Privacy Policy

Last updated: 27 October 2026

This policy explains what BoothBook ("BoothBook", "we", "us") collects when a tattoo studio or their client uses BoothBook, why we collect it, and what you can do about it.

1. Who we are

BoothBook operates BoothBook, a booking and front-desk application for tattoo studios. For any privacy question or request, write to hello@boothbook.app.

2. Two kinds of users, two kinds of data

Studios and their staff create an account and use the application. Their clients use a public booking page, a payment link, an intake form and a consent form. We hold data on behalf of the studio for the second group — the studio decides what is collected and why, and we process it on their instructions.

3. What we collect

• Account data — studio name, your name, email address, a hashed password (we never store the password itself), staff roles and permissions.
• Booking data — services, prices, durations, appointments, artist assignments, notes, design-approval versions, waitlist entries, promo codes, gift cards.
• Client data entered by the studio — client name, email, phone, booking history, tags, notes, and any text the studio chooses to record.
• Consent and intake records — answers to the studio's intake questions, the client's typed legal name, a drawn signature, the signature timestamp and the IP address it was signed from. These exist so the studio can show who agreed to what, and when.
• Payment records — amounts, type (deposit, prepayment, tip), status, and a reference from the payment provider. We do not store card numbers.
• Technical data — server logs (IP address, requested URL, timestamp, user agent) needed to run and secure the service.

4. Why we use it

• To provide the service: show calendars, hold slots, take bookings, send confirmations.
• To keep records the studio is legally exposed without: signed consent, design approvals, payment history.
• To operate the business: billing, support, fraud and abuse prevention, rate limiting.
• To improve the product in aggregate (for example, which screens are slow). We do not build advertising profiles and we do not sell personal data.

5. Legal bases (EEA and UK users)

Where the GDPR applies, we rely on: performance of a contract (running your account), legal obligation (tax and accounting records), legitimate interests (security, abuse prevention, product improvement), and consent where we ask for it explicitly. The studio is the controller for its clients' booking and consent data; we act as processor.

6. Who we share it with

We use a small number of service providers and share only what each one needs:

• Hosting and database — the server that stores your data.
• Email delivery — to send booking confirmations, reminders and receipts.
• Payment processing — for subscription billing. Card data goes to the processor directly; it never touches our servers.
• Authorities — only where we are legally required to respond.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

7. Cookies and local storage

BoothBook sets one session cookie, which keeps you logged in. It is technically necessary and is not used for tracking. Your light/dark theme choice is stored in your browser's local storage and never sent to us. We do not run third-party advertising cookies.

8. How long we keep it

Account and booking data stay while the account is active. After cancellation we keep it for 30 days so it can be exported, then delete it, except where accounting or legal rules require a longer retention (invoices, consent records a studio is required to keep). Server logs are kept for 30 days.

9. Security

Passwords are hashed with scrypt. Traffic is served over HTTPS. Access to production data is restricted to the operator of the service. No system is perfectly secure; if a breach affects your data we will notify affected studios without undue delay.

10. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal data, to object to certain processing, and to withdraw consent. Write to hello@boothbook.app and we will respond within 30 days. If you are a studio client, your first point of contact is the studio — we will support them in answering you.

California residents: you may request disclosure of the categories of personal information we hold, request deletion, and request that we not sell it. We do not sell personal information. We will not discriminate against you for exercising these rights.

11. International transfers

Our servers are located outside your country. Where data moves across borders we rely on standard contractual clauses or an equivalent lawful transfer mechanism.

12. Children

BoothBook is not directed at children. Tattooing is age-restricted in most jurisdictions and studios are responsible for verifying the age of their clients.

13. Changes

If this policy changes materially we will post the new version here and, for account holders, send an email. The date at the top always shows the current version.

14. Contact

Privacy questions, data requests, deletion: hello@boothbook.app.