Privacy Policy

Who we are

Bookwan is operated by ByOkwani Beauty LTD (company registration number 17282665), registered at 32 Dakeyne Street, Nottingham, United Kingdom, trading as Beautified by Okwani. Bookwan is a trading name of ByOkwani Beauty LTD.

For any privacy questions, email us at hello@bookwan.me.

Our role: controller and processor

Bookwan plays two different roles under UK GDPR and the EU GDPR, and it matters which one applies to you:

• We are the data controller for the personal data of beauty professionals who sign up for Bookwan - account details, business profile, subscription and billing data, support conversations and usage data.
• We are a data processor for the client data a professional collects through their booking website - client names, contact details, appointment history, booking form answers and notes. The professional is the controller of that data and decides how it is used; we process it on their instructions in order to provide the platform.

If you booked an appointment with a professional and want your data changed or removed, contact that professional first. Professionals who need a data processing agreement covering their use of Bookwan can request one at hello@bookwan.me.

We never sell your personal data. We do not rent, sell or otherwise share personal data with third parties for their own marketing, and we do not use client data to advertise to them.

What information we collect

We collect only the information needed to run the booking platform. This falls into three groups:

• Professional account information - name, email address, phone number, password (stored as a secure hash by our authentication provider), business name, address, category, logo, photos, videos, service descriptions, prices, availability, policies and any other content you choose to publish on your booking website.
• Client booking information - name, email, phone number and any answers submitted through the booking form or custom questions you configure. We also store the appointment details, payment status, deposits, balances and any notes you add as the professional.
• Technical information - browser type, IP address, device information and cookies or local-storage values needed to keep you signed in, remember your theme preference and preserve incomplete onboarding drafts.

How we use your information

We use the information we collect to:

• Create and manage your account and booking website.
• Display your services, availability and policies to clients.
• Process appointments, deposits, balance payments, refunds and payouts.
• Send booking confirmations, reminders, review invitations and plan billing emails.
• Keep your dashboard, calendar and customer records accurate and up to date.
• Prevent fraud, abuse and technical errors.
• Comply with legal and tax obligations.

We do not sell personal information to anyone, and we do not use client booking data to advertise unrelated products.

Legal basis for processing

We process personal data because it is necessary to perform our contract with you (running your account and bookings), because you have consented (for example when connecting optional integrations), or because we have a legitimate interest in keeping the platform secure and reliable. Some processing is also required by law, such as retaining transaction records for tax purposes.

Payments

Card payments are processed by Stripe. Bookwan never stores full card details on our servers. We keep the transaction amount, currency, status, Stripe reference, last-four digits of the card (where provided), refund history and payout records so you can reconcile your dashboard.

Each beauty professional receives a Stripe Connect Express account. Money from client bookings is charged through that connected account and payouts are sent to the professional’s own bank account by Stripe.

Third-party services we use

We rely on a small number of trusted providers. Each provider only receives the data needed for their specific function:

• Supabase - hosts our database, authentication and file storage.
• Stripe - handles card payments, connected accounts, payouts and subscription billing.
• Google - used for optional sign-in and optional Google Calendar two-way sync. You control whether each connection is enabled.
• Email service - sends transactional emails such as booking confirmations, reminders and review invites from a Bookwan sending domain.

Optional integrations

Google Calendar sync: If you connect Google Calendar, we read your busy events and create or update Bookwan appointments in your Google Calendar. Your Google access tokens are encrypted at rest and never exposed to the browser.

Google API Services Limited Use disclosure: Bookwan's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is used only to provide the scheduling features you switch on inside your own account. We do not transfer it to others except as needed to provide those features, comply with the law, or as part of a merger with your notice; we do not use it for advertising; we do not sell it; and no human reads it except with your explicit permission for support, for security, or where the law requires it. When you disconnect a calendar, or delete your account, the stored Google tokens and mirrored events are deleted.

Cookies and local storage

We use essential cookies and browser storage to keep you signed in, remember your sidebar and theme preferences, and save incomplete onboarding drafts. These are functional rather than marketing cookies and are needed for the app to work correctly.

International transfers

We are based in the United Kingdom, but some of our providers (including hosting, payments, email delivery and Google integrations) process data in the European Economic Area and the United States. Where data leaves the UK or EEA, transfers rely on an approved adequacy decision or on Standard Contractual Clauses together with the UK International Data Transfer Addendum, plus additional safeguards such as encryption in transit and at rest.

Marketing communications

We send operational emails that are needed to run your account - booking confirmations, reminders, review requests, payment receipts, security and billing notices. These are not marketing and cannot be switched off while your account is active.

We only send product or marketing emails where you have opted in or where we are permitted to do so as an existing customer. Every marketing email includes an unsubscribe link, and unsubscribing does not affect the operational emails above. Professionals who email their own clients through Bookwan are responsible for having a lawful basis to do so.

How long we keep your data

We keep your account and business data for as long as you have a Bookwan account. If you delete your account, we remove your business profile, services, website content, customers and bookings from active systems.

Some records, such as payment transactions, invoices and audit logs, may be retained for legal, tax or regulatory purposes even after account deletion. These are kept securely and are not used for marketing.

Security

We protect your data using industry-standard measures: encrypted connections (HTTPS/TLS), row-level security on our database, encrypted OAuth tokens for calendar and Google Business Profile integrations, and hashed passwords handled by our authentication provider. Access to server-side functions is verified on every request.

No system is completely risk-free. If we become aware of a security incident that affects your personal data, we will notify affected users as required by law.

Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated data.
• Withdraw consent for optional integrations.
• Object to or restrict certain processing.
• Ask us to transfer your data to another provider (data portability).
• Complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk); we ask that you contact us first so we can try to put things right.

Professionals can update most information directly in Settings. To delete your account, use the account deletion option in Settings or email hello@bookwan.me. We action deletion requests within 30 days. Clients who want their booking data removed should contact the professional they booked with, or contact us directly if the professional is unresponsive.

We respond to rights requests within one month. There are limited legal exceptions - for example, we may keep transaction records needed for tax, fraud prevention or defending legal claims even after a deletion request.

Automated decisions - we do not use your personal data for automated decision-making or profiling that has a legal or similarly significant effect on you.

US residents - if you live in California or another US state with privacy legislation, you have equivalent rights to know, access, delete and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioural advertising, and we do not discriminate against anyone who exercises their privacy rights.

Children

Bookwan is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of Bookwan after changes means you accept the updated policy.

Contact us

For questions, access requests or complaints about this Privacy Policy, email hello@bookwan.me or write to ByOkwani Beauty LTD, 32 Dakeyne Street, Nottingham, United Kingdom.