Legal

Privacy policy

Last updated: 6 October 2026

This English version is a courtesy translation. In the event of any discrepancy, the Spanish version shall prevail.

This policy explains how BookingForNow (hereinafter, “the Platform”) processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

  • Controller: David Suárez Marra
  • Tax ID (NIF/CIF): 53504952Y
  • Address: Calle José Hierro 6, portal 1, 5.º A, 28702 San Sebastián de los Reyes (Madrid), España
  • Contact email for data protection matters:soporte@bookingfornow.com

2. Data we process

About the person or company that subscribes to the Platform: business name, your name if you provide it when signing up (used to greet you and as the first professional in the calendar), email address, password (stored encrypted by our authentication provider), business sector if provided, the account’s language, country, time zone and currency (inferred from your browser), service usage data and the origin of the visit with which you arrived when signing up (see section 4).

About the end clients managed by the business: the contact and appointment details that the business enters or that are collected through its online booking page. For this data, the business acts as the data controller and the Platform as the data processor, processing it solely on the business’s instructions, under the data processing agreement included in the Terms and conditions (section 9).

Payment data: subscription payments are processed entirely through Stripe. The Platform does not store card numbers or financial payment details; we only keep the identifiers and subscription status needed for billing.

3. Purposes and legal basis

  • Providing the service and managing the account — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Billing and management of subscription payments — legal basis: performance of a contract and compliance with legal obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
  • Operational and support communications (service notices, reminders) — legal basis: performance of a contract and legitimate interest (Art. 6(1)(f) GDPR).
  • Marketing emails to people who sign up (tips and offers about BookingForNow during the trial and when it ends) — legal basis: legitimate interest (Art. 6(1)(f) GDPR), as they concern products or services similar to those contracted (Art. 21(2) of Spanish Law 34/2002, LSSI). You can object when you sign up (checkbox on the sign-up form), at any time with the unsubscribe link in each email, or by writing to soporte@bookingfornow.com.
  • Security and prevention of fraud and abuse — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Aggregate measurement of site usage (see section 4) — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Knowing which channels bring sign-ups (sign-up origin, see section 4) — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Compliance with legal obligations — legal basis: Art. 6(1)(c) GDPR.

4. First-party analytics and sign-up origin

We measure visits with our own system, hosted on our servers: we do not use Google Analytics or any third-party tool, and we do not set cookies or persistent identifiers for this purpose. For each page visited we record the path (without parameters), the referring domain, the browser language, the approximate country, the device type (mobile, tablet or computer), the campaign parameters (UTM) and, only when you are signed in, the business the account belongs to.

To count unique visitors per day, the server calculates an anonymous fingerprint from a key that changes every day, the IP address and the browser. The IP address is not stored, and the fingerprint cannot be used to recognise the same person from one day to the next or to reconstruct their identity.

This measurement is automatically disabled if your browser sends the Do Not Track or Global Privacy Control signal.

Sign-up origin. When an account is created, the origin of the visit with which the session started is stored with it: the campaign parameters (UTM), the link’s referral code (“?ref”), if it had one, the referring domain and the landing page, without parameters. Until sign-up, the browser keeps it only for the duration of the visit (session storage, see the Cookie policy), and it is not sent if your browser sends either of the signals above. We use it to know which channels bring businesses to the Platform, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). It is not used for profiling or to make decisions about your account, it is not disclosed to third parties and it is kept in the audit log, which is deleted after 3 years (section 6). You can object by writing to soporte@bookingfornow.com.

5. Recipients and data processors

To provide the service we rely on the following providers, which act as data processors under their respective data processing agreements:

  • Supabase — database and authentication (hosting of account and appointment data).
  • Stripe — payment processing and subscription management.
  • Resend — sending of emails (transactional and, to people who sign up, marketing).
  • Vercel — hosting of the web application.
  • Cloudflare — content delivery network (CDN) and anti-bot verification (Turnstile).

We do not sell or disclose personal data to third parties for advertising purposes.

6. Data retention

We keep the data while the account remains active and, after it is cancelled, for the legally required periods (for example, tax and accounting obligations). Once those periods have elapsed, the data is deleted or anonymised. In addition, the Platform automatically applies the following periods:

  • Log of emails sent (confirmations, reminders and other notices): after 12 months each entry is anonymised (the recipient, subject and other details are removed), and after 3 years it is deleted. Trial-period notices sent to the account holder are not anonymised earlier, because they are used to avoid sending them twice, and are also deleted after 3 years.
  • Audit log (which changes were made to the account and by whom, and the sign-up origin): deleted after 3 years.
  • Backups: automatic daily backups are kept for 14 days, and those created right before a restore for 30 days. They are stored encrypted.
  • End clients deleted by the business: they are not physically deleted; instead, their record is anonymised (their name, contact details, address, the general remarks on their record and attached documents are removed, their email address is removed from the email logs, and their future appointments are cancelled). Their appointment history, clinical notes and signed consent forms are kept, linked to the anonymised record, because the business, as controller, may be required to retain them (for example, clinical records).

7. Rights of data subjects

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given. To exercise them, write to us at soporte@bookingfornow.com stating the right you wish to exercise. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that the processing does not comply with the regulations.

If you are an end client of a business that uses the Platform, please address your requests to that business, which is the controller of your data.

8. International transfers

Some of our providers may process data outside the European Economic Area. In such cases, the transfers are covered by the safeguards provided for in the GDPR, mainly the Standard Contractual Clauses (SCCs) approved by the European Commission and any appropriate supplementary measures.

9. Contact

For any question regarding this policy, you can write to us at soporte@bookingfornow.com. See also our Cookie policy.