Privacy Policy

1. Who we are

Bookywooky is a diary and booking app for self-employed beauty, wellbeing and other appointment-based professionals and their clients. It is currently in beta. Bookywooky is operated by Adam Bujega and Suzanne Bujega, trading as Bookywooky. It is not a limited company.

Adam and Suzanne decide together how personal information is used in Bookywooky, so they are joint controllers of it (except where section 3 explains that a professional is the controller). They have agreed between them that:

• support@bookywooky.co.uk is the single contact point for every privacy question and request, and is monitored by both of them;
• either of them will answer your request, and they share responsibility for this policy, for keeping your information secure and for the providers listed in section 8;
• you can still exercise your rights against either of them individually.

2. Who this policy is about

• Professionals and clients who have a Bookywooky account.
• People a professional records in Bookywooky who may never use it themselves: their clients and members of a client’s household, which can include children.
• People who use this website or join our early-access list.

3. Our role, and the professional’s role

For your own Bookywooky account we decide how your information is used, so we are the controller. When a professional keeps business records about their clients in Bookywooky (client details, notes, household members, appointments and before/after photos), the professional decides what to record and why, and we process those records on their behalf. If you are their client, the professional is responsible for answering your requests about those records; you can also contact us and we will help.

4. What we collect

If you are a professional

• Account: name, email address, password (stored only as a secure hash), and your analytics choice.
• Profile: profile and cover photos, business name, bio, category, the areas you cover and your business address (turned into map coordinates).
• Diary: working hours, blocked time, private diary notes, handwriting you add to the diary, and your appointments.
• Subscription: your plan, trial dates and subscription status. Subscriptions are bought through Google Play or the App Store; Google or Apple takes the payment and we never see your card details.
• Devices: push-notification tokens, device type and an app installation identifier, and your notification settings.
• Support and diagnostics: bug reports you choose to send (your description, an optional screenshot, and app and device details) and technical error reports.

If you are a client with an account

• Name, email address, password (as a hash), profile photo, phone number and home address (turned into map coordinates).
• Household members you add, booking requests, reviews (rating, comment and whether the comment may be shared) and inspiration you save.

If a professional records you

• Contact details: name, phone, email and home address.
• The professional’s notes about you and your appointments, and addresses they save for you.
• Household members: names, relationship and, in some cases, date of birth or age.
• Appointment history: dates, services and prices.
• Before and after photos of your treatment, and whether you agreed to their use in the professional’s portfolio or on social media. The professional records that permission; Bookywooky does not contact you about it.

Sensitive information

Notes and photos can reveal health information, such as allergies or skin and scalp conditions, sometimes about children. Bookywooky does not ask for health information, and professionals should record only what they need to provide a safe treatment.

Usage analytics

Product analytics are off until you switch on “Share usage analytics” in the app, and nothing about how you use the app is recorded until you do. The current version of the app does still contact our analytics provider when it starts and when you sign in or out, sending a random identifier and basic app and device details (app version, operating system, device type) but no usage information; a future app update removes this. If you switch analytics on, we record which features you use, with your Bookywooky account number, role and basic device and app details, but never names, contact details, notes, photos, payments or AI conversations. You can switch it off again at any time.

Photo metadata and location

Since 16 October 2026, every photo is re-saved by our servers before it is stored, which removes embedded camera information, including GPS location. Some photos uploaded before then may still contain it; we are checking those. Bookywooky does not access your device’s location; places come only from addresses that are typed in.

5. How we use it, and our lawful basis

6. Photos

• Profile, cover and service photos, and a client’s profile photo, are stored in a public storage area: anyone with the link can see them, and they are shown in the app.
• Before and after photos are stored privately and shown only to the professional who took them, through links that expire after one hour.
• If a professional publishes a portfolio photo, it is shown to that professional’s connected clients in the app. Professionals can also share a copy outside Bookywooky; once shared, it cannot be recalled.

7. AI features

If you choose to use Ask Bookywooky, voice commands, handwriting recognition or paper-diary import, what you type or say, or the image you take, is sent to OpenAI to be understood. This can include clients’ names. Bookywooky does not keep the audio or the images; handwriting you add to the diary is kept as part of your diary.

8. Who we share personal information with

We do not sell personal information. These service providers process it on our instructions:

Our database and stored files are held by Supabase in Ireland, and analytics by PostHog in the EU. OpenAI, Expo, Google and Apple process the information they receive in the USA, and other providers may also process information outside the UK. Where information leaves the UK, we rely on the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum in each provider’s data processing terms. We may also disclose information if the law requires it.

9. How long we keep it

• While you have an account, we keep your information so the service works.
• When you delete your account, your personal details, photos, devices, reminders and other personal records are deleted straight away. What is kept, and why, is listed on our Delete your account page.
• Appointment records kept after an account is deleted: kept only while they are needed for the other person's appointment history and for legitimate record-keeping, such as a professional's business records. We have not yet set a fixed maximum period; when we do, we will publish it here.
• Records of photo permissions a professional recorded, kept after either account is deleted without names or contact details: up to six years after the last change to that record.
• Bug-report screenshots: 30 days after the report is closed, and never more than 90 days.
• Email delivery records (no email addresses): 400 days. AI usage statistics (no personal information): 90 days.
• Password-reset links expire after 60 minutes.
• On your phone, the offline copy of your diary covers 7 days back and 60 days ahead and is cleared when you sign out.
• Backups: used only to restore the service if data is lost, never for anything else. Old backups are not yet deleted on a fixed schedule; we are setting a retention period and will publish it here.
• Error-monitoring and app analytics data are kept for the provider’s standard period.
• Website statistics: Google Analytics keeps the information linked to your visits for 14 months and then deletes it. Reports that show only totals, with nothing about any individual visitor, may be kept longer.
• Cookies on your device last for a set time, separately from the above: the Google Analytics cookies up to 2 years (until you withdraw consent or clear them), and the cookie that remembers your cookie choice 12 months, after which we ask again.
• Records of your cookie choices kept by our consent provider, Cookiebot (a random identifier, the date and time, your choices, the page, your browser type and a shortened IP address): 12 months.

10. Your rights

You can ask for a copy of your information, or ask us to correct or delete it, restrict or object to how we use it, or transfer it. You can withdraw consent at any time, for example by switching analytics off in the app, or with “Cookie settings” at the bottom of every page of this website. Email support@bookywooky.co.uk; we reply within one month. If a professional holds your information as their client record, we will pass your request to them and help them respond. You can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113), but please contact us first.

11. This website

If you join our early-access list we collect your first name, email address and the professional categories you choose, and use them only to tell you about Bookywooky. If you reach us through one of our tagged links (for example in a social media post), we also record the campaign details in that link (its source, medium, campaign and post) with your sign-up, so we can see which posts bring people to the beta. We read these from the link itself; nothing is stored on your device.

When you first visit, we ask which cookies you allow. Necessary cookies only remember your choice, and our consent provider Cookiebot keeps a record of it, including a refusal. If you accept statistics cookies, Google Analytics records which pages you view, which of our sign-up and plan buttons you click, and whether you join the early-access list, together with your browser, device type and approximate location (town or region) that Google works out from your connection. It does not receive your name or email address. Nothing is recorded until you accept, and nothing more is recorded after you withdraw.

This website does not use advertising or marketing cookies. You can change your choice at any time with “Cookie settings” at the bottom of every page. Our Cookies page lists each cookie and how long it lasts.

12. Children

Bookywooky accounts are for adults. Adults and professionals can record information about children in a household (for example, to book a child’s appointment) and should record only what is needed.

13. Security

Information is encrypted in transit, passwords are stored as one-way hashes, private photos are shown only through short-lived links, and administrator access requires Google sign-in, is limited by role and is audit-logged.

14. Changes

We will update this policy when Bookywooky changes and tell you about important changes in the app or by email.