Privacy Policy

1. Who we are

Appoint Me is operated by GK Tools Ltd, a company registered in England & Wales, company number 16434833, registered office 483 Green Lanes, London, N13 4BS. We're registered with the UK Information Commissioner's Office, registration reference ZB899192 (opens in a new tab). This policy covers the Appoint Me booking application at this domain — the booking pages, customer accounts, and business admin panel.

2. Controller & processor — two different roles

This section matters most, so it is set out directly.

Appoint Me is a platform: businesses (“Businesses”) sign up to take bookings from their own customers (“Customers”). That means personal data flows through us in two quite different ways.

When you book an appointment, buy a gift card, or pay a deposit with a Business, that Business decides what data they collect from you and why — they are the data controller for your booking data under UK GDPR. GK Tools Ltd (trading as Appoint Me) is their data processor: we store and handle that data on the Business's instructions, under our Data Processing Addendum, purely to run the booking software. We don't decide how a Business uses your data, and we don't use it for our own purposes — for example, we never use your booking history to market other businesses to you.

For everything else — a Business owner or staff member's own account details, subscription billing, and anyone who visits our marketing pages — GK Tools Ltd is the data controller. In that context this policy works like any standard privacy policy: we're the ones responsible for that data, and you can come to us directly with any request.

3. Information we collect

If you're a Business (owner or staff)

• Name, email address, phone number, and password (stored as a salted hash — we never store it in plain text);
• Business details — name, address, service list, opening hours, staff, locations;
• Subscription and billing information — Stripe handles and stores your card or bank details; we hold only what's needed to manage your subscription (plan, billing history, payment status);
• Language and display-theme preferences;
• Referral information — if another business recommended Appoint Me to you, we record which one and tell that business your business name if you sign up, so we can give you both any referral reward. We do this as a fair and expected part of a recommendation scheme, and you can ask us not to.

If you're a Customer booking with a Business

• Name, email address, phone number;
• Booking details — service, date/time, staff member, any notes you add, and your booking history with that Business;
• If you create an Appoint Me customer account (so you can manage bookings across any Business that uses Appoint Me), your login and account details;
• Deposit or gift-card payments — we see that a payment was made, how much, and which booking or gift card it was for. Your card details go to Stripe, never to us;
• If you review a Business after an appointment: your rating, review text, any photos you add and any video link. Reviews are shown publicly on that Business's booking page, with the name you review under. See our Terms for the rules on reviews.
• Offers and news from a Business: when you book, a Business may ask whether it may send you offers and news by email, or by WhatsApp or text. The boxes are never ticked for you. If you say yes, we record your choice for that Business together with the exact wording you were shown, its language, the date and time, and the IP address and browser used, so that the Business can show that you agreed. We keep this record for six years after your last choice. You can change your mind at any time in your Appoint Me account or through the link in your booking emails; this never affects your appointment confirmations or reminders. A Business in the United Kingdom may instead use the “soft opt-in” for email: the email box then asks whether you do not want its offers and news by email. If you leave it unticked, that Business may email you about services similar to the ones you booked until you say no, every such email lets you unsubscribe, and we record this choice in the same way.

Automatically, from anyone using the Service

• IP address — used to suggest your currency/language on first visit, and for security, fraud-prevention and rate-limiting purposes;
• Standard device/browser information sent by any web request (such as your browser's user agent);
• Cookies and local storage — see the next section.

If you ask for a demo

• Your email address or mobile number, whichever you give us, and your business name if you add it;
• Which demo you opened, the language you read it in, the page that brought you to it, and the country we estimate from your IP address;
• Whether you came back through the link we sent you, and whether you later signed up;
• Which parts of the demo you look at and when you come back, so we know which setup emails to send you. We use this only to sort demo requests; it never decides anything about you automatically;
• A one-way scrambled (hashed) form of your IP address, used only to stop abuse of the form.

4. Cookies & similar technologies

We keep this list honest and short. Nothing here builds a profile of you across other websites, and the only advertising tag is Microsoft Advertising's, which runs only if you accept cookies, and only to measure our own adverts. We do use privacy-friendly analytics to understand how the Service is used; see “Analytics” below for exactly what that means. Here's everything Appoint Me actually sets.

Strictly necessary — the Service can't work without these

Functional

Analytics

We use two analytics tools. Matomo, a privacy-respecting tool we host ourselves, sees roughly how the Service is used. It's configured cookie-free — it doesn't set any cookies and can't identify you personally, so it runs without asking for your consent. Google Analytics gives us a fuller picture, but only ever runs after you actively accept it in the cookie banner; rejecting or ignoring the banner keeps it off, and you can change your mind at any time via “Cookie settings” in the footer. The same consent covers Microsoft Advertising’s tag, which tells us whether our adverts on Bing lead to sign-ups; it sets its own cookies (_uetsid, _uetvid) only after you accept. Separately, if you arrive from one of our adverts, the advert’s click reference and campaign tags in the link are kept with your visit on our server, and stored with your business if you sign up, so we know which adverts bring customers. We pass that click reference on to Microsoft only if you accepted cookies. Nothing else about you is sent with it.

Emails we send you

When we reply to your support requests, the email contains a tiny image, and its links pass through core.gk.tools on the way to where they lead. When you open one of these emails or click a link in it, we record that it happened, when, the app or browser used and your IP address (stored encrypted), so we know our reply reached you. We don’t use this for advertising or to build a profile of you, and it is never shared. If your mail app blocks images, opens are not recorded; links work the same either way. The IP address and app or browser details are deleted after 90 days; the fact that the email was opened or a link clicked, and when, stays with the email record. Lawful basis: our legitimate interest in knowing that our emails arrive.

Opting out of analytics

Google Analytics and Microsoft Advertising only ever run if you accept them — use “Cookie settings” in the footer to change that at any time. Matomo needs no consent because it sets no cookies, but you can still switch it off for this browser using the box below. Your choice is stored on this device only.

Local storage — device-only, never sent to our servers

We also save your colour-theme, light or dark mode, language and currency-display choices in your browser's local storage so the site remembers them next visit. Local storage never leaves your device. It isn't a cookie in the legal sense, and we list it here for completeness. Your colour theme and light or dark choice are also kept in the cookies listed above, so that every Appoint Me page follows them.

Third-party

When you pay by card on Stripe's payment page, Stripe may set its own cookies there to prevent fraud, under Stripe's Privacy Policy (opens in a new tab). Where a form on the Service is protected by reCAPTCHA (see “Who we share data with” below), Google may set its own cookies to do that job — that's governed by Google's Privacy Policy (opens in a new tab), not this one.

You can block or delete cookies in your browser settings at any time. Blocking the strictly-necessary ones will stop the Service working properly — you won't be able to stay logged in, for example.

5. How we use your data

We only process personal data when we have a lawful basis to do so:

• Contract — to create your account, take a booking, process a subscription or deposit, and generally provide the Service you've asked for.
• Legitimate interests — to keep the Service secure (rate-limiting, bot protection, fraud prevention), to understand where bookings come from (tracking links), to run our referral scheme, and to improve the product — always balanced against your rights, and you can object (see “Your rights”).
• Legal obligation — to keep financial records (invoices, subscription payments) for as long as UK tax law requires.
• Consent — where we ask for it specifically. If you ask for a demo, we send Appoint Me news and offers only if you tick that box yourself, and you can withdraw that consent at any time with one click. The demo link and the short setup guide (4 emails over 2 weeks) are sent because you asked for the demo, which is our legitimate interest, and they stop as soon as you unsubscribe.

6. Who we share data with

We don't sell personal data, ever. We share it only with the parties that help us run the Service — and, for our own adverts, with Microsoft Advertising: if you accepted cookies and signed your business up after clicking one of our adverts, we send Microsoft that advert's click reference and when you signed up, so it can count the conversion (see “Cookies” above). The others:

• Stripe — processes subscription payments by card or Direct Debit and stores card or bank details on our behalf, and takes deposit and gift-card payments by card into the Business's own Stripe account. Stripe is PCI-DSS compliant; we never see or store your full card number. Stripe's Privacy Policy (opens in a new tab)
• GK Tools' own banking systems (“gktools-core”) — our internal service that reconciles standing-order and bank-transfer payments (matching a Business's bank payment to the right Appoint Me subscription) and looks up a general location from an IP address to suggest currency/language. It's part of the same company, not an external vendor, but we're telling you about it because it does process payment and IP data. Deposits and gift cards do not pass through it: they are paid by card through Stripe, straight to the Business.
• Google reCAPTCHA — protects sign-up, login and booking forms from bots and abuse. Google's Privacy Policy (opens in a new tab)
• Google Maps (address suggestions) — when a business types an address into a form in its dashboard, what is typed is sent to Google to suggest matching addresses. Nothing is sent until someone types in the field, and only the address is sent. Google's Privacy Policy (opens in a new tab)
• Microsoft 365 (Microsoft Ireland Operations Ltd) — sends the emails the Service needs to send (booking confirmations and reminders, password resets, email verification, sign-in codes), and the demo link and setup guide to anyone who asks for a demo. Used only to deliver those emails.
• Anthropic (Anthropic Ireland, Limited), the maker of Claude, and Google, the maker of Gemini — when someone in our support team asks for a suggested reply to your message, the conversation is sent to Claude or Gemini through that company’s commercial service. It receives your first name, the messages in that conversation and the names of any attachments (never their contents or your email address). Our team reads and edits every suggestion before anything is sent, and under their commercial terms your messages may not be used to train their models. A suggestion is kept with the conversation and deleted with it.
• The assistant in a Business’s dashboard (Anthropic and Google, as above) — a Business can ask it to draft an email to its clients, or to answer a question about using Appoint Me. Drafts and answers are written by Claude (we may switch answers to Gemini instead), through each company’s commercial service. They receive only the Business’s own details (its name, booking link, services, prices and offers, and how many clients an email is for) and what the Business types. They never receive a client’s name, contact details or bookings. The Business reads and edits every draft, and nothing is sent unless it chooses to send it. The providers may not use any of this to train their models, and we keep only a record that the assistant was used and what it cost, never the words.
• Esendex (formerly Esendex), run by Commify UK Limited (company 04217280), data stored in the UK — sends the text messages the Service sends: sign-in codes, the demo link if you give a mobile number instead of an email address, and appointment texts where a Business switches them on. It receives only the mobile number and the text. Esendex keeps message content for 6 months and traffic data, including mobile numbers, for up to 2 years.
• allhost.io — the UK data centre servers Appoint Me runs on.
• Google Analytics — measures how our site is used, and only ever runs after you accept analytics cookies (see “Cookies” above). Google's Privacy Policy (opens in a new tab)
• Sign in with Google or Apple — if you choose to sign in this way, Google or Apple tells us your name, your email address (or an Apple relay address) and an account identifier. When you delete your account we tell Apple to revoke the sign-in.
• Stripe as its own controller — Stripe also uses some payment information for its own fraud-prevention, legal and regulatory duties, which it decides itself rather than on our instructions. Its privacy policy explains this.
• Apple and Google — if you allow notifications in our phone apps, booking messages are delivered through Apple Push Notification service or Firebase Cloud Messaging. They receive the message and the device address, not your account details.
• Google Calendar and Microsoft Outlook — if someone who works at a Business connects their own calendar, we read only when they are busy (start and end times), never what their events are, so customers can't book them at those times. They can disconnect at any time, from the dashboard or from their Google or Microsoft account, and we then delete the busy times we stored.
• An AI receptionist the Business chooses — a Business can connect a third-party AI receptionist so it can tell callers about its services, prices and free times and book them in. That service is chosen by the Business and works for the Business; it sees only what it needs to answer and make the booking, and the Business is responsible for it.
• The Business you book with — that's the whole point of a booking. See “Controller & processor” above.

We'll only share data with anyone else if the law requires it (for example a court order), or if you ask us to.

7. International transfers

Our servers are in the UK. Some of the companies listed above process data outside the UK, mainly in the United States (Stripe, Google, Apple and Microsoft). Where they do, the transfer is covered by safeguards recognised under UK GDPR: the UK Extension to the EU-US Data Privacy Framework where the company is certified under it, and otherwise the ICO's International Data Transfer Agreement or its Addendum to the EU Standard Contractual Clauses. Email us for a copy of the safeguard that applies. An AI receptionist a Business connects processes the booking data it needs wherever that service operates; the Business chooses it, so ask the Business where your data goes. Anthropic and Google, which suggest support replies and power the dashboard assistant, process that data in the United States under their data processing terms, with the same safeguards.

8. How long we keep data

• Business account & subscription data — for as long as your account is active, then for 30 days afterwards, during which you can ask us for a copy of your data, then deleted, except invoices and payment records, which we keep for 6 years from the end of the financial year they relate to, as UK tax law requires.
• Reviews — for as long as the Business keeps its account, unless the review is removed at the Customer's request, or by us under our Terms, for example after we check a report. Closing your customer account does not remove your reviews; ask us to.
• Customer booking data — retained on the Business's instruction, generally for as long as their account is active, or as needed to resolve a dispute or meet a legal obligation. If you ask a Business to delete your data and they no longer have a reason to keep it, we'll action that deletion on their behalf.
• Cookies — as listed in the table above.
• Demo requests — if you ask for a demo and do not sign up, we delete your email address, mobile number and business name 12 months after your last visit. If you unsubscribe, we keep only a scrambled (hashed) copy of the address, so that we never email it again.

9. Keeping data secure

We use industry-standard measures to protect personal data — encrypted connections (HTTPS), hashed sensitive fields (passwords are always hashed, never stored in plain text), access controls so a Business can only ever see its own data, and regular security review of the platform. No system is completely immune to risk, but we take this seriously: if a breach ever occurs we will report it to the ICO without undue delay and, where feasible, within 72 hours, and tell you directly, without undue delay, if it is likely to put you at high risk.

10. Children's data

Appoint Me isn't directed at children. You must be at least 13 to create a customer account, and if you are under 18 please only use Appoint Me with a parent or guardian's agreement. A Business might of course provide services to children — a children's haircut, for example — in which case it's the adult making the booking who provides their own contact details to the Business, not the child's.

11. Your rights

Under UK GDPR you have the right to:

• know what data we (or, for booking data, the relevant Business) hold about you, and get a copy of it — access;
• have inaccurate data corrected — rectification;
• ask for your data to be deleted, where there's no good reason for us to keep it — erasure;
• ask us to restrict or object to certain processing, including anything based on legitimate interests — restriction & objection;
• receive your data in a portable format, or have it sent directly to another provider — portability;
• withdraw consent at any time, where we're relying on it.

To exercise any of these for your own Appoint Me business account, or for your Appoint Me customer account (the login you use to manage bookings across any Business on Appoint Me), contact us directly (below) — we're the controller for both. For a specific booking made with a Business, we'd suggest asking them first — they're the controller for that booking data and can usually act fastest — but you're welcome to come to us and we'll help either way.

12. Our phone apps

Appoint Me and Appoint Me Business, our apps for iPhone, iPad and Android, show the same Service as the website, and everything in this policy applies to them. They add only the following.

• Diagnostics — when the app crashes, a page is slow or fails to load, or a screen is opened, the app sends us a short report: what happened, the page it happened on (never what was typed or shown on it), the app and system version, the phone model, and a random number made up on the phone when the app was installed. It is not linked to your account or used to identify you, and we keep it for 30 days, to find and fix faults.
• Kept on your phone — the pages and photos you open, and your upcoming appointments for the widgets, the Lock Screen and the offline screen, so they still show with no signal. Signing out removes them (the next time the phone has signal), as does deleting the app. None of it is copied to cloud backups: not to iCloud on iPhone and iPad, and not to Google's backup on Android.
• Notifications — if you allow them, the phone gives the app an address for sending you booking messages, which we keep until you sign out.
• No tracking — the apps contain no advertising code and do not follow you across other companies' apps or websites. Usage figures come from our own analytics, without cookies.

To delete your Appoint Me account, see Deleting your account.

13. Changes to this policy

We may update this policy as the Service or the law changes. The version in force is always the one published at this address, dated at the top; material changes will be flagged on the Service.

14. Contact & complaints

Email support@appointme.com or write to GK Tools Ltd, 483 Green Lanes, London, N13 4BS. If you're unhappy with how we've handled your data, you can complain to us at the same address. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you what we have decided and why. You can also complain to the UK Information Commissioner's Office at any time, including if you are not happy with our answer: ico.org.uk/make-a-complaint (opens in a new tab).