Booking Hub · Interim · v2026-08-09
Privacy notice
How the Booking Hub preview handles operator and fan personal data. A formal GDPR policy with a registered entity will replace this when ready.
← Home · Terms · Privacy · Report abuse
Who this covers
This interim notice explains how the Booking Hub preview handles personal data for (1) invited operators who sign in with Google, and (2) fans who submit a public booking form. It is not yet a counsel-reviewed GDPR privacy policy.
Roles (planned GDPR framing)
For fan booking data on a hub’s public page, the hub operator is typically the controller of that fan relationship; the preview software processes bookings on the operator’s behalf. For operator accounts (Google sign-in, memberships), the preview maintainers process account data to provide access. Exact controller/processor contracts will be published when a registered entity exists.
Fan data on /book
Depending on hub settings, a booking may collect name, email, phone, chosen service/slot, and custom form answers. That data is stored to create and manage the booking, send confirmation/reconfirm emails when enabled, and (if connected) create calendar events. Operators control which contact fields are shown or required.
Operator account data
Sign-in uses Google OAuth (Auth.js). We store account identifiers needed for access (such as email, name, and membership/role). Calendar connections store sealed tokens so the hub can create events when you connect Google Calendar.
Infrastructure processors
Hosting and data may involve providers such as Vercel (app hosting), Neon (Postgres), Google (sign-in / Calendar), Resend (transactional email), and Cloudflare Turnstile (abuse protection on public booking). Configure production secrets only in the host environment—never in public docs.
Retention & requests
Bookings and form answers are retained while the hub needs them for scheduling history. To request deletion or access during the preview, email bookinghub.com@gmail.com with enough detail to identify the hub and records. Operators remain responsible for fan requests that only they can fulfill.
Version
Privacy notice version 2026-08-09. Material changes will bump this version.