Privacy Policy

1. Introduction

BooknSwap ("we," "our," or "us") provides a platform that lets business owners connect their booking system (e.g. Square Appointments) and allows their clients to view appointments and request to swap times with other clients. This Privacy Policy explains what information we collect, how we use it, and your choices. It applies to our website, web app, and mobile app (together, the "Service"). By using the Service, you agree to this policy.

2. Information We Collect

We collect information you provide and information we need to run the Service.

• Account information: When you sign up (as a business owner or client), we collect email address and name (first and last name where provided). Clients may also add a verified phone number (and optionally one additional phone number). We use this to create and manage your account, authenticate you, and match you to appointments.
• Phone numbers (clients): If you provide a phone number in the app, we store it after SMS verification so we can associate your account with appointments that businesses booked using that number. Phone numbers are stored in our database (not used as your Cognito sign-in username). Sign-in remains email-based.
• Additional emails (clients): If you add extra email addresses to your account (e.g. to see appointments booked under another email), we store those so we can match you to the right appointments.
• Connection and booking data: If you connect Square Appointments, we store connection details (e.g. business name, location) and sync appointment data (times, service names, duration, client email and/or phone when Square provides them) so we can show appointments and facilitate swap requests. We do not store your Square password; we use OAuth and store only what Square provides via their API.
• Swap requests: When a client requests or accepts a swap, we store the request (which appointments, status, expiry) so we can process the swap and notify the other party.
• Payment and subscription: If you subscribe to a paid plan, payment is handled by Stripe. We store subscription status and plan tier (e.g. starter, pro); we do not store your full card number. Stripe's privacy policy applies to payment data they process.
• Communications: We send transactional emails (verification codes, client invitations and reminders, swap notifications, subscription-related messages) and transactional SMS (e.g. phone verification codes; and, when enabled, appointment-related invite messages). If you contact us (e.g. support@booknswap.com or enterprise contact), we keep your message and contact details to respond.
• Push notification identifiers: If you enable push notifications on the mobile app, we (and our push provider) may process a device/push token so we can deliver swap and related alerts.
• Technical and usage data: Our infrastructure (e.g. AWS) may log IP address, device type, and request logs for security and operation. We do not sell this data.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service (e.g. sync appointments, process swap requests).
• Authenticate you and send email or SMS verification and sign-in codes.
• Match clients to appointments using email and/or phone numbers provided by you or synced from a connected booking system.
• Send transactional notifications (e.g. invitations to join BooknSwap, reminders, swap request received, swap accepted or denied) by email, SMS (when enabled), and/or push notification.
• Manage your subscription and billing via Stripe.
• Respond to your requests and support inquiries.
• Comply with law, protect our rights, and ensure security and fraud prevention.

We send transactional messages related to the Service. We do not sell your personal information or use your phone number for third-party advertising. If we ever send marketing messages, we will obtain any consent required by law and provide an opt-out.

4. Sharing and Third Parties

We do not sell your personal information. We share data only as needed to run the Service:

• AWS (Amazon Web Services): Our apps and backend run on AWS (e.g. Cognito for authentication, DynamoDB for data, Lambda, SES for email, Secrets Manager). Data is stored in regions we configure (e.g. us-east-1). AWS acts as a processor under their shared responsibility model.
• Twilio: We use Twilio (including Twilio Verify and, when enabled, Twilio Messaging) to send SMS verification codes and other transactional SMS related to the Service. Phone numbers and message content needed to deliver those SMS are processed by Twilio under their privacy policy.
• OneSignal: If you enable push notifications, we use OneSignal to deliver them. Device and push identifiers needed for delivery are processed by OneSignal under their privacy policy.
• Square: If you connect Square, we send and receive data via Square's APIs (e.g. appointments, booking updates for swaps). Square's privacy policy applies to how they handle that data.
• Stripe: Payment and subscription data are processed by Stripe. We send them identifiers and plan info; they handle card details. Stripe's privacy policy applies.
• Swap and invite notifications: To facilitate the Service, we may send emails or SMS to the relevant users (e.g. a client invited to join, the person who receives a swap request, or the requester when a request is accepted or denied). Content includes appointment and business context needed for that message.
• Legal and safety: We may disclose information if required by law, to protect rights or safety, or in connection with a merger or sale of assets (with notice where required).

5. Data Retention and Security

We retain your account and service data for as long as your account is active and as needed to provide the Service and comply with legal obligations. Verification codes and temporary tokens are short-lived. We use industry-standard measures (e.g. encryption in transit and at rest, access controls, secure auth) to protect your data. No system is 100% secure; we will notify you of a breach where required by law.

7. Cookies and Similar Technologies

Our web app uses essential cookies and local storage (e.g. for authentication and preferences) so the Service can function. We do not use third-party advertising cookies. You can control cookies through your browser settings; disabling them may limit some features.

8. Children

The Service is not intended for users under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us and we will delete it.

9. International Transfers

Your data may be processed in the United States or other countries where our service providers operate (including SMS and push providers). By using the Service, you consent to such transfer. We rely on appropriate safeguards (e.g. standard contractual clauses or adequacy decisions) where required by law.

10. Changes

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. For material changes, we may notify you by email or through the Service. Your continued use after the effective date constitutes acceptance of the updated policy.