This Privacy Policy explains how Bookline — the booking, website and sales platform for beauty salons available at bookline.pl and panel.bookline.pl, including salon websites created with it — collects, uses, stores and shares personal data, and what rights you have. We comply with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). Polish version: Polityka prywatności.
1. Who we are
Bookline is operated by Jakub Kaźmierczak, trading as NexuStudio, address: Kniejowa 1, 89-500 Tuchola, Poland, e-mail: kontakt@bookline.pl, phone +48 696 575 039 ("we", "us", "Bookline"). For any privacy question, contact kontakt@bookline.pl.
2. Salon data and salon customers' data
- We are the controller of the data of salons using Bookline and of their team members who have access to the Bookline panel (owners, staff), as well as of people who contact us.
- We are a processor of the data of salon customers (people who book appointments). The salon is the controller of that data and we process it on the salon's behalf under a data processing agreement. See section 5.
3. What data we collect, why and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running a salon account, signing in, using the panel | name, e-mail, phone, salon name and address, password (stored only as a hash), team member accounts | Art. 6(1)(b) — contract |
| Subscription and template purchases | billing details and payment history; card details are processed only by Stripe — we never see them | Art. 6(1)(b) and (c) — contract, tax obligations |
| Account e-mails (address confirmation, payments, changes to terms, outages) | e-mail, salon name | Art. 6(1)(b) and (f) |
| Google Calendar integration (only if the salon turns it on) | described in section 4 | Art. 6(1)(b) — providing a feature the salon requests |
| Security (sign-in, abuse and bot protection, audit log) | IP address, browser information, time and type of actions | Art. 6(1)(f) — legitimate interest in keeping the service secure |
| Proof of acceptance of the terms, this policy and the data processing agreement | date, document version, IP address | Art. 6(1)(c) and (f) |
| Answering messages and complaints, establishing and defending legal claims | correspondence | Art. 6(1)(f) |
We do not sell personal data, we do not use it for advertising and we do not profile users for marketing.
4. Google user data (Google Calendar)
A salon can connect Bookline to its Google account in the panel (Settings → Google Calendar). Bookline then adds appointments to the Google Calendars of the salon's team members, and busy times in Google Calendar block online bookings at those times. Connecting is optional and can be disconnected at any time.
Google OAuth scopes we request and why:
- openid, email — to show in the panel which Google account is connected;
- https://www.googleapis.com/auth/calendar.calendarlist.readonly — to list the calendars the account can write to, so the salon can choose which calendar each team member's appointments go to;
- https://www.googleapis.com/auth/calendar.events — to create, update and delete the events of appointments booked in Bookline, and to check when a calendar is busy.
Google user data we access:
- the e-mail address of the connected Google account;
- names and IDs of calendars the account can write to;
- for availability checks — only the start and end time, status, transparency and ID of events. We do not read the titles, descriptions, attendees, locations or attachments of events that were not created by Bookline.
Data we write to Google Calendar: appointment events created by Bookline — service, customer name, customer phone, appointment notes and add-ons — plus the Bookline appointment ID, so that the event can later be updated or removed.
How we use Google user data: only to provide the Google Calendar integration described above — syncing appointments to the salon's calendars and preventing double bookings. We use it for no other purpose.
How we store and protect Google user data:
- the OAuth refresh token is stored encrypted (AES-GCM) on our server in the EU and is used only for this integration;
- busy time ranges are kept only temporarily to calculate available booking slots and are refreshed continuously;
- all traffic between Bookline and Google is encrypted (HTTPS).
Sharing of Google user data: we do not sell, rent or share Google user data with third parties, except our hosting provider (Hostinger, EU data centre), which stores it on our behalf, and where required by law.
Retention and deletion of Google user data:
- we keep the connection until the salon disconnects Google Calendar in the panel or closes its Bookline account;
- when the salon disconnects, we revoke the token with Google and delete the connection data from our database immediately; account closure deletes it within 30 days;
- you can also revoke Bookline's access at any time at myaccount.google.com/permissions, or ask us to delete the data by writing to kontakt@bookline.pl.
What we never do with Google user data:
- use it for advertising, including retargeting or personalised ads;
- sell it or transfer it to data brokers or information resellers;
- use it to determine creditworthiness or for lending purposes;
- use it to develop, improve or train generalised or non-personalised AI or machine-learning models;
- allow humans to read it, unless the salon explicitly asks us to (e.g. for support), it is necessary for security purposes such as investigating abuse, or it is required by law.
Bookline's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Data of salon customers
When you book an appointment at a salon that uses Bookline, your data (name, phone, e-mail, appointment time and service, notes, visit history, deposit information) goes to that salon, which is its controller. Please contact the salon first about access, correction or deletion. We process the data on the salon's behalf: we store it, send booking confirmations and reminders by e-mail in the salon's name and, if the salon uses it, sync appointments to its Google Calendar.
To protect salons from fake bookings we store a keyed hash of the IP address (not the address itself) with online bookings and check simple signals, such as a form filled in very quickly or a disposable e-mail address. Such bookings are not rejected automatically — they are only flagged for the salon to review. We may also limit how many upcoming bookings one e-mail address or phone number can have. We do not make decisions producing legal effects solely by automated means.
Deposits are collected by the salon through its own Stripe account; card details are processed by Stripe.
7. Transfers outside the EEA
Bookline's servers and database are in the European Union. Some providers (e.g. Stripe, Google) may process data outside the European Economic Area, in particular in the USA, on the basis of an adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
8. How long we keep data
- salon account data — while the account is active and up to 30 days after it is closed, then deleted;
- Google Calendar connection — until disconnected or until the account is closed (see section 4);
- billing records — 5 years from the end of the year in which the tax obligation arose;
- proof of acceptance and audit log — until legal claims become time-barred;
- server logs with IP addresses — up to 90 days;
- correspondence — until the matter is closed, or until related claims become time-barred.
9. How we protect data
- all connections are encrypted (HTTPS);
- passwords are stored only as hashes; integration keys and tokens (Google, Stripe, SMTP) are encrypted;
- each salon sees only its own data, and team members only the parts of the panel the owner gave them;
- administrative access is protected with two-factor authentication.
10. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, data portability and to object to processing based on legitimate interest. Write to kontakt@bookline.pl — we reply within one month. You can also lodge a complaint with the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
12. Changes to this policy
We will update this policy when the way we process data changes and will notify salons of material changes by e-mail and in the panel in advance. Current version: 2026-11, effective from 2 November 2026. If the Polish and English versions differ, the Polish version prevails.