Privacy Policy

Who we are

Hourbook is provided by [Hourbook — trading name of [legal entity name], company number [00000000]], of [registered/contact address] (“Hourbook”, “we”, “us”). We are registered with the UK Information Commissioner’s Office, registration reference [ICO registration reference, once registered at ico.org.uk].

This policy covers two different relationships, because they work differently under data protection law:

• Businesses and their staff who sign up to Hourbook to run their diary. For this data, Hourbook decides how the platform itself works, so we are the data controller.
• A business’s own customers — the people who book appointments. That data belongs to the business’s relationship with their customer, not to us. We only process it on the business’s instructions, so we are a data processor acting for them, and they remain the controller. If you booked an appointment through a business’s Hourbook page, that business is who to contact about your data first; we process it on their behalf under the terms in our Terms of Service.

What we collect, and why

If you run a business on Hourbook, or work for one

Account and login data: your name, email address, and a securely hashed password (we never store your password itself). We use this to run your account, let you sign in, and know who did what.

Business details: your business name, address, phone number and opening hours — used to run your booking page and diary, and shown publicly on it where you’ve chosen to add it.

Usage and activity data: a log of significant actions taken in your account (bookings made, settings changed, who signed in and when) — used for your own audit trail, and to help us support you if something goes wrong.

Sign-in and security records: whenever someone tries to sign in, sign up or change a password, we record the email address typed, the IP address, the type of browser, and whether it worked. We use this to spot and stop people trying to break into accounts. Only Hourbook can see these records, and they are deleted after 90 days.

Lawful basis: performance of our contract with you (our Terms of Service), and our legitimate interest in keeping the service secure and working properly.

A business’s customers (booking an appointment)

Name, email and phone number, so the business can confirm, remind and reach you about your appointment.

Appointment history: what you booked, when, with whom, and its status (kept, cancelled, completed, no-show).

Notes the business adds about you — for example a preference, or something they need to remember. We do not add or read these ourselves; they are entered and controlled entirely by the business.

If the business takes payment online: the amount, date and status of each payment or refund, a reference from Stripe, and which version of the business’s cancellation policy you agreed to, and when. You type your card details on Stripe’s own payment page; Hourbook never sees or stores them. If you start to pay but don’t finish, your name, email and phone number are held for the half hour your time is reserved, then deleted within two weeks.

Lawful basis: this is the responsibility of the business you booked with, not ours — they must have their own lawful basis (typically performance of their contract with you) for collecting it. We process it strictly on their instructions.

A note on sensitive information: please don’t ask a business to record health or medical details (allergies, conditions, medication) in a general notes field unless you’ve clearly agreed to that with them directly — this kind of “special category” data has extra legal protections that a plain notes field isn’t designed to handle.

If you enquire about Hourbook, or contact us

Your name, business details, email, phone number and whatever you tell us in your message — used only to respond to you and, if you become a customer, to set up your account. If you don’t become a customer, we delete your enquiry after a year.

Lawful basis: our legitimate interest in responding to people who contact us, and steps taken at your request before entering a contract.

Cookies

We use one cookie: to remember whether you prefer light or dark mode. It does not identify you, track you, or get shared with anyone. We don’t currently use any analytics or advertising cookies. If that changes, we’ll update this policy and ask for your consent first, where the law requires it.

Who we share data with

We don’t sell personal data, to anyone, ever. We use a small number of specialist providers to run Hourbook, each of whom only processes data on our instructions and under their own data protection agreement with us:

• Vercel — hosts the application itself.
• Prisma Postgres — hosts our database.
• Resend — sends transactional emails (booking confirmations, appointment reminders, alerts to business owners about bookings, invitation and password-reset links) on our behalf.

When a business takes payment online, the payment itself is handled by Stripe. Your card details go straight to Stripe’s payment page and are processed under Stripe’s own privacy policy, with Stripe acting for the business you are paying and, for fraud prevention and legal compliance, in its own right. The money goes to the business’s own Stripe account; Hourbook does not receive it.

When you choose a password, we also check it against the Pwned Passwords service from Have I Been Pwned, so we can refuse one that has already appeared in a data breach. Only the first five characters of a one-way scramble (a hash) of the password are sent. The password itself, and anything that identifies you, never leaves our servers, and the service cannot tell whose password it is.

We may also disclose data where the law requires it (for example, to a regulator or law enforcement with a valid legal basis), or as part of a genuine business transfer, in which case we’d tell you.

Where data is stored

Our providers may process data outside the UK. Where that happens, we rely on Standard Contractual Clauses or another lawful transfer mechanism recognised under UK GDPR to make sure your data stays properly protected wherever it’s processed.

How long we keep it

We keep account and appointment data for as long as your account is active, plus a period afterwards where we’re legally required to (for example, financial records for tax purposes are generally kept for six years). If a business deletes a customer record, we remove the personally identifying details but may keep an anonymised transaction record where we have a legal obligation to. Invitation and password-reset links expire and are deleted automatically after seven days regardless of whether they were used. Sign-in and security records are deleted after 90 days, and the short-lived counters we use to limit repeated attempts (which can hold an email address or IP address) are cleared automatically within hours of expiring.

How we protect it

We use industry-standard measures appropriate to the data we hold: encrypted connections (HTTPS) everywhere, passwords stored using one-way hashing (never in plain text) rather than being stored as usable text, and access to a business’s data restricted to that business’s own signed-in staff. Access within our own team is limited to what’s needed to run and support the service. Every login can also turn on two-step sign-in, which asks for a code from an authenticator app as well as the password; the secret behind those codes is stored encrypted.

Your rights

Under UK GDPR, you can ask us (or, for a business’s customer data, the business you dealt with) to:

• tell you what personal data is held about you, and give you a copy (right of access);
• correct data that’s wrong or incomplete (rectification);
• delete your data, where the law allows (erasure);
• restrict or object to certain processing;
• receive your data in a portable format, where technically feasible (portability).

To exercise any of these for your own Hourbook account, email privacy@hourbook.co.uk. We’ll respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk) at any time.

If you are a business’s customer, ask the business: it has tools in Hourbook to download everything it holds about you, and to erase your personal details (your name, contact details and notes are removed, and your name is taken out of its activity log). Your past appointments may remain as anonymous records, because they are part of the business’s accounts.

Children

Hourbook is a business tool. It isn’t directed at, and we don’t knowingly collect data from, children.

Changes to this policy

We’ll update this page if how we handle data changes, and update the date at the top. For significant changes, we’ll tell business owners directly.

Contact us

Questions about this policy, or about your data: privacy@hourbook.co.uk.