We collect several types of information to provide and improve our Services:

Account Information. When you register, we collect your name, email address, business name, and password. If you subscribe to a paid plan, we collect billing information including payment card details (processed securely by our payment processor — we do not store full card numbers).

Business Data. You provide information about your services, staff, availability schedules, client details, and appointment history. This includes personal data about your clients that you choose to store in our system.

Usage Data. We automatically collect information about how you interact with our Services, including IP address, browser type, device information, pages visited, time spent, and referral sources.

Cookies and Tracking. We use cookies and similar technologies to maintain your session, remember preferences, analyze usage patterns, and improve our Services. You can control cookies through your browser settings.

Communications. When you contact us, we collect the content of your messages and any attachments.

We use the information we collect for the following purposes:

• To provide, maintain, and improve our Services
• To process transactions and send related information
• To send confirmations, reminders, and notifications to you and your clients
• To respond to your inquiries and provide customer support
• To monitor and analyze usage trends and preferences
• To detect, prevent, and address fraud, security breaches, or technical issues
• To comply with legal obligations and enforce our Terms of Use
• To send you service-related announcements and marketing communications (with your consent, where required)

For users in the European Economic Area (EEA), our legal basis for collecting and using personal information depends on the specific context:

• Performance of a contract — processing necessary to fulfill our contractual obligations to you
• Legitimate interests — processing necessary for our legitimate business interests, such as fraud prevention and service improvement
• Consent — where you have given explicit consent (e.g., marketing emails)
• Legal obligation — where we are required by law to process your data

We do not sell, trade, or rent your personal information to third parties for marketing purposes. We may share information in the following circumstances:

Service Providers. We engage trusted third-party vendors to perform functions on our behalf, such as payment processing (Stripe), email delivery (Resend), cloud hosting (Supabase), and analytics. These providers have access to personal information only as necessary to perform their services and are contractually obligated to protect it.

Business Transfers. If APPTBuddies is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

Legal Requirements. We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of APPTBuddies, our users, or the public.

With Your Consent. We may share your information with third parties when you explicitly authorize us to do so.

We implement industry-standard security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.3
• Encryption of data at rest using AES-256
• Secure password hashing using bcrypt
• Regular security audits and vulnerability assessments
• Role-based access controls and least-privilege principles
• Automated backups with encrypted storage

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account information is retained for the duration of your active account plus 30 days after cancellation, after which it is securely deleted. Business data (appointments, client records) may be retained longer if required for legal, tax, or regulatory compliance purposes.

Usage data and logs are typically retained for 12 months, after which they are anonymized or deleted.

Depending on your location, you may have the following rights regarding your personal information:

• Access. Request a copy of the personal information we hold about you.
• Correction. Request that we correct inaccurate or incomplete information.
• Deletion. Request that we delete your personal information, subject to legal retention requirements.
• Portability. Request a copy of your data in a structured, machine-readable format.
• Restriction. Request that we limit the processing of your data in certain circumstances.
• Objection. Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent.Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you are a California resident, you have specific rights under the CCPA and CPRA:

• Right to Know. You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete. You may request deletion of your personal information, with certain exceptions.
• Right to Opt-Out. We do not sell personal information. If this changes, we will provide an opt-out mechanism.
• Right to Non-Discrimination. We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, email us at [email protected] with "CCPA Request" in the subject line.

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your jurisdiction.

When we transfer personal data from the EEA, UK, or Switzerland to countries that have not been deemed adequate by the European Commission, we use Standard Contractual Clauses (SCCs) and other lawful transfer mechanisms to ensure appropriate safeguards are in place.

Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child under 16 without parental consent, we will take steps to delete that information.

Our Services may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party sites or services you interact with.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on our website at least 30 days before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the revised policy.

We encourage you to review this policy periodically for the latest information on our privacy practices.

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at:

APPTBuddies
Email: [email protected]