This Privacy Policy explains how 1MinuteBooking ("1MinuteBooking", "we", "us", "our") handles personal data collected through 1minutebooking.com and every business booking page hosted on it (together, the "Service").
Two kinds of people interact with the Service, and our role is different for each:
| Who | What data | Our role |
|---|---|---|
| Account Holders — businesses that register for 1MinuteBooking to run their own booking page | Account, billing, and settings data described in Section 2 | We are the data controller: we decide how this data is used to operate and improve the Service. |
| Clients — people who book an appointment through an Account Holder's public booking page | Name, contact details, appointment details, and anything else the Account Holder's booking form collects | The Account Holder is the data controller; we act only as their data processor / service provider, storing and processing this data solely to operate that Account Holder's booking page and deliver the Service to them. |
If you are a Client and have a question about how your information is used, please contact the business you booked with first — they control that data and are responsible for their own privacy practices toward you. We're happy to assist or forward a request; see Section 12.
a. Account Holders (businesses). When you sign up, we collect:
b. Clients (the people who book through your page). When someone books an appointment on an Account Holder's booking page, we collect on that Account Holder's behalf:
If the Account Holder has not turned on the optional Stripe Payments feature, 1MinuteBooking does not collect or process payment card details from Clients at all — how a Client pays the business (cash, card reader, a payment link, etc.) is arranged directly between the Client and the Account Holder, outside the Service. If the Account Holder has turned Stripe Payments on, a Client's card details are entered directly into a payment form provided by Stripe and go straight to Stripe — they never pass through or get stored on 1MinuteBooking's own servers. See Section 7 for Stripe's role as a service provider in that case.
c. Automatically, from anyone using the Service. Standard web server request logs (IP address, browser/device information, requested page, timestamps), and the strictly-necessary cookies described in Section 6 (see Section 6).
We do not sell personal data, and we do not use Client or Account Holder data for advertising or behavioral profiling. We run no third-party analytics or advertising trackers on the Service.
To keep booking pages free of spam and abusive requests, each booking and quote request is automatically checked for whether its originating IP address looks like a VPN or proxy. This check is on by default; an Account Holder can turn it off for their own booking page, in which case no VPN/proxy lookup of any kind is made for submissions to that page. We first send that IP address (and nothing else — no name, email, or booking details) to a third-party VPN-detection service, IPHub (iphub.info), which returns a verdict. If IPHub is unavailable or out of quota, we fall back to a local, offline database (MaxMind GeoLite2) that runs entirely on our own servers and shares nothing with any outside party. We keep a short-lived cache of recent verdicts per IP address to avoid repeat lookups, and a log of each check (the IP address, the verdict, and the network/ASN details returned) so we can review spam-screening accuracy and usage.
The IP address a booking was submitted from is stored with that booking and shown to the Account Holder who received it, so they can mark it as spam. When they do, later booking and quote requests to that Account Holder from the same IP address (or, for IPv6, the same /64 network) are filed as spam for them automatically and no notification email is sent about them. Each Account Holder's list of spam IP addresses applies only to their own booking page, can be edited by them at any time, and is deleted along with their account.
We also look up the country each submission's IP address appears to be in, using a local, offline database (MaxMind GeoLite2) on our own servers — no outside party is contacted for it. That country is stored with the booking and shown to the Account Holder. An Account Holder can list countries, and words or phrases, that they treat as spam: a submission from a listed country, or containing a listed word in any field the Client typed, is filed as spam for that Account Holder in the same way. Where an Account Holder takes card payments through Stripe, they can also require bank verification (3-D Secure) for a payment that comes from a VPN/proxy or from one of their spam countries. These lists apply only to that Account Holder's own booking page.
Separately, during an Account Holder's first-time setup only, if their account doesn't already have a currency chosen, we look up their own IP address against that same local database once to determine their approximate country, so we can pre-select a likely currency (US → USD, Canada → CAD) for them to confirm or change - it's never chosen for anyone automatically, just suggested. This is a one-time, best-effort convenience, unrelated to the spam/fraud check above; it's skipped entirely once a currency is already set. Unlike the booking check above, this lookup uses only the local database and never leaves our own servers - no outside party is contacted for it.
The same one-time setup step also uses that IP address, against the same kind of local database, to suggest a time zone and a tax rate for the Account Holder's approximate region. Like the currency, these are only suggestions to confirm or change, and nothing is sent to any outside party.
hCaptcha is used on our email sign-up form, and on booking pages as an extra layer of spam protection. On a booking page it is on by default, and the Account Holder can turn it off or change when it appears. Where it is shown, hCaptcha (operated by Intuition Machines, Inc.) processes limited technical and interaction data from the Client's browser to verify they're human, under its own privacy policy, available at hcaptcha.com/privacy. We do not control what hCaptcha does with that data beyond what its policy describes.
We set only strictly-necessary cookies of our own: a session cookie that keeps an Account Holder logged in to their dashboard and expires after a short period of inactivity, and, when you sign in with an emailed link, a short-lived cookie that confirms the link is being opened in the same browser that requested it. Neither is used for tracking, advertising, or analytics.
Two third-party services that run on some pages may set their own strictly-functional cookies or use browser storage, under their own policies: hCaptcha, where a captcha is shown, and Stripe, where a booking page takes card payments. We do not run any third-party analytics, advertising, or social-media tracking scripts on the Service.
We do not sell or rent personal data to anyone. We share data only as follows:
We retain account, booking, and client data for as long as an account remains active, so that Account Holders have a continuous booking history and their Clients' details are available for future appointments. Account Holders can delete individual bookings, clients, blackout dates, and other records directly from their dashboard at any time, and, on the Pro plan, can export their booking history to Excel before removing anything. Bookings an Account Holder marks as spam are deleted automatically 30 days after they are marked, together with any client record that existed only because of them (one tied to a card payment is kept until the Account Holder deletes it).
Operational logs — VPN/proxy checks, address searches, email-address checks, help-chat questions and payment events (which can include IP addresses, email addresses and, for address search, the text typed) — are each limited to the most recent 2,000 entries, with older entries removed automatically. Entries linked to an Account Holder's account are also deleted along with that account, except help-chat questions, which are kept without the account link. Short-lived caches of recent VPN verdicts and address suggestions are held in memory only and are not retained.
Account Holders can delete their account, and everything in it, themselves at any time from Settings > Account (Delete my account), or by contacting us using the details in Section 15. Deletion is permanent. The free-trial record described in Section 2 is kept, copies in our backups may persist for a limited period before they are overwritten, and we may retain limited information where required for legitimate business purposes such as fraud prevention, dispute resolution, tax, or other legal obligations.
We use reasonable technical and organizational measures to protect the data in our care, including: no password storage at all (you sign in with Google or a one-time emailed link), hardened session cookies, and access controls limiting what platform administration can view. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.
Our servers and service providers may be located in a different country than you. By using the Service, you understand that your information may be processed in, and transferred to, other jurisdictions with data protection laws that may differ from those of your own country.
The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Account Holders can exercise most of these rights directly from their dashboard (editing or deleting clients, bookings, and settings, deleting their account, or, on the Pro plan, exporting data to Excel). For anything else, or if you're a Client wanting to exercise these rights, contact us at the address in Section 15 and we will respond, or route your request to the relevant Account Holder where they are the controller of your data, within a reasonable time and as required by applicable law.
Because we don't run tracking or advertising technologies on the Service, there is nothing to disable, and we do not currently respond differently to browser "Do Not Track" signals.
We may update this Privacy Policy from time to time. We'll update the "Last updated" date above, and where changes are material, we'll provide additional notice (such as an in-dashboard message or email). Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.
Questions about this Privacy Policy or how your data is handled? Reach us at [email protected].