Privacy policy

BookSam (“BookSam”, “we”) provides the BookSam service at booksam.app. Questions about privacy? Email us at privacy@booksam.app.

• For salon data (your account, settings and wallet) we are the controller.
• For data of clients who book through a salon's booking link, the salon is the controller. We are the processor: we only use that data to provide the service to that salon. The terms for this are in section 9 of our Terms.

From salons:

• business name, WhatsApp number, country, language, time zone, opening hours and other settings;
• your PIN or password, only as a one-way hash (we can't read it ourselves);
• the API key of your own Stripe or Mollie account and any calendar connections, stored encrypted;
• your wallet balance, top-ups and one fee line per paid booking;
• for auto top-up: a reference to your saved payment method and a short description (for example card brand and last 4 digits). We never receive full card or account numbers;
• technical data: your IP address (briefly, to stop abuse and too many login attempts) and server logs.

From clients of salons:

• the name you enter, your phone number (for the WhatsApp confirmation and reminder), the time you chose and your language;
• the status of the booking and whether the deposit was paid.

From people on the waitlist for our other apps (SamCents, SamSitter, SecretSam): your email address or WhatsApp number, which apps you signed up for, your language and when you signed up.

BookSam never processes or stores your card or bank details. The deposit goes straight through the salon's own Stripe or Mollie account.

• Providing your account and the service: booking link, calendar, deposit requests and dashboard (performance of a contract, Art. 6(1)(b) GDPR).
• Processing bookings and sending WhatsApp confirmations and reminders on behalf of the salon (on the salon's instructions).
• The wallet, top-ups and our accounting (contract and legal retention duties, Art. 6(1)(b) and (c) GDPR).
• Security and abuse prevention, such as limiting login attempts (legitimate interest, Art. 6(1)(f) GDPR).
• Resetting your PIN with a code sent on WhatsApp (performance of a contract).
• The waitlist on booksam.app/links: messaging you when an app you signed up for goes live (consent, Art. 6(1)(a) GDPR). To withdraw your consent, email privacy@booksam.app and we'll take you off the list.

We don't sell data, don't build marketing profiles and don't make automated decisions about you.

• Hosting and database (Vercel and Supabase). Where possible we choose storage in the EU.
• Meta (WhatsApp Business Platform), to send confirmations, reminders and reset codes.
• Stripe and Mollie: for deposits through the salon's own account (the salon has its own agreement with them) and for BookSam wallet top-ups through our account.
• Google, only if a salon connects Google Calendar itself.

Some of these parties also process data outside the European Economic Area, for example in the United States. This happens under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

• Client name and phone number: wiped automatically 12 months after the appointment.
• Salon account: for as long as the account exists. After a deletion request we erase it within 30 days, except what we must keep by law.
• Wallet transactions and payments to BookSam: 7 years (tax retention duty).
• PIN reset codes: valid for 10 minutes, then useless.
• Waitlist: until you opt out, and at most 24 months after your last signup (then erased automatically).
• Server logs: at most 30 days.

We only use functional cookies: bk_session (staying logged in, 30 days), lang and cur (your language and currency, 1 year), geo_cc (your country, worked out from your browser's time zone so we show the right currency, 1 year) and loc_pref (remembers that you picked a language or currency yourself, 1 year). No tracking, advertising or analytics cookies, so we don't ask for consent.

All connections are encrypted (HTTPS). PINs are hashed with scrypt; payment and calendar keys are encrypted with AES-256-GCM. Data is strictly separated per salon, and an account locks for a while after repeated wrong login attempts.

You can access, correct or delete your data, restrict its processing, take it with you and object. Email privacy@booksam.app; we reply within one month.

Booked through a salon? Contact that salon first: they decide what happens with your booking, and we help them do it.

If you disagree with how we handle your data, you can complain to your data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

When we change this policy, the date at the top changes. We tell salons about important changes in the dashboard beforehand.