Privacy Policy

Secret Sauce OÜ (registry code 17395646, registered in Estonia) operates the BookedFox website and software at bookedfox.com(collectively, the “Service”). In this Privacy Policy, “BookedFox”, “we”, “us”, or “our” refers to Secret Sauce OÜ as the provider of BookedFox.

This Privacy Policy explains how we collect, use, share, and protect personal information when you visit our marketing website, join our waitlist, create a business account, book a service through a merchant's public booking page, use the crew mobile experience, or otherwise interact with the Service.

We may update this Privacy Policy from time to time. If we make material changes, we will post the revised policy on this page and update the “Last updated” date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

This policy should be read together with our Terms of Service.

This Privacy Policy applies to:

• Website visitors who browse our marketing site or legal pages.
• Waitlist sign-ups who request early access before or during launch.
• Merchants (business owners, admins, dispatchers, and invited team members) who use the owner app, crew tools, or related features.
• End customers who submit booking requests, use a customer portal, or receive communications from a merchant through BookedFox.
• Crew and field workers assigned to jobs through a merchant account.

Privacy laws distinguish between the party that decides why and howpersonal information is processed (the “controller” or “business”) and the party that processes information on someone else's behalf (the “processor” or “service provider”).

• When we act as controller: We decide how to process information relating to our marketing site, waitlist, merchant account registration, billing relationship with merchants, and product analytics where we define the purposes.
• When we act as processor: Merchants use BookedFoxto manage their customers, jobs, and payments. For customer and job data that a merchant enters or collects through the Service, the merchant is the controller and we process that data solely to provide the Service on the merchant's instructions, as described in our Terms of Service.
• Stripe: Payment card processing is handled by Stripe, Inc. Stripe acts as an independent controller (or co-controller, depending on context) for payment data under Stripe's Privacy Policy. BookedFox does not store full payment card numbers.

If you are an end customer of a merchant using BookedFox and wish to exercise privacy rights regarding data the merchant collected about you, please contact that merchant first. We will assist merchants in responding to lawful requests where required.

Merchants must maintain an accurate, accessible privacy notice for their own customers and comply with laws applicable to their business. See our Terms of Service for merchant obligations.

We use personal information to:

• Provide, operate, maintain, and improve the Service
• Authenticate users and enforce role-based access within each merchant organization
• Process booking requests, jobs, schedules, payments, and notifications you or a merchant trigger
• Send transactional emails and, when configured, SMS messages on a merchant's behalf
• Respond to support requests and investigate security or fraud concerns
• Analyze product usage to improve reliability and features
• Comply with legal obligations and enforce our Terms of Service
• Send waitlist updates and, with consent where required, product and launch communications

Where the GDPR or UK GDPR applies, we rely on the following lawful bases (whichever applies to the specific processing):

• Contract: Processing necessary to provide the Service you or a merchant signed up for.
• Legitimate interests: Securing the Service, preventing abuse, improving features, and communicating about the Service in a proportionate way.
• Consent: Waitlist marketing and optional communications where consent is required; you may withdraw consent at any time.
• Legal obligation: Record-keeping, tax, or compliance requirements.

Transactional messages (booking confirmations, reminders, payment links, crew assignments, and similar) are sent as part of the Service when a merchant enables them or triggers them. These are not marketing messages.

Product and waitlist messages from BookedFox may include early-access updates, launch announcements, or feature news. You can opt out of non-essential marketing emails by using the unsubscribe link in any such message or by contacting us at privacy@bookedfox.com.

We use cookies and similar technologies for the following purposes:

• Essential cookies: Authentication and session management (for example, Supabase auth cookies) required to sign in and use the product securely.
• Product analytics: When configured, PostHog may use cookies or local storage to understand how the Service is used across product routes. This helps us measure feature adoption and improve the product.
• Marketing analytics: Google Tag Manager loads only on indexable marketing routes (/, /blog, /privacy, /terms) — not on merchant app, booking, auth, or crew surfaces. Tags configured in GTM (for example, Google Analytics) are subject to those providers' policies.
• Error monitoring: When configured, Sentry may collect diagnostic data about errors to help us fix issues.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from signing in. For Google ad personalization settings, visit Google Ads Settings.

We do not sell personal information.We do not share personal information for cross-context behavioral advertising in exchange for money. California residents: we do not “sell” or “share” personal information as those terms are defined under the CCPA/CPRA.

We share personal information only as described below:

• Service providers (subprocessors) who process data on our behalf under contractual obligations, including:

• Merchants: Customer data you submit through a booking page is accessible to the merchant whose business you booked.
• Legal and safety: When required by law, court order, or to protect rights, safety, and security.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice where required by law.

Secret Sauce OÜ is established in Estonia (European Union). Our service providers may process personal information in the United States, the European Union, and other countries where they operate data centers.

When we transfer personal information from the EEA, UK, or Switzerland to countries that have not received an adequacy decision, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms, where applicable. Contact us for more information about transfer safeguards.

We retain personal information for as long as needed to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

• Merchant accounts: Retained while the account is active and for a reasonable period afterward for backups, disputes, and legal compliance.
• Customer data processed for merchants:Retained according to the merchant's use of the Service and deletion requests; merchants may export or request deletion through their account or by contacting us.
• Waitlist data: Retained until you unsubscribe, we launch publicly, or you request deletion.
• Logs and analytics: Retained for a limited period appropriate to security and product improvement, then deleted or aggregated.

We implement administrative, technical, and organizational measures designed to protect personal information, including encryption in transit (TLS), tenant isolation by organization, and role-based access controls. Job photos are stored in private storage buckets with signed URL access.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. If you believe your account has been compromised, contact us promptly at hello@bookedfox.com.

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal information, object to certain processing, or withdraw consent where processing is consent-based.

To exercise your rights, email privacy@bookedfox.com with enough information to verify your request. We will respond within the timeframe required by applicable law. End customers should contact their merchant first for data the merchant controls.

The Service is intended for businesses and adults. It is not directed to children under 16 (or under 13 in the United States). We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us at privacy@bookedfox.com and we will take steps to delete it.

We may revise this Privacy Policy from time to time. The updated version will be posted at https://bookedfox.com/privacywith a new “Last updated” date. Material changes may also be communicated by email or in-product notice where appropriate.

For privacy questions or to exercise your rights, contact:

Secret Sauce OÜ
Registry code: 17395646
F. R. Kreutzwaldi tn 4-16, Kesklinna linnaosa, Tallinn, Harju maakond, 10120, Estonia
Email: privacy@bookedfox.com

General support (non-privacy): hello@bookedfox.com