Privacy notice
Diarybird is booking software used by businesses that take appointments and bookings — groomers, salons, therapists, trainers, tutors, cleaners, clubs and similar. This notice explains what happens to your information when you book with a business that uses Diarybird, and when you use Diarybird as a member of a business's team.
Who is responsible for your information
If you book with a business, that business is the controller of your information: it decides what it's used for, and it's who you booked with. Diarybird is the business's processor — we store and handle your details on the business's behalf and only on its instructions. The business's name is shown on the booking page and in every email we send for it. For questions about your booking, or to exercise your rights, you can contact the business directly or email us and we'll pass your request on.
If you use Diarybird as a business owner or member of staff, or contact us about Diarybird, we are the controller of your account information.
Diarybird is operated by Chester Relph, trading as Diarybird. Contact: hello@diarybird.com — our postal address is available on request.
If you book with a business
What we hold
- Your name, email address and mobile number.
- Your bookings: service, date, time, number of people, price, anything you tell the business in the notes, and whether you attended.
- Payment records if you pay online: amount, date, card brand and last four digits, and refunds. Card numbers are handled by Stripe and never reach Diarybird or the business.
- Messages sent to you (confirmations, reminders and — only if you agreed — offers) and whether you unsubscribed.
- Technical information needed to keep the booking page secure, such as a one-way hash of your IP address used to limit abuse.
What it's used for, and why that's allowed
| Purpose | Lawful basis |
|---|---|
| Taking, confirming, changing and cancelling your booking; confirmation and reminder emails and texts; contacting you about the booking | Performing the contract you made with the business |
| Taking deposits and payments, refunds, and keeping records the business must keep for tax and accounting | Contract, and the business's legal obligations |
| Keeping your visit history so staff recognise you, and so the business understands how often customers return | The business's legitimate interest in running and improving its business |
| Offers and “we miss you” messages from the business | Your consent — only if you ticked the box when booking or told the business you were happy to hear from it. Every message has a one-click unsubscribe. |
| Preventing spam and fraud on the booking page | Legitimate interest in keeping the service secure |
We never sell your information, never use it for our own marketing, and never share it between different businesses or companies.
If you use Diarybird at a business
We hold your name, username, role, the businesses you can access, and a record of changes you make to bookings (so the business can see who did what). We use this to run your account and keep it secure, under our contract with your employer and our legitimate interest in security.
Who else handles it
We use a small number of suppliers, each bound by a data processing agreement:
- Supabase — database and sign-in (servers in London, UK).
- Vercel — hosting the website (servers in London, UK).
- Resend — sending emails.
- Hostinger — our email inbox, where replies to booking emails can arrive.
- Twilio — sending text messages.
- Stripe — online payments, when the business takes them. Stripe is also a controller of payment information under its own privacy policy.
- Cloudflare Turnstile — checking booking requests come from people, not bots.
Some of these suppliers may process information outside the UK. Where they do, it's protected by the UK's adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long it's kept
- Bookings and customer records: for as long as the business uses Diarybird, unless the business deletes them sooner.
- Payment records: six years, for tax and accounting.
- Security logs of booking attempts: 30 days.
- When a business stops using Diarybird, its data is returned to it on request and then deleted within 90 days.
Your rights
You can ask to see the information held about you, correct it, delete it, restrict or object to how it's used, or receive it in a portable format. You can withdraw consent to offers at any time using the unsubscribe link. Contact the business, or email hello@diarybird.com and we'll help. If you're unhappy with how your information has been handled you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
Diarybird only uses cookies that are essential for it to work. See the cookie policy.