Legal

Privacy & Data Use Policy

Effective April 15, 2026 · Governed by PIPEDA and applicable Ontario law

In plain language: You share booking and revenue data with Booked & Banked so we can identify recoverable revenue in your business. We store it securely, we do not sell it, and if it ever informs a benchmark or industry insight, it is fully anonymized first. We also use AI tools to assist with analysis and report-building — your data is anonymized before it touches those tools. Here is what all of that means in practice.

1. What we collect

When you engage Booked & Banked, you share business data exported from your booking system. This typically includes:

Appointment records: dates, service types, amounts, and outcomes (completed, cancelled, no-showed)
Client visit frequency and rebooking behaviour — no client names, emails, or contact details are required or requested
Aggregate revenue figures and service-level breakdowns
Business context shared during intake or strategy calls (team size, operating model, goals)

We do not collect, require, or retain your clients’ personal information. If your booking system export contains client names or contact details, you are asked to remove or anonymize them before submission. We will flag this if it is noticed in a file.

2. Website forms

This website uses Netlify Forms to process submissions from the intake form and the revenue leak calculator. When you submit a form, the information you provide (such as your name, email, business type, and calculator inputs) is transmitted to and stored by Netlify on our behalf, and is used only to respond to your enquiry and prepare for a potential engagement. Form submissions are not sold or shared with third parties for marketing purposes.

3. How we store your data

Engagement data is stored in a private, access-controlled Google Drive folder created specifically for your engagement. Access to all client folders is protected by two-factor authentication (2FA) at the account level, meaning your files cannot be accessed without both a password and a secondary verification step.

Data is retained for the duration of your active engagement plus twelve (12) months, to support any follow-up work or Quarterly Reviews you may elect. After that period, your files are permanently deleted unless you request otherwise in writing.

4. Use of AI tools in analysis

We use AI-assisted tools as part of the analysis, report-writing, and dashboard development process. This is a core part of how Booked & Banked delivers accurate, detailed findings efficiently.

AI tools are used to identify revenue patterns in appointment data, structure and draft written findings, and support the development of dashboards and visualizations. Before any data is processed through these tools, it is anonymized — all business names, owner names, location identifiers, and any other identifying details are removed. The AI tool receives a clean, context-free dataset. It does not receive your business name, your clients’ information, or any detail that could identify your operation.

What this means in practice

The data file shared with AI tools contains no business name, owner name, location, or identifying context
We do not input prompts that name your business or describe identifiable details
The underlying data file remains within our controlled Google Drive environment and is not stored or retained by the AI tool itself
AI-generated outputs (draft findings, pattern summaries) are reviewed, verified, and edited before delivery to you

5. How we use your data

For your engagement

Your data is used to conduct the analysis you have commissioned: retention calculations, cancellation leakage quantification, lifetime value analysis, service mix review, and related diagnostics. All findings are delivered to you in writing.

For industry benchmarking

Patterns across multiple client engagements allow us to build more accurate benchmarks over time — for example, typical cancellation rates by business type, or lifetime value gaps across booking platforms. This makes future analyses more precise and grounded in real data.

If your engagement data contributes to any benchmark or industry insight shared externally, it will be:

Fully anonymized — no business name, owner name, location, or identifying detail included
Aggregated with data from multiple other engagements, never reported as a standalone case
Presented only as a range or pattern, not a specific figure traceable to your business

We may say: “Lash studios in our dataset average a 48–54% one-time client rate.” We will never say: “A studio in [city] had a 51% rate.” Your data informs patterns. It does not represent your business publicly.

6. What we will never do

Sell, rent, license, or transfer your individual business data to any third party
Share your data in a form that could identify your business without your explicit written consent
Use your data to contact, market to, or profile your clients
Provide your specific data to competitors in your local market
Retain your data beyond the stated 12-month period without your written instruction to do so

7. Your rights

You may, at any time, contact us at josh@bookedandbanked.ca to:

Request a copy of all data and files held in connection with your engagement
Request deletion of your data before the standard 12-month retention period
Opt out of your anonymized data contributing to future industry benchmarks
Withdraw consent for ongoing data storage (note: this terminates any active subscription services that depend on it)

Requests will be acknowledged within 5 business days and fulfilled within 10 business days.

8. Applicable law

This privacy policy is governed by Canada’s federal privacy legislation (PIPEDA) and applicable Ontario provincial law. Clients located in other jurisdictions may have additional rights under local legislation — please contact us if this applies to your situation.

Questions about this policy? Email josh@bookedandbanked.ca.