Booking Privacy Notice â Draft
This is an implementation draft, not a finalized legal document. The operator must confirm its identity, jurisdiction, retention schedule, and contact mechanism before collecting real customer information.
What this application collects
Appointment name, Indian mobile number, service selection, appointment date and time, optional WhatsApp consent, booking reference, payment provider reference and booking/payment status. The internal CRM also stores contact/lead source, sales stage, private staff notes, appointment history and follow-up tasks. We do not collect card details in the booking application: online checkout is handled by the activated payment provider.
Purpose
To schedule and administer appointments, link repeat bookings to one contact, organize internal customer-service follow-ups, avoid duplicate reservations, verify payments if online checkout is enabled, and send booking-related WhatsApp confirmation only with explicit customer opt-in. Booking consent does not grant permission to send unsolicited marketing messages.
Processing & providers
Booking records are stored using Cloudflare D1. When integrated and enabled, Razorpay processes checkout payments and Meta WhatsApp Business Cloud API delivers template message requests. These providers have their own privacy policies and service terms.
Who can access records
Authorized owner and administrator roles can view appointment names, contact numbers, booking/payment status and internal CRM records, including private notes and tasks. Public status lookup requires the randomized booking reference and matching mobile number.
Retention and requests
A production retention/deletion policy has not yet been finalized or automated. Before public launch, the operator must define applicable periods, a process for requests to access/correct/delete data when appropriate, and the responsible support contact. Do not treat this draft as a compliant published notice until reviewed.
Operator details to complete before launch
Business/controller identity: [Add legal business name]
Support/privacy contact: [Add verified contact channel]
Effective date: [Add date after approval]