Privacy Policy

Effective September 25, 2026

Two kinds of information

• Business customers — the owners and staff who use ZeloBooking to run their business. For this information, we decide how it’s used.
• Their clients — people who book appointments with a business that uses ZeloBooking. The business decides how its client information is used; we process it on the business’s behalf, only to provide the service. If you booked with a business and have a question about your information, contact that business first — we’ll help them answer you.

What we collect

From business customers

• Account details: name, email address, password (stored only as a secure hash).
• Business details: business name, type, address, time zone, phone, services, prices, staff names, working hours and settings.
• Mobile numbers you choose to add for account text messages, and your consent to receive them.
• Billing information for your ZeloBooking subscription. Card payments are handled by our payment processor; we never see or store full card numbers.

From clients who book

• Name, email address and, if given, mobile phone number.
• Appointment details: services, times, the staff member, notes and booking history.
• Amounts a business records for its own reporting. ZeloBooking does not take payments for appointments.
• Consent and intake forms a business asks you to sign, stored encrypted and locked once signed.
• Your choices about reminders and marketing messages, with the time and wording you agreed to.

Automatically

• Basic technical information needed to run and secure the service (for example IP address and browser type in security logs).
• Cookies that keep you signed in and remember your cookie choices. Our built-in website statistics are cookie-less and don’t store IP addresses or identifiers.

How we use information

• To provide ZeloBooking: bookings, calendars, reminders, forms and websites.
• To send messages you or the business asked for, such as confirmations and reminders.
• To keep the service secure, prevent abuse and fix problems.
• To bill business customers for their subscription.
• To meet legal obligations.

We do not sell personal information, and we do not use clients’ information to market our own products to them.

Text messaging (SMS)

ZeloBooking sends text messages only to people who agreed to receive them: business owners and staff for account notifications (for example new bookings and cancellations), and clients for appointment reminders or, if they separately opted in, offers from a business. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We share mobile numbers only with the carriers and messaging provider needed to deliver the messages you asked for.

Who we share information with

We use trusted service providers to run ZeloBooking. They may process information only on our instructions:

• Supabase — database and sign-in.
• Cloudflare — hosting, security and content delivery.
• Twilio — text messages.
• Our email delivery provider — confirmation and reminder emails.
• Stripe — subscription billing for business customers.

We may also share information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of our business (with notice to you). A business can see its own clients’ information; no business can see another business’s clients.

How we protect information

• Encryption in transit (HTTPS) and at rest.
• Each business’s data is kept separate by access rules enforced in the database itself.
• Signed consent forms are encrypted and protected by a PIN sent to the client.
• Access is limited by role, and sensitive actions are logged.

How long we keep information

We keep information for as long as the business account is active or as needed to provide the service. When a business closes its account, we delete or anonymize its data within 90 days, except where we must keep records longer by law (for example billing records). Businesses can ask us to delete individual client records sooner.

Your choices and rights

• Opt out of text messages by replying STOP; opt out of marketing emails with the unsubscribe link.
• Ask to access, correct or delete your information. Business customers can contact us; clients should contact the business they booked with, or us and we’ll pass it on.
• Depending on where you live (for example California), you may have additional rights. We don’t sell or share personal information for cross-context behavioral advertising, and our own website uses no advertising trackers.

We won’t treat you differently for using these rights.

Children

ZeloBooking is not directed to children under 13, and we don’t knowingly collect their information. Businesses serving minors are responsible for obtaining a parent’s or guardian’s consent where required.

Business websites built with ZeloBooking

Businesses can publish their own website with ZeloBooking. If a business adds its own analytics or tracking tools, those load only after visitors consent, and the business is responsible for describing them in its own privacy notice.

Changes to this policy

We’ll post any changes here and update the effective date. For significant changes we’ll notify business customers by email or in the app.

Contact us

Privacy questions or requests: privacy@zelobooking.com. General support: support@zelobooking.com.
Zeloxa Labs LLC