Privacy

For a business’s own account (its owner, team and billing), RedStick decides why and how the data is used.

For a business’s customers, the business decides why and how the data is used. RedStick stores it and processes it on the business’s behalf, to run the bookings, send the emails and take the payments the business set up. Questions about a booking, or a request to see or delete your details, go to the business first.

The sign-in a customer uses is the exception: one customer login works across every business on RedStick, and RedStick keeps that login. Each business sees only its own record of you. [owner/counsel to confirm: controller or processor for the customer login]

About a business and its team:

• Name, email address and sign-in details, including two-step sign-in and passkeys if used.
• Sessions, with the network address and browser each one came from.
• Invitations, role and the actions the team takes in the dashboard.
• Plan and billing records. Cards are handled by Stripe; we keep references to saved payment methods, not card numbers.
• A connected calendar’s account address and the access tokens, stored encrypted.

About a business’s customers, entered by them or by the business:

• Name, email address and phone number.
• Bookings, including who or what is being booked (for example a person, a pet or a dependant), the answers to the business’s intake questions and any files the customer uploads.
• Reviews, messages and form submissions sent through a business’s site.
• Sign-in details for the customer login, and its sessions.
• Records of the emails we sent for the business and whether they were delivered.

We set only the cookies needed to keep you signed in and to keep the site working.

• A session cookie while you are signed in, on the host you signed in on. Its name starts with __Host-, which means the browser sends it to that host only. The dashboard, the customer login and each business site have their own.
• On a business site, a small cookie called rs_signed_in that only says there may be a session to check. It holds no secret.

We do not use advertising cookies, and we do not sell or share data for advertising. [owner to confirm no analytics or tracking is added to this site before launch]

We use these services to run RedStick Booking. Each receives only what its job needs.

• Amazon Web Services hosts the application, the database and stored files.
• Stripe bills businesses for their plan, and takes payments, deposits and fees for a business from its customers. Stripe is also responsible for the data it collects directly.
• SendGrid delivers the emails we send: sign-in codes, booking confirmations, reminders and receipts.
• Google and Microsoft, only when a business connects a calendar, or when someone chooses to sign in with Google.

We do not sell personal data. [owner/counsel to confirm: hosting region and international transfers]

A business can connect its Google Calendar so that bookings appear in it and its other events block times. We ask Google for these permissions:

• openid and email: the stable account identifier and the address we show next to the connection.
• https://www.googleapis.com/auth/calendar.events: to read when the business is busy, and to create, update and remove the events RedStick itself added for its bookings.

What we do with it:

• We read event times, so that busy time stops customers booking it. We ask Google not to send event titles, descriptions, locations or guests, so we do not receive them.
• We write booking events into the connected calendar. We do not list the business’s other calendars or read its settings.
• We store the access tokens encrypted, and delete them when the business disconnects the calendar. The business can also remove RedStick’s access in its Google account.

RedStick Booking’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the calendar features above. We do not transfer it to others except as needed to provide those features, to follow the law, or as part of a merger or sale with notice. We do not use it for advertising, including interest-based advertising. No person reads it unless the business asks us to help with a problem, we need to investigate abuse or a security issue, or the law requires it.

Customers who sign in with Google give us their name and email address. Microsoft works the same way for Outlook calendars, with the permissions to read and write calendar events and to read the signed-in profile.

A business can export its data. If a business cancels, its account stays for 90 days so it can come back. After that, or when the business asks, we delete its data, its files and its customers’ records. We keep billing records that tax and accounting rules require, with the personal details removed.

A business chooses how long uploaded intake files are kept, from keeping them to deleting them when a booking ends. After deletion the business’s web address and name stay reserved for 30 days.

[owner/counsel to confirm: retention periods for logs, email delivery records and backups]

You can ask to see, correct or delete your personal data. If you are a customer, ask the business you booked with, or write to us and we will pass it on. Our details are on the contact page. [owner/counsel to confirm: legal bases, rights by region and complaint route]

When we change this page, we change the date at the top. If a change affects how we use data you already gave us, we tell the business by email first.