Privacy Policy

Last updated: October 21, 2026 · Effective date: October 21, 2026

1. Introduction

This Privacy Policy explains how iBooker.online (“we”, “us”, “our”), operated by Antreprenor Independent · IAROSLAV IASINSKI (IDNO: 1026023037338), accessible at ibooker.online, collects, uses, and protects information when you use our Service. By using iBooker.online, you agree to the practices described in this Policy.

2. Who We Are

iBooker.online is an independent conversion tracking tool for Square Appointments. We are not affiliated with Square, Block, Inc., Google, Meta, or Polar. We act as a data processor on your behalf — we relay booking event signals to the analytics platforms you configure.

3. What Data We Collect

3.1 Account Data

When you register, we collect:

• Your email address
• Your name (if provided)
• Your subscription plan and billing status (managed by Polar)

3.2 Integration Configuration Data

When you connect your Square account and configure tracking, we store:

• Your Square OAuth access token (encrypted)
• Your GA4 Measurement ID and/or Meta Pixel ID
• Your project settings (location preferences, configured events)

We do not store your Square password. Ever.

3.3 Event Relay Data (Transient)

When a booking event occurs, we briefly process the following data in memory to relay it to your configured analytics platform:

• Event type (e.g. purchase, begin_checkout)
• Service name and price
• Location name
• Staff name
• Booking ID
• Currency and duration

This data is not written to any persistent database. It passes through our system and is sent immediately to Google or Meta on your behalf.

3.4 Technical and Usage Data

We may automatically collect:

• IP address
• Browser type and version
• Pages visited within the Service
• Date and time of access
• Referrer URL

This data is used solely for security, debugging, and service improvement.

3.5 Saved Waitlist Requests and Saved Bookings (Optional, Off by Default)

If — and only after — a business turns one of these features on in its admin and explicitly agrees to it, we store, on that business's behalf:

• Saved waitlist requests: for each waitlist request made on its booking page, the client's name, email address and phone number, the requested service, preferred dates and times, and any specialist or location chosen.
• Saved bookings: for each booking made through its booking page or widget, the client's name, email address, phone number and other details entered on the booking form; the booked services, time, location and price; and where the booking came from — campaign and UTM parameters, ad click identifiers, analytics cookie identifiers (such as the Google Analytics client ID and Meta browser and click IDs), the landing, booking and referring pages, and the browser's user agent.

The business is the controller of this data and we act as its processor (see Section 7 of our Terms of Service). The data is visible only to the business and the teammates it gives access to, is never sold or used for our own marketing, and is deleted when the business deletes it, turns the feature off, or deletes the project — and in any case after 12 months. We keep a record of when, and from which account, the feature was turned on or off. Clients who want to access or delete their details should contact the business they booked with or joined the waitlist of; we will assist the business with such requests.

4. What Data We Do NOT Collect

We want to be explicit about what we never collect or store:

• Your customers' personal data (names, emails, phone numbers) — except saved waitlist requests and saved bookings, only if you turn those features on (Section 3.5)
• Your customers' payment card information
• Full appointment history or booking records
• Your Square account password or secret keys
• Any data beyond what is listed in Section 3

Apart from that optional feature, your customers' data lives within Square's platform, governed by Square's own Privacy Policy.

5. How We Use Your Data

We use the data we collect to:

• Provide and operate the Service
• Authenticate your Square account via OAuth
• Relay conversion events to your configured analytics platforms
• Send you transactional emails (account confirmation, subscription receipts, service notices)
• Respond to your support requests
• Detect and prevent fraud, abuse, or security incidents
• Comply with legal obligations

We do not sell, rent, or share your personal data with third parties for advertising or marketing purposes.

6. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contract performance — to provide the Service you signed up for
• Legitimate interests — to maintain security, prevent abuse, and improve the Service
• Legal obligation — to comply with applicable laws
• Consent — where you have explicitly provided it (e.g. marketing communications)

7. Data Sharing, Subprocessors and Third Parties

We do not sell your data, or your customers' data, to anyone. Data leaves our systems only as described below.

7.1 Subprocessors

These providers process data on our behalf, only to run the Service, under their own terms of service and data-protection commitments:

We will update this list before adding a new subprocessor; the “Last updated” date above shows the latest change.

7.2 Platforms you connect

These are not our subprocessors: they are services you choose to connect, and we send data to them only on your instruction, under your own account and their own policies. You are responsible for your use of them.

• Square (Block, Inc.) — your booking platform. We connect via Square's official OAuth API; bookings and customer records are created in, and live in, your Square account.
• Google (Google Analytics 4, Google Ads) — if you add your Google tags, booking events are sent to them.
• Meta (Meta Pixel, Conversions API) — if you add your Pixel or turn on the Conversions API, booking events are sent to Meta; with the Conversions API they include your customer's details in hashed form.
• TikTok and OpenAI Ads — if you add their pixels, booking events are sent to them.
• WhatConverts — if you connect it, each booking is sent to your WhatConverts account as a lead, with the customer's contact details and where the booking came from.

8. Data Retention

After account deletion, all your data is permanently removed within 30 days.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of OAuth tokens at rest
• HTTPS/TLS encryption for all data in transit
• Access controls limiting who can access production systems
• Regular security reviews

However, no system is 100% secure. We cannot guarantee absolute security and are not liable for unauthorized access resulting from circumstances beyond our reasonable control.

10. Your Rights (GDPR / EEA Users)

If you are located in the EEA or UK, you have the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data (“right to be forgotten”)
• Restriction — request that we limit processing of your data
• Portability — request your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at team@ibooker.online. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

11. Cookies

We use cookies that are necessary to operate the Service:

• Session cookies — to keep you logged in
• Security cookies — to protect sign-in and verification steps
• Booking-page cookies — to keep a customer's phone verification during their visit

On our own website (ibooker.online's marketing pages and the admin) we also use Google Tag Manager with Google Analytics, and the Meta Pixel, to measure visits and sign-ups. These set their own cookies (such as _ga and _fbp). They are not loaded on businesses' booking pages.

On booking pages, any analytics or advertising tags are the business's own (see Section 7.2). Our booking widget reads the identifiers those tags already set (such as _ga, _fbp and _fbc) only to attribute a booking to its source, and stores them only if the business turned on Saved bookings (Section 3.5). Asking visitors for any consent those tags require is the responsibility of the business that runs them.

You can block or delete cookies in your browser settings, but this may affect the functionality of the Service.

12. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at team@ibooker.online and we will delete it promptly.

13. International Data Transfers

Your data may be processed on servers located outside your country of residence. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR requirements (e.g. Standard Contractual Clauses).

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. The latest version is always available at ibooker.online/privacy. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

15. Contact

For any privacy-related questions, requests, or complaints:

This Privacy Policy was last updated on June 2, 2026.