Privacy Policy

1. What is collected

When you book an appointment through BookOS, the following is collected:

• Contact details — your name, email address, and phone number.
• Booking information — the services you book, your appointment history, and any related notes.
• Payment method on file — to enforce a business's cancellation and no-show policy, a payment card is kept on file. Your full card number is never seen or stored by BookOS or by the business. Card details are collected and stored directly by Stripe, the payment processor, on Stripe's PCI-DSS Level 1 certified systems. Only a secure token, the last four digits, the expiry date, and the card brand are retained.
• Consent records — the date, time, and version of the policy you agreed to at booking.

2. Why it is collected

This information is used to:

• Book, confirm, and manage your appointments.
• Send booking confirmations, reminders, and notices — including if a card on file is about to expire.
• Enforce the business's cancellation and no-show policy, including holding and, where applicable, charging a deposit. A card on file is collected specifically so that the business's no-show and cancellation policy can be applied; this purpose is disclosed to you at the time of booking.

Personal information is not used for advertising, and is not sold or shared with third parties for their marketing purposes.

3. Consent

When you complete a booking, you are asked to expressly agree to this Privacy Policy and to the business's booking, cancellation, and no-show terms. That agreement is recorded with the date, time, and policy version in effect at the time of booking.

You may withdraw consent to certain uses of your personal information, subject to legal and contractual restrictions and reasonable notice. If you withdraw consent to information necessary to hold or manage bookings, the business may be unable to offer future bookings that require a card on file.

4. How information is protected

• Card data is handled entirely by Stripe, a PCI-DSS Level 1 certified payment processor. Full card numbers are never stored on BookOS systems.
• Other information is encrypted in transit and at rest, and access is restricted to authorized staff of the business and of BookOS acting as its service provider.
• BookOS maintains technical and organizational safeguards appropriate to the sensitivity of the information it processes.

5. Who can access information

Your information is accessible to:

• The business you booked with — the controller of your information, to manage your appointments.
• BookOS / NovelLogic Ventures Inc. — the platform provider, acting as the business's service provider only, to operate the service.
• Stripe — the payment processor, for handling the payment card on file.

Some service providers used to operate the platform — including payment, hosting, email, and technical support providers — may process or store personal information outside British Columbia or Canada. Where that occurs, your information may be subject to the laws of the jurisdiction in which it is processed.

Information is not disclosed to anyone else except where required or permitted by law. BookOS and the businesses using it may disclose personal information to comply with applicable law, regulation, court order, subpoena, or other lawful process, and to protect the rights, safety, property, or security of the business, BookOS / NovelLogic Ventures Inc., clients, staff, payment processors, or others where permitted or required by law.

6. How long information is kept

Personal information is retained only for as long as necessary for the purposes described above and to satisfy legal, accounting, tax, chargeback, fraud-prevention, and record-keeping requirements. As a general practice:

• booking and client account records may be retained for up to seven years after the last client interaction;
• transaction, invoice, and payment-related records may be retained for up to seven years to meet tax, accounting, and dispute-resolution requirements;
• consent logs, policy-version records, and audit logs may be retained for up to seven years to demonstrate compliance and respond to disputes; and
• information no longer required is securely deleted or irreversibly anonymized within a reasonable time.

Retention periods may be extended where required or permitted by law, or where reasonably necessary to establish, defend, or resolve legal claims.

7. Your choices and rights

Under PIPEDA and BC's PIPA, and subject to applicable law, you may:

• Access the personal information held about you.
• Correct inaccurate information — including updating your card on file.
• Request deletion of personal information that is no longer required for the purposes for which it was collected.

Not all information can be deleted immediately. A business or its service providers may retain information required for legal, tax, accounting, security, fraud-prevention, chargeback, audit, or dispute-resolution purposes. Where appropriate, identifying information is deleted or irreversibly anonymized, and a minimal record of the deletion request may be retained.

8. Changes to this policy

This policy may be updated from time to time. When it changes, the "last updated" date above is revised, and material changes are communicated. The version of the policy in effect at the time of your booking governs that booking.

9. How to contact us

For any privacy question, request, or concern, contact:

NovelLogic Ventures Inc. (BookOS)
Privacy contact: privacy@novellogic.ca

If you have a concern that has not been resolved, you may also contact:

• Office of the Privacy Commissioner of Canada — for PIPEDA matters (priv.gc.ca)
• Office of the Information and Privacy Commissioner for British Columbia — for PIPA matters (oipc.bc.ca)