Privacy Policy
Last updated November 14, 2026
Shop Bookings (“we”, “us”) is a Shopify app for appointment bookings and event tickets, run by [YOUR LEGAL NAME OR COMPANY NAME], [YOUR BUSINESS ADDRESS]. This policy explains what information the app handles, why, and the choices you have. It covers merchants who install the app (“merchants”) and the merchants’ customers who book appointments or buy tickets (“customers”).
Our role
For customer information, the merchant decides how it is used and is the data controller. We process it on the merchant’s behalf, only to run the app for that merchant, as set out in our Terms of Service. For merchant account information, we are the controller.
Information we handle
From merchants
- Store details from Shopify: store domain, store name, contact email, currency, time zone and plan.
- What you set up in the app: services, staff members (names, and emails or phone numbers if you add them), opening hours, events, ticket types, message templates and settings.
- Billing records for your plan and message credits. Payments are handled by Shopify; we never see card details.
- API keys you choose to connect (Klaviyo, Mailchimp). These are stored encrypted.
About customers
- Name, email address and phone number, from the merchant’s Shopify orders, the booking or ticket form, or added by the merchant (manually or by CSV import).
- Bookings and tickets: service or event, date and time, staff member, attendee names, ticket codes, check-in times, payments recorded, notes and answers to the merchant’s booking questions.
- Whether the customer agreed to receive texts (SMS or WhatsApp) and when, and whether they accepted marketing at checkout.
- Messages sent to the customer (email, SMS, WhatsApp) and whether they were delivered.
We don’t collect payment card details, addresses, dates of birth or government ID numbers. The storefront widgets don’t set tracking or advertising cookies.
How we use it
- To show available times, hold seats during checkout, and create bookings and tickets when an order is paid.
- To send the confirmations, PDF tickets, reminders, follow-ups and other messages the merchant has turned on. Texts are only sent to customers who opted in.
- To let customers view, reschedule or cancel their booking, and to check them in.
- To show merchants their calendar, customers, revenue and reports, and to let them export their data.
- To sync customers to Klaviyo or Mailchimp, only when the merchant connects them. Customers who didn’t opt in to marketing are added as non-marketing contacts.
- To bill for the Pro plan and message credits, provide support, keep the service secure and fix problems.
We don’t sell personal information, and we don’t use customer information for our own marketing or to build profiles.
Who we share it with
Only with the service providers needed to run the app, under contracts that require them to protect it:
| Provider | Purpose |
|---|---|
| Shopify | App platform, orders, checkout and billing |
| [HOSTING PROVIDER, e.g. Hostinger] | Hosting the app |
| [DATABASE PROVIDER, e.g. Neon] | Database (encrypted at rest) |
| [EMAIL PROVIDER, e.g. Resend] | Sending emails |
| Twilio | Sending SMS and WhatsApp messages (Pro, only to customers who opted in) |
| Meta (WhatsApp) | Delivering WhatsApp messages |
| Klaviyo, Mailchimp | Only if the merchant connects them |
We may also disclose information if the law requires it, or to protect the rights and safety of our users or the public.
How long we keep it
- While the app is installed, we keep data so the merchant can see their bookings, tickets and history.
- When a merchant uninstalls, Shopify asks us to delete the store’s data 48 hours later, and we delete all of it: settings, services, events, bookings, tickets, customers and messages.
- When a customer asks a merchant to delete their data, Shopify tells us and we erase that customer’s name, email, phone number, notes and answers, and any queued messages to them.
Security
All traffic uses HTTPS. The database is encrypted at rest, third-party API keys are encrypted by the app, and access to production systems is limited to people who need it to run the service. If a breach affects personal information, we will tell affected merchants without undue delay.
Your rights
Customers: to access, correct or delete your information, contact the store you booked with; they control it and can do this in the app, and Shopify passes deletion requests to us. You can stop text messages at any time by replying STOP, and unsubscribe from emails using the store’s contact details.
Merchants: you can export your bookings and attendees as CSV at any time, and ask us to access, correct or delete your account information at privacy@shopbookings.app. Depending on where you live (for example the EU, UK, California or India), you may have further rights under local law, and you can complain to your data protection authority.
International transfers
Our providers may process information in countries other than yours, including the United States. Where the law requires it, we rely on safeguards such as the European Commission’s standard contractual clauses.
Children
The app is for businesses and isn’t directed at children. Merchants are responsible for getting any consent needed when they take bookings for children.
Changes
If we change this policy in a meaningful way, we’ll update the date above and tell merchants in the app or by email.
Contact
[YOUR LEGAL NAME OR COMPANY NAME], [YOUR BUSINESS ADDRESS] · privacy@shopbookings.app