Legal

Privacy & data use policy

Effective April 15, 2026 · Governed by PIPEDA and applicable Ontario law

In plain language: You share booking and revenue data with Booked & Banked so we can identify recoverable revenue in your business. We store it securely, we do not sell it, and if it ever informs a benchmark or industry insight, it is fully anonymized first. We also use AI tools to assist with analysis and report-building — your data is anonymized before it touches those tools.

1. What we collect

When you engage Booked & Banked, you share business data exported from your booking system. This typically includes:

Appointment records: dates, service types, amounts, and outcomes (completed, cancelled, no-showed)
Client visit frequency and rebooking behaviour — no client names, emails, or contact details are required or requested
Aggregate revenue figures and service-level breakdowns
Business context shared during intake or strategy calls (team size, operating model, goals)

We do not collect, require, or retain your clients' personal information. If your booking system export contains client names or contact details, you are asked to remove or anonymize them before submission.

2. Website forms

This website uses Netlify Forms to process submissions from the intake form and the revenue leak calculator. When you submit a form, the information you provide is transmitted to and stored by Netlify on our behalf, and is used only to respond to your enquiry. Form submissions are not sold or shared with third parties for marketing purposes.

3. How we store your data

Engagement data is stored in a private, access-controlled Google Drive folder created specifically for your engagement. Access is protected by two-factor authentication at the account level.

Data is retained for the duration of your active engagement plus twelve (12) months. After that period, your files are permanently deleted unless you request otherwise in writing.

4. Use of AI tools in analysis

We use AI-assisted tools as part of the analysis, report-writing, and dashboard development process. Before any data is processed through these tools, it is anonymized — all business names, owner names, location identifiers, and any other identifying details are removed.

What this means in practice

The data file shared with AI tools contains no business name, owner name, location, or identifying context
We do not input prompts that name your business or describe identifiable details
The underlying data file remains within our controlled Google Drive environment
AI-generated outputs are reviewed, verified, and edited before delivery to you

5. How we use your data

For your engagement

Your data is used to conduct the analysis you have commissioned: retention calculations, cancellation leakage quantification, lifetime value analysis, service mix review, and related diagnostics.

For industry benchmarking

Patterns across multiple client engagements allow us to build more accurate benchmarks over time. If your engagement data contributes to any benchmark shared externally, it will be:

Fully anonymized — no business name, owner name, location, or identifying detail included
Aggregated with data from multiple other engagements, never reported as a standalone case
Presented only as a range or pattern, not a specific figure traceable to your business

6. What we will never do

Sell, rent, license, or transfer your individual business data to any third party
Share your data in a form that could identify your business without your explicit written consent
Use your data to contact, market to, or profile your clients
Provide your specific data to competitors in your local market
Retain your data beyond the stated 12-month period without your written instruction

7. Your rights

You may, at any time, contact us at josh@bookedandbanked.ca to:

Request a copy of all data and files held in connection with your engagement
Request deletion of your data before the standard 12-month retention period
Opt out of your anonymized data contributing to future industry benchmarks
Withdraw consent for ongoing data storage

Requests will be acknowledged within 5 business days and fulfilled within 10 business days.

8. Applicable law

This privacy policy is governed by Canada's federal privacy legislation (PIPEDA) and applicable Ontario provincial law. Questions? Email josh@bookedandbanked.ca.