Legal
Privacy Policy
Global SaaS privacy notice for business management, booking, CRM, notifications and administration services.
This Privacy Policy explains how Bookly handles personal data when providing its services worldwide. It should be read together with Bookly’s Terms of Service, Cookie Policy and, where applicable, a Data Processing Agreement (DPA).
1. Scope and overview
This Privacy Policy describes how SRL Automation Factory, operating the Bookly product and the website bookly.expert (collectively, “Bookly”, “we”, “us”, or “our”), collects, uses, stores, discloses, transfers and otherwise processes Personal Data in connection with the Bookly services (the “Services”).
Bookly is a business software platform designed to help service businesses manage operations such as appointments and reservations, customer relationship management (CRM), staff administration, automated notifications, business records, subscription features and related workflows. The exact features available to a Business Customer may vary by plan, country, language, integration or product configuration.
This Privacy Policy applies to Business Customers, their owners and staff, End Customers whose information is processed through Bookly, website visitors, support contacts, prospective customers and other individuals who interact with the Services.
2. Who we are
Bookly is operated by SRL Automation Factory, a company established in the Republic of Moldova.
Product: Bookly
Website: https://bookly.expert/
Privacy and support contact: booklyexpert@gmail.com
For privacy matters relating to data that a Business Customer controls, End Customers should normally contact the relevant Business Customer first. If a request is sent to Bookly and Bookly is acting only as a processor, we may refer or forward the request to the relevant Business Customer, where appropriate.
3. Key definitions
| Term | Meaning |
|---|---|
| Business Customer | A company, sole trader, professional, venue, salon, restaurant, clinic, studio, service provider or other organization that subscribes to or uses Bookly. |
| Business User | An owner, administrator, employee, contractor or other authorized user who accesses a Business Customer account. |
| End Customer | A person whose information is entered into or generated through Bookly in connection with a Business Customer, for example a person making a booking or receiving a reminder. |
| Business Customer Data | Data submitted to, stored in or generated through Bookly by or for a Business Customer, including customer, staff, booking and operational data. |
| Personal Data | Information relating to an identified or identifiable natural person, including equivalent concepts such as “personal information” under applicable privacy laws. |
| Processing | Any operation performed on Personal Data, such as collecting, storing, organizing, using, transmitting, deleting or otherwise handling it. |
4. Our roles: controller and processor
4.1 When Bookly acts as a controller
Bookly generally acts as a controller for Personal Data that we determine the purposes and means of processing, including:
- Business User registration and account administration data;
- website visitor and technical usage data collected for Bookly’s own purposes;
- support communications sent directly to Bookly;
- billing and subscription metadata received from Lemon Squeezy;
- security, fraud-prevention and platform integrity data;
- Bookly product announcements, marketing preferences and sales communications;
- information required for our legal, accounting, tax, compliance and corporate obligations.
4.2 When Bookly acts as a processor or service provider
When a Business Customer uses Bookly to manage End Customers, staff, bookings, reservations, notes, reminders or other Business Customer Data, the Business Customer generally determines why that data is processed. In those circumstances, Bookly generally acts as a processor, subprocessor or “service provider” on the Business Customer’s behalf, depending on applicable law.
The Business Customer is responsible for providing required privacy notices, obtaining required consents, establishing a lawful basis for processing and configuring Bookly in a manner consistent with applicable law.
4.3 Data Processing Agreements
Where required by applicable data protection law, Bookly and a Business Customer may enter into a Data Processing Agreement (“DPA”) covering processor obligations, confidentiality, security, subprocessing, international transfers, assistance with data subject requests and deletion or return of Business Customer Data.
5. Personal Data we collect
The Personal Data we process depends on how Bookly is used. The categories below are designed to cover the core Bookly platform and common business-management workflows.
| Category | Examples |
|---|---|
| Account and identity data | Name, business name, username or login identifier, email address, phone number, preferred language, role, account status and authentication-related information. |
| Business profile data | Business category, locations, opening hours, services, prices, staff, branding, contact details, tax or billing details, configuration settings and public business profile information. |
| End Customer and CRM data | Names, email addresses, phone numbers, contact preferences, booking history, service history, notes, tags, communications, loyalty or membership information, and other data entered by a Business Customer. |
| Booking and reservation data | Appointment date and time, service, location, staff member, status, cancellation or no-show information, booking source, notes and related operational information. |
| Staff and team data | Names, business contact details, schedules, roles, permissions, assigned services, availability and other workforce-related data uploaded by a Business Customer. |
| Billing and subscription data | Subscription plan, order or transaction identifiers, billing country, currency, payment status, invoice-related information, tax-related information and limited payment metadata received from Lemon Squeezy. |
| Communications data | Support requests, feedback, email correspondence, notification content, delivery status, communications preferences and records of interactions with Bookly or a Business Customer. |
| Device and technical data | IP address, browser and device type, operating system, timestamps, language/locale, referring pages, session data, log events, crash or error information and security-related signals. |
| Integration data | Authorization tokens, identifiers, calendar or third-party service data and synchronization metadata when a Business Customer chooses to connect an integration. |
| Marketing and preference data | Consent status, communication preferences, campaign interactions and product or marketing engagement information. |
5.1 Payment card data
Bookly uses Lemon Squeezy for subscription checkout and billing. Full payment card details are generally collected and processed directly by Lemon Squeezy rather than by Bookly. Bookly may receive limited transaction and subscription information needed to activate, administer, reconcile and support subscriptions.
6. How we obtain Personal Data
We may obtain Personal Data:
- directly from you when you create an account, configure Bookly, contact support or communicate with us;
- from a Business Customer when it enters, imports or synchronizes data about its End Customers, staff or operations;
- automatically when you use the website or Services, through logs, cookies and similar technologies;
- from Lemon Squeezy in connection with subscription checkout, billing, tax, fraud prevention and payment status;
- from third-party integrations that you choose to connect to Bookly;
- from publicly available sources or business contacts where lawful and relevant to sales, security or verification activities.
7. How and why we use Personal Data
We use Personal Data only where we have a lawful and appropriate reason to do so. Depending on the jurisdiction, this may include performance of a contract, steps requested before entering into a contract, legitimate interests, consent, compliance with legal obligations or another legal basis recognized by applicable law.
| Purpose | Typical data | Typical legal basis / reason |
|---|---|---|
| Provide and operate Bookly | Account, business, CRM, booking, staff, technical and integration data | Contract; legitimate interests; processing on Business Customer instructions. |
| Create and administer accounts | Identity, account, role and authentication data | Contract; legitimate interests in managing access and security. |
| Process subscriptions and billing | Subscription, billing and transaction metadata | Contract; legal obligations; legitimate interests in financial administration. |
| Send operational notifications | Booking, contact, communication and delivery data | Contract; legitimate interests; Business Customer instructions; consent where required. |
| Provide support | Account, contact, technical and communications data | Contract; legitimate interests in customer support and service quality. |
| Secure the Services | Technical, log, account and security data | Legitimate interests; legal obligations where applicable. |
| Improve and troubleshoot the product | Technical, usage, error and aggregated service data | Legitimate interests; consent for non-essential analytics where required. |
| Communicate about Bookly | Business User contact and preference data | Legitimate interests or consent, depending on the communication and applicable law. |
| Comply with law and protect rights | Account, transaction, communications and other relevant data | Legal obligations; legitimate interests in establishing, exercising or defending legal claims. |
Where we rely on legitimate interests, we consider the impact on individuals and do not rely on that basis where our interests are overridden by applicable rights and freedoms.
8. Business Customer Data and processor activities
Business Customers may use Bookly to collect, organize and manage Personal Data relating to End Customers and staff. When Bookly processes that data solely on behalf of a Business Customer, Bookly will process it to provide the Services, maintain security, perform authorized support, comply with documented instructions and satisfy legal obligations applicable to Bookly.
Bookly does not acquire ownership of Business Customer Data merely because that data is stored in the Services. Business Customers remain responsible for the accuracy, legality and instructions associated with their Business Customer Data.
8.1 End Customer privacy requests
If Bookly receives a request from an End Customer concerning Business Customer Data for which Bookly is acting as processor, Bookly may direct the individual to the relevant Business Customer and may assist the Business Customer with the request as required by applicable law or a DPA.
8.2 Customer responsibilities
Business Customers must not use Bookly to collect or process Personal Data unlawfully. In particular, Business Customers are responsible for:
- providing required privacy notices to End Customers and staff;
- obtaining consent where consent is required, including for certain marketing communications;
- limiting access to authorized Business Users;
- keeping account credentials secure;
- using notes and CRM fields responsibly and avoiding unnecessary sensitive data;
- responding to privacy rights requests and retention obligations that apply to their business.
9. Bookings, CRM, staff and business records
Bookly may store historical booking, CRM, staff and operational records to provide continuity, reporting, customer history, no-show or cancellation management, auditability, troubleshooting and other business functionality requested by a Business Customer.
Business Customers control what information they enter into free-text notes and custom fields. Because free-text fields can create privacy and security risks, Business Customers should avoid entering sensitive or excessive information unless it is genuinely necessary and lawful for their business purpose.
10. Notifications and communications
10.1 Messages sent on behalf of Business Customers
Bookly may facilitate automated or manual messages sent by Business Customers to End Customers, including booking confirmations, appointment or reservation reminders, cancellations, rescheduling notices, payment-related notices, follow-up messages and other service communications.
Where a Business Customer uses Bookly for promotional or marketing messages, that Business Customer is responsible for ensuring that it has any consent or other legal basis required by applicable direct-marketing, electronic communications, anti-spam or privacy law, and for honoring opt-out requests.
10.2 Messages from Bookly to Business Users
We may send Business Users service, security, account, billing and legal notices that are necessary to operate the account. We may also send product news or marketing communications where permitted by law. Marketing communications will include an appropriate way to opt out where required; opting out of marketing does not prevent necessary transactional or service communications.
11. Payments and subscriptions through Lemon Squeezy
Bookly uses Lemon Squeezy as a third-party commerce and billing provider for paid subscriptions. Lemon Squeezy operates as a Merchant of Record for covered transactions. This means that, for applicable purchases, Lemon Squeezy handles the transaction with the buyer and may process payment, billing, fraud-prevention, tax, refund and compliance information under Lemon Squeezy’s own legal obligations and privacy notice.
Depending on the transaction, Lemon Squeezy may act as an independent controller for certain buyer and payment data and may also provide data or services to Bookly for subscription administration. Bookly may receive information such as the subscription or order identifier, plan, transaction status, price, currency, billing country, tax-related information and limited customer or billing details.
Bookly generally does not receive or store complete payment card numbers or card security codes. Payment information entered into Lemon Squeezy checkout is processed by Lemon Squeezy and its payment partners.
12. Integrations and connected services
Bookly may allow Business Customers to connect third-party tools, calendars, communications services or other integrations. When you enable an integration, Bookly may receive and transmit information necessary to authenticate the connection, synchronize data and provide the requested functionality.
Third-party services are governed by their own terms and privacy policies. Business Customers are responsible for reviewing those terms before enabling an integration and for ensuring they have authority to transfer any relevant Personal Data.
If an integration is disconnected, Bookly may retain historical data previously synchronized into the Bookly account where that data forms part of Business Customer Data, subject to the retention and deletion provisions below.
13. Cookies and similar technologies
Bookly may use cookies, local storage, pixels, SDKs and similar technologies to keep users signed in, remember preferences, protect the Services, understand product performance, troubleshoot issues and, where configured, measure website or product usage.
Where applicable law requires consent for non-essential cookies or analytics, Bookly will seek consent before using those technologies. Users may also be able to manage cookies through browser or device settings. Blocking necessary cookies may prevent parts of the Services from functioning correctly.
If Bookly publishes a separate Cookie Policy or consent-management interface, that document or interface will provide more specific and current information about the technologies in use.
14. When we share Personal Data
We may disclose Personal Data in the following circumstances:
- to service providers and subprocessors that help us operate Bookly;
- to Lemon Squeezy and payment-related parties in connection with subscriptions and billing;
- to a Business Customer when the information relates to that Business Customer’s account, End Customers, staff or business operations;
- to third-party integrations at the direction of a Business Customer;
- to professional advisers such as lawyers, auditors, accountants or insurers where reasonably necessary;
- to authorities, regulators, courts or other parties where required by law or where reasonably necessary to protect rights, safety, security or prevent fraud;
- in connection with a merger, acquisition, financing, restructuring, sale of assets or similar corporate transaction, subject to appropriate safeguards.
We do not disclose Business Customer Data to unrelated third parties for their own independent marketing merely because that data is stored in Bookly.
15. Service providers and subprocessors
Bookly relies on third-party providers to operate a global SaaS service. Providers may change as the product develops. As of the date of this Privacy Policy, important known providers include:
| Provider | Purpose | Typical role |
|---|---|---|
| DigitalOcean | Cloud infrastructure, hosting, storage and backup-related infrastructure used to operate Bookly. | Processor / subprocessor for infrastructure services. |
| Lemon Squeezy | Merchant of Record, subscription checkout, payment processing, billing, tax, fraud prevention and related commerce services. | May act as an independent controller and/or service provider depending on the processing activity. |
| Resend | Email delivery infrastructure used to send transactional messages and email notifications from Bookly. | Processor / subprocessor for email delivery services. |
We may also use communications, monitoring, security, analytics, software development and support providers as necessary. Where Bookly acts as a processor and applicable law requires subprocessor terms, those relationships will be addressed through appropriate contractual safeguards.
16. International data transfers
Bookly is operated from the Republic of Moldova and uses service providers that may process information in other countries. As a result, Personal Data may be transferred to, accessed from or stored in countries outside the jurisdiction in which the individual is located.
Where applicable law restricts international transfers, we use or require appropriate transfer mechanisms and safeguards, which may include adequacy decisions, Standard Contractual Clauses, contractual protections, recognized data-transfer frameworks or other lawful mechanisms.
Business Customers are responsible for determining whether their use of Bookly requires additional transfer documentation for Business Customer Data. Where Bookly acts as a processor, transfer safeguards may also be addressed in a DPA.
17. Data retention and backups
17.1 General retention approach
Bookly retains Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy, to provide the Services, comply with legal and accounting obligations, maintain security, prevent fraud, resolve disputes, enforce agreements and follow documented Business Customer instructions.
Bookly does not currently apply an automatic deletion rule merely because an account or a business record has been inactive for a particular period. Historical Business Customer Data may therefore remain available in the account unless it is deleted through available product controls, deleted under a retention rule implemented by the Business Customer, or subject to a valid deletion request or other legal requirement.
This does not override applicable rights to erasure, data-minimization duties or legal storage-limitation requirements. We may delete or anonymize Personal Data when it is no longer reasonably necessary, and we will honor valid deletion obligations subject to lawful exceptions.
17.2 Typical retention considerations
| Data type | Retention approach |
|---|---|
| Business account data | Generally retained while the account is active and afterward for a period reasonably necessary for account closure, security, disputes, legal obligations and business records. |
| Business Customer Data | Generally retained according to Business Customer instructions, product configuration, account status and applicable law. Historical records are not necessarily deleted automatically because they become inactive. |
| Subscription and transaction records | Retained as needed for billing, tax, accounting, fraud prevention, disputes and legal compliance. Lemon Squeezy may apply its own retention periods to data it controls. |
| Support communications | Retained as reasonably necessary to resolve issues, maintain support history, improve service quality and establish or defend legal claims. |
| Security and technical logs | Retained for periods appropriate to security, troubleshooting, reliability, abuse prevention and legal obligations. |
| Marketing preferences | Retained while relevant to communications and, where a person opts out, a suppression record may be retained so the opt-out can be respected. |
17.3 Backups
Bookly maintains backups using DigitalOcean infrastructure for service continuity, disaster recovery and resilience. When data is deleted from active systems, residual copies may remain in backup systems until those backups are rotated, overwritten or deleted in the ordinary backup lifecycle. Backup copies are not intended to be used as active production records except where restoration is necessary for continuity, recovery, security or legal reasons.
If a backup is restored, Bookly will take reasonable steps to re-apply deletion or restriction requirements that were validly implemented before the restoration, where technically and legally appropriate.
18. Security
We use technical and organizational measures designed to protect Personal Data against unauthorized access, disclosure, alteration, loss, misuse or destruction. Measures may include access controls, authentication controls, transport security, environment separation, logging and monitoring, backup and recovery procedures, restricted administrative access, software maintenance and internal security practices appropriate to the nature of the data and risk.
No internet service, cloud environment or storage system can guarantee absolute security. Business Customers are also responsible for account security, including strong credentials, appropriate user permissions, secure devices and promptly removing access for users who no longer require it.
If Bookly becomes aware of a Personal Data breach, we will investigate and take steps required by applicable law and contractual commitments, which may include notifying affected Business Customers, authorities or individuals where legally required.
19. Your privacy rights and choices
Depending on your location and the context in which Bookly processes your Personal Data, you may have rights to:
- request access to Personal Data about you;
- request correction of inaccurate or incomplete Personal Data;
- request deletion or erasure;
- request restriction of processing;
- object to certain processing, including certain processing based on legitimate interests;
- receive certain Personal Data in a portable format;
- withdraw consent where processing is based on consent, without affecting processing that was lawful before withdrawal;
- opt out of certain marketing communications;
- complain to a competent privacy or data-protection authority.
Some rights are subject to legal conditions, exceptions and verification requirements. We may need to verify your identity before completing a request. We will not discriminate against an individual for exercising rights protected by applicable law.
19.1 Requests concerning Business Customer Data
If your Personal Data is controlled by a Business Customer and Bookly is only processing it on that Business Customer’s behalf, please contact the Business Customer first. Bookly may assist the Business Customer with the request as required by applicable law or contract.
19.2 Requests concerning Bookly-controlled data
Requests may be sent to booklyexpert@gmail.com. Please describe the request and the Bookly account, business or interaction to which it relates.
20. Regional privacy information
20.1 European Economic Area, United Kingdom and Switzerland
Where the GDPR, UK GDPR or equivalent Swiss data-protection rules apply, Bookly processes Personal Data under one or more legal bases described in Section 7. Individuals may have rights including access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and may lodge a complaint with the competent supervisory authority.
Where Bookly acts as processor for an EEA, UK or Swiss Business Customer, the Business Customer is generally responsible for the legal basis and transparency applicable to End Customer and staff data, while Bookly processes that data under the Business Customer’s instructions and applicable processor obligations.
20.2 Republic of Moldova
For processing subject to Moldovan law, Bookly complies with applicable personal-data legislation of the Republic of Moldova, including Law No. 133/2011 on Personal Data Protection while applicable and Law No. 195/2024 on Personal Data Protection from its effective date of 23 August 2026, together with implementing rules and other applicable legislation.
Individuals may also have the right to contact the competent Moldovan data-protection authority regarding concerns about the processing of Personal Data.
20.3 United States
Residents of certain U.S. states may have additional rights under state privacy laws, subject to statutory thresholds, exemptions and definitions. Depending on the law, these may include rights to know, access, correct, delete, obtain a portable copy, and opt out of certain sales, sharing, targeted advertising or profiling.
Bookly does not sell Personal Data in exchange for monetary payment. If Bookly engages in processing that is treated as a “sale”, “sharing” or targeted advertising under an applicable U.S. privacy law, Bookly will provide notices and opt-out mechanisms required by that law.
20.4 Brazil, Canada and other jurisdictions
Individuals in Brazil, Canada and other jurisdictions may have additional privacy rights under laws such as the LGPD, PIPEDA or applicable provincial, state or national privacy laws. Bookly will respond to valid requests to the extent those laws apply to the relevant processing.
21. Sensitive Personal Data and minors
21.1 Sensitive data
Bookly is designed as a general business-management platform, not as a dedicated system for storing highly sensitive medical, biometric, financial-account, government-identifier or similarly sensitive information. Business Customers should avoid entering sensitive Personal Data into notes or custom fields unless it is necessary for their business, specifically supported by the Services, and lawful in their jurisdiction.
Certain businesses may need to record information that can be sensitive in context, such as allergies, accessibility requirements or service-related health information. The Business Customer is responsible for determining whether such processing is lawful, necessary, proportionate and subject to any additional consent, security or documentation requirements.
21.2 Minors
Bookly business accounts are intended for adults and authorized business representatives. The Services are not directed to children for the purpose of independently creating a Business Customer account. Business Customers that process information about minors through bookings or services are responsible for complying with applicable age, parental-consent and child-privacy requirements.
22. Automated workflows and decision-making
Bookly is designed to automate routine business workflows, such as reminders, notifications, scheduling actions, follow-ups, status changes and administrative tasks configured by a Business Customer. These operational automations may use account, booking, CRM or communication data to perform the action selected or configured by the Business Customer.
Bookly does not intend routine workflow automation to make solely automated decisions that produce legal or similarly significant effects on individuals. If Bookly introduces such processing in the future where special legal rules apply, we will provide any additional notices, safeguards and choices required by law.
23. Languages and translations
Bookly may make the Services and this Privacy Policy available in multiple languages. Translations are provided to improve accessibility and understanding. We aim to keep translated versions consistent with the English version.
If a translated version differs from the English version, the English version will be used to interpret this Privacy Policy to the extent permitted by applicable law. Where local law requires a particular language version or provides otherwise, the mandatory local requirement will apply.
Bookly may process language and locale preferences to display the appropriate interface, content, notifications and support experience.
24. Third-party services and links
The Services may contain links to third-party websites, integrations or services. Bookly is not responsible for the privacy practices of independent third parties. When you leave Bookly or provide information directly to another provider, that provider’s privacy terms apply to its processing.
This includes Lemon Squeezy’s processing of buyer and payment data and any third-party integration enabled by a Business Customer.
25. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes to the Services, our providers, legal requirements, security practices or how we process Personal Data. The “Last updated” date at the top of the Privacy Policy shows when the current version was issued.
Where changes are material and applicable law requires notice, we may provide notice through the Services, by email, on our website or through another appropriate method. Continued use of the Services after an update does not waive any consent requirement imposed by applicable law.
26. Contacting Bookly
Questions, privacy requests or concerns about this Privacy Policy may be sent to:
Legal entity: SRL Automation Factory
Product: Bookly
Website: https://bookly.expert/
Email: booklyexpert@gmail.com
© 2026 SRL Automation Factory. Bookly.