Privacy policy

When you book: your name, phone number, email (if you give one), the service and time you chose, and any note you write. The phone number is required — the merchant needs to reach you, and you need it together with your booking reference to look the booking up again.

When you create an account: email and password. Passwords are hashed by Supabase Auth; we never see them.

When a business registers: business name, address, contact details, services and prices, opening hours and staff names. This information is meant to appear publicly on your business page.

Automatically: technical logs such as browser type, approximate location and page views, used to keep the site working and to prevent abuse.

To place, confirm, remind about and cancel bookings; to show merchants their own bookings; to prevent duplicate bookings and abuse; to understand overall usage (not identifying individuals); and where the law requires it.

We do not use the contact details you leave when booking for direct marketing unless you separately opt in. Under Part VIA of the Ordinance, using personal data for direct marketing without consent is a criminal offence — but the simpler reason is that you left your number to get a haircut, not to receive ads.

The business you booked: they see your name, phone, email (if provided) and note. That is inherent to the booking — without it they cannot serve you.

Service providers: hosting and database (Vercel, Supabase), traffic analytics (Vercel Analytics and Google Analytics), email delivery (Resend), merchant payments (Paddle). They may process the data only to provide those services to us.

We never touch payment card data: merchant subscriptions are billed through Paddle as Merchant of Record. Card details never pass through our servers.

Apart from the above and where the law requires it, we do not sell, rent or pass your personal data to third parties.

Our database is hosted by Supabase on servers in Singapore, and the site is served over Vercel's global network. This means your data is processed and stored outside Hong Kong. The providers we use maintain appropriate security and data-protection measures.

Booking records are kept for 24 months, then anonymised (statistics retained, contact details removed). That period exists so disputes, refunds and merchant record-checks remain possible.

Account data is removed within 30 days of you deleting your account. Published reviews remain but are detached from your account.

Public business data is removed when a listing is taken down, except transaction records the law requires us to keep.

Under the Ordinance you have the right to access and correct the personal data we hold about you. Most of it you can change by signing in; for the rest, contact us.

We will respond within 40 days of your request (section 19). A fee permitted by the Ordinance may apply to data access requests.

You may also ask us to stop using your data for any promotional purpose — we will do so immediately and free of charge.

Essential: remembering your sign-in, language and appearance choice. Without these you would be signed out constantly. Analytics: we use Google Analytics to understand how the site is used — what people search for, whether they find it, and where they drop off between searching and booking. This is to improve the site, not to identify you personally, and it is not used for advertising tracking (we run no ad networks). To opt out, install Google's opt-out add-on, or use Do Not Track or private browsing — we respect all of these, and none of them affects your access to any feature.

Every table in our database enforces row-level security: merchants see only their own bookings, users only their own data. Guests need the booking reference and the phone number used to book — a reference alone is not enough.

No system can promise absolute security, but we encode these boundaries as automated tests that run on every change.

If this policy changes materially, we will update the date on this page and show a notice on the site.

For any privacy question, or an access or correction request, reach us through our contact page.