Privacy Policy

Bookly (“we”, “us”, “our”) provides a multi-tenant Software-as-a-Service platform that enables small and medium businesses to manage customer bookings, orders, and conversations over WhatsApp, Instagram Direct Messages, and Facebook Messenger. This policy explains what personal data we collect when you use our platform, how we use it, and the rights you have over it.

For any privacy-related question, contact us at support@bookly.ikieguy.online.

We collect only the data needed to operate the service. Specifically:

• Account data: the business owner's name, email address, hashed password, and business name when they register.
• WhatsApp Business credentials: when a business connects their WhatsApp Cloud API account via Meta's Embedded Signup flow, we receive and store (encrypted at rest) their WhatsApp Business Account ID, phone number ID, display phone number, and an access token. These credentials are used solely to send and receive messages on the business's behalf.
• Facebook Page and Instagram credentials: when a business connects Instagram or Messenger through the Facebook Login consent screen, we receive and store the ID and name of the Facebook Page they choose, the ID and username of the Instagram professional account linked to that Page, and a Page access token (encrypted at rest). We request only the permissions needed to receive and reply to messages: pages_messaging, instagram_manage_messages, instagram_basic, pages_show_list, and pages_manage_metadata. We do not read posts, comments, followers, or advertising data.
• Customer conversations: when an end-customer messages a business through our platform, we store the contents of the messages exchanged and timestamps, together with the identifier the channel gives us: the phone number and WhatsApp profile name on WhatsApp; on Instagram, the Instagram-scoped user ID and, where Meta provides it, the @username and profile name; on Messenger, the Page-scoped user ID and profile name. Instagram and Messenger do not give us the customer's phone number; we only hold one if the customer types it into the conversation. This data is the property of the business the customer is messaging.
• Bookings & orders: customer name, phone number, selected service or product, scheduled time, and (where applicable) delivery address and payment reference.
• Payment information: payment processing is handled by Paystack (https://paystack.com). We do not store card numbers, CVVs, or full bank details. We store only the Paystack transaction reference and the high-level result (status, amount, currency).
• Operational metadata: IP addresses, request timestamps, and audit log entries needed for security monitoring and dispute resolution.

• To operate the platform: send and receive messages on WhatsApp, Instagram, and Messenger on the business's behalf, create bookings, process orders and ride or package purchases.
• To let a business's automated assistant understand and answer its customers' messages (where the business has turned the assistant on).
• To send appointment reminders and order updates via WhatsApp, SMS, or email.
• To enforce subscription quotas and billing.
• To detect abuse, fraud, and security incidents.
• To respond to support requests.

We do not sell your personal data. We do not use customer conversation contents to train machine-learning models, and we do not use data received from Meta for advertising, profiling, or any purpose other than answering the conversation it came from.

Our public website uses Plausible Analytics to count page visits and a few anonymous actions, such as clicks on “Start free”, demo requests and WhatsApp links. Plausible is cookieless: it sets no cookies, does not collect personal data, does not store your IP address, and does not follow you across other websites. Because of this, we do not show a cookie banner.

The signed-in Bookly app uses only essential browser storage, such as keeping you logged in and remembering your display settings. We use no advertising or tracking cookies.

We process personal data in line with Ghana's Data Protection Act, 2012 (Act 843). You may raise any concern with us at support@bookly.ikieguy.online, and you also have the right to complain to Ghana's Data Protection Commission.

We share data with the following processors strictly for the purposes listed:

• Meta Platforms (WhatsApp Cloud API, Instagram Messaging API, Messenger Platform): to deliver and receive messages on behalf of connected businesses.
• OpenAI (only for businesses that turn on the AI assistant): the text of a customer's message and the business's services and opening times are sent to OpenAI's API to compose a reply. Under OpenAI's API terms this data is not used to train their models. Businesses using a scripted assistant send nothing to OpenAI.
• Sentry: error monitoring; error reports exclude message contents and secrets.
• A business's own systems (optional, per-business): a business may connect its own application through our API or webhooks; conversation and booking data for that business is then shared with the application it chose.
• Paystack: to process customer payments and platform subscription billing.
• Supabase: hosts our PostgreSQL database; data is encrypted in transit and at rest.
• Google Calendar & Microsoft Outlook (optional, per-business): to sync bookings into the business's own calendar when they connect those integrations.
• Arkesel (optional): used as an SMS fallback when WhatsApp delivery fails.
• Gmail SMTP (optional): used as an email fallback when WhatsApp and SMS delivery both fail.

Account, conversation, booking, and order data are retained while the business's account is active and for up to 12 months after account closure, after which they are permanently deleted. Audit log entries are retained for 24 months for security and compliance purposes.

A business may request deletion of all their data at any time by emailing support@bookly.ikieguy.online. Deletion is completed within 30 days.

Businesses: open Bookly → Channels and choose Disconnect on Facebook & Instagram. We immediately stop receiving messages and delete the stored Page access token. You can also remove Bookly from Facebook (Settings & privacy → Settings → Business integrations). To delete the stored conversations as well, email support@bookly.ikieguy.online from the account owner's address; we confirm and complete deletion within 30 days.

Customers who messaged a business on Instagram or Messenger: email support@bookly.ikieguy.online with the name of the business and your Instagram username or Facebook name, and we delete your conversations and identifiers within 30 days, telling the business it has been done.

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (subject to legal retention obligations).
• Object to or restrict certain processing.
• Withdraw consent for optional integrations (calendar, SMS fallback) at any time.

Exercise any of these rights by emailing support@bookly.ikieguy.online.

All data is transmitted over HTTPS. Stored secrets (WhatsApp access tokens, OAuth tokens, Facebook Page tokens, Paystack keys, Gmail app passwords) are encrypted at rest using AES-256-GCM. Database connections require TLS. Access to production data is limited to authorized engineering staff.

Bookly is intended for use by businesses and adult consumers. We do not knowingly collect data from anyone under 13 years of age. If you believe we have inadvertently collected such data, contact us and we will delete it.

We may update this policy from time to time. Material changes will be announced via email to registered business owners. The “Last updated” date at the top of this page always reflects the current version.

For any privacy concern, complaint, or data-subject request, email support@bookly.ikieguy.online.