Legal
Privacy Policy
Last updated:
This Privacy Policy describes how OnPointBooking, LLC (“Company,” “we,” “us,” or “our”) collects, uses, and discloses personal information. OnPointBooking is used by two kinds of people: business owners who create an account to run their cleaning business on our platform, and customers who submit a booking through a business owner’s public booking page, without ever creating an account of their own. This policy covers both.
We do not sell your personal information or share it for cross-context behavioral advertising. We do not use analytics or advertising tracking scripts of any kind.
1. Personal Information We Collect
The table below outlines the categories of Personal Information we collect, the business purposes for collection, and our data retention periods.
| Category | Specific Examples | Business Purpose | Retention Period |
|---|---|---|---|
| Business Owner Identifiers | Owner name, business name, email address, phone number, account login credentials, time zone. | To create and manage your account, operate your public booking page and dashboard, and communicate with you. | Active account, plus up to 60 days after trial expiry or 30 days after cancellation. |
| Customer Identifiers | Name, phone number, service address, email address (optional) — collected when someone books an appointment. Customers are not required to create an account. | To create, confirm, and manage a booking, and to notify the customer of its status. | Tied to the business's account — removed when that business's account is deleted. |
| Commercial Information | Services booked, pricing, appointment dates/times, booking status, subscription plan and status, Stripe customer and subscription reference IDs. | To deliver bookings, calculate pricing, and manage subscription billing. | Same as the identifiers above; Stripe separately retains its own records per Stripe's policies. |
| Technical / Security Data | IP address (used only for rate-limiting and abuse prevention), general error and crash diagnostics. | To keep the platform secure, prevent abuse, and fix bugs. | Rate-limit counters expire automatically within minutes to hours. Error diagnostics are retained per our error-monitoring provider's policy (IP addresses are not collected there — see Section 4). |
| Account Security Data | Password (stored only as a secure hash, never in plain text). | To authenticate you and keep your account secure. | Active account lifecycle. |
| Fraud-Prevention Record (Trial History) | Email address, the name of the first business created with it, and the date a free trial was granted. | To prevent an email address from receiving more than one free trial. | Permanent — retained even after the associated account is deleted. See Section 5. |
2. Sources of Personal Information
We collect the categories of Personal Information listed above from the following sources:
- Directly From Business Owners: When you sign up for an account, configure your dashboard settings, or contact our support team.
- Directly From Customers: When a customer fills out the booking form on a business owner’s public booking page. No account or login is required to submit a booking.
- Automatically: We log your IP address on incoming requests solely to enforce rate limits and prevent abuse. We do not use cookies, analytics, or advertising tracking technology of any kind.
3. Cookies and Local Storage
OnPointBooking does not use cookies. We store two small pieces of data directly in your browser’s local storage, neither of which is transmitted to any advertising or analytics network:
- Your login session, so you stay signed in to your dashboard.
- Your light/dark display preference.
4. How We Disclose Personal Information
We do not sell personal information. We share it only with the service providers below, each of whom is bound by contract to use it solely to provide services to us:
Stripe
Payment & Subscription Processing
Hosts our checkout and billing-portal pages directly and stores your payment card details. We never receive or store your card number, CVV, or expiration date — only a reference to your Stripe customer and subscription.
Supabase
Database & Authentication
Hosts our production database and manages login/authentication for business owner accounts.
Vercel
Application Hosting
Hosts and serves the OnPointBooking application, including scheduled background jobs.
Resend
Transactional Email
Sends every account, booking, and billing email on our behalf — verification links, booking notifications, and trial/payment reminders.
Upstash (Redis)
Abuse Prevention & Caching
Temporarily stores rate-limiting counters, keyed by IP address and automatically expiring within minutes to hours, plus short-lived pricing lookups. Does not receive customer names or booking details.
Sentry
Error Monitoring
Receives technical error reports when something breaks, to help us diagnose and fix it. Configured not to collect your IP address or browser cookies.
5. Trial History — A Permanent Fraud-Prevention Record
To prevent a business from repeatedly claiming a new 30-day free trial, we keep a minimal permanent record whenever a trial is granted: the email address used, the name of the first business created with it, and the date the trial began.
This record is kept separately from your account and is not deleted when your account is deleted — including in response to the account-deletion process described in Section 6, or a data-deletion request submitted under Section 8. It exists solely to be checked against future signups, and we retain it under our legitimate business interest in preventing abuse of the free-trial offer.
This record is never used for marketing and is never shared with any third party. It does not include your name, phone number, business details, or any booking data — only the email address, the first business name, and the trial-start date.
6. Account Deletion and Data Retention
If a free trial ends without a subscription, the account is permanently deleted 60 days later unless the owner subscribes. If a paid subscription is canceled, the account is permanently deleted 30 days after cancellation unless the owner resubscribes.
What is deleted: the Stripe customer record, all bookings, pricing and discount settings, blocked/unavailable time settings, the business profile, the subscription record, and the login credentials.
What is not deleted:
- The minimal fraud-prevention record described in Section 5 (Trial History) — retained permanently, by design.
- Records Stripe independently retains for its own tax, accounting, and regulatory obligations, which are outside our control.
- Error-diagnostic data already sent to our error-monitoring provider before deletion (which, per our configuration, does not include IP addresses — see Section 4).
- Email-delivery records our email provider retains under its own data-retention policy.
Deleted data may also persist briefly in routine, automated database backups until those backups are overwritten in the normal course of our backup cycle — we do not selectively purge individual accounts from backups.
7. Security
We use technical safeguards appropriate to the information we hold, including:
- Passwords are hashed and never stored in plain text.
- Every business’s data is isolated at the database level (row-level security), so one business cannot query or access another business’s bookings or customer information.
- All traffic is encrypted in transit (HTTPS/TLS).
- Rate limiting on every public-facing endpoint to deter automated abuse.
- Server-side authorization checks on every account-management action — a valid login session alone is not enough to modify another business’s data.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
8. Consumer Privacy Rights for California Residents
California Consumer Privacy Act (CCPA)
If you are a resident of California, the CCPA grants you specific, actionable legal rights over your personal data:
Right to Know and Access
You have the right to request a copy of the personal information we have collected about you.
Right to Delete
You have the right to request that we delete personal information we hold about you, subject to the limited exceptions described in Section 6 (Trial History, third-party regulatory records, and routine backups).
Right to Correct
You have the right to request that we correct inaccurate personal information we hold about you.
Right to Limit Sensitive Data
The only Sensitive Personal Information we hold is your account password, used strictly for authentication. Because we do not use it for any other purpose, we are not required to offer a separate "Limit the Use of My Sensitive Personal Information" link.
Right to Non-Retaliation
We will never deny services, alter price tiers, or discriminate against you for exercising your consumer privacy rights.
Do Not Sell or Share My Personal Information
We do not sell or share your personal information with third parties for cross-context behavioral advertising purposes. No opt-out is required, but you may submit a Privacy Request at any time.
9. How to Exercise Your Rights
To exercise any of your rights under the CCPA or applicable law, please submit a verifiable consumer request through one of the following channels:
We will respond to verified consumer requests within 45 days of receipt.
10. Children’s Privacy
Our Services are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at support@onpointbooking.com and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date at the top of this page. Continued use of the Services after changes take effect constitutes acceptance of the revised policy.
Contact Us
If you have questions about this Privacy Policy or our data practices, contact us at support@onpointbooking.com.