Privacy Policy

BookFlow is operated by One Search Banter Ltd ("we", "us"), Great Britain. This policy explains how personal data is handled on the BookFlow platform. Contact for anything below: kevin@bookflow.works.

Data about the businesses that use BookFlow

When a business signs up we collect what an account needs: names and email addresses of the account's users, the business's details, and billing information. We also keep routine technical logs (sign-ins, actions in the dashboard) to run and secure the service. We use this data to provide the platform, send service email, and give support — nothing else. We do not sell it or use it for advertising.

Data about a business's customers

Bookings, client records and messages that a business manages in BookFlow belong to that business: the business is the data controller, and we process the data only on its instructions to provide the service. If you are a customer of a business that uses BookFlow, that business's own privacy policy (on its own website) is the one that applies to you — and requests about your data are best made to the business, though we will help route anything sent to us.

Data from connected social accounts (Meta, TikTok)

When a business connects its own Facebook Page, Instagram professional account or TikTok account, we receive and store only: the account's public identity (name or @handle, ID, profile picture), and the access token — and, for TikTok, the refresh token — that lets us publish the business's own posts to it. Tokens are encrypted at rest. We receive no data about the business's followers or customers from Meta or TikTok, read nobody's messages or comments (beyond posting the business's own optional first comment), and use this data solely to provide publishing. Disconnecting an account deletes its tokens immediately — full detail on our data deletion page.

Where data lives, and who helps us run the service

The platform runs on dedicated servers in Germany (EU), with encrypted backups. Traffic is TLS-encrypted. Our sub-processors — providers acting on our instructions — are: Hetzner (hosting, Germany), Cloudflare (DNS and media storage), Resend (transactional email) and Stripe (payments). We share personal data with no one else, except where the law compels it — and such requests are reviewed for legality, challenged where unlawful, answered minimally and documented.

Retention

Account data is kept while the account exists, then deleted or anonymised except where law requires retention (for example, financial records). Social access tokens exist only while an account is connected. Businesses can request export or deletion of their data at any time.

Your rights

Under UK and EU data protection law you can ask for access to, correction of, deletion of, or a copy of personal data we hold about you, and object to or restrict processing. Email kevin@bookflow.works and we will respond promptly. You also have the right to complain to the ICO (ico.org.uk).

Cookies

The platform uses essential cookies only — see the cookie policy.

Changes

If this policy changes materially we will notify account owners. The date above is the date of the current version.