookies.

9. Changes to this policy

If this policy changes materially, we'll update the date at the top of this page and, for significant changes, notify account owners by email.