Privacy Policy

Last updated: May 2026

At BookMyDay (operated by Offer18 Tracking Platform Pvt. Ltd.), your privacy is critically important to us. This Privacy Policy explains in detail how we collect, use, disclose, store, and protect your personal information when you access or use the BookMyDay platform, website, mobile applications, APIs, and any related services (collectively, the "Service").

By using our Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Service.

1. Information We Collect

We collect information in the following categories:

1.1 Information You Provide Directly

• Account Information: When you register for an account, we collect your name, email address, password, organisation name, and time zone.
• Profile Information: Optional details you add to your profile, such as a profile photo, job title, phone number, and bio.
• Booking Data: Information related to appointments you create or receive, including event titles, descriptions, attendee details, dates, times, and locations.
• Payment Information: When you subscribe to a paid plan or accept payments through the platform, billing details such as card number, expiry date, and billing address are collected and processed by our PCI-compliant payment processors (e.g., Stripe, Razorpay). We do not store full card numbers on our servers.
• Communications: Messages you send through our contact forms, support tickets, or chat, including your name, email, and message content.
• Calendar Data: When you connect a Google Calendar or other third-party calendar account, we access your calendar to check real-time availability, prevent double-bookings, and create, update, or delete events on your behalf. For Google Calendar, we request full calendar access (read and write) so we can create event entries, attach Google Meet links, and remove events when bookings are cancelled. We do not access the content of events unrelated to bookings made through BookMyDay.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, clicks, session duration, referral URLs, and user flows within the platform.
• Device Information: Browser type and version, operating system, screen resolution, device type, and unique device identifiers.
• Network Information: IP address, internet service provider, and approximate geographic location derived from your IP address.
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies as described in our Cookie Policy.

1.3 Information from Third Parties

• Calendar Providers: Free/busy status and event metadata from connected calendar accounts.
• Authentication Providers: If you sign in using a third-party service (e.g., Google SSO), we receive your name, email address, and profile picture from that provider.
• Payment Processors: Transaction status, payment confirmations, and fraud-detection signals.

1.4 Google API Data

BookMyDay integrates with Google services to provide calendar scheduling and video meeting capabilities. When you connect your Google account, we request the following OAuth scopes and use the data exclusively to deliver the features described:

• Email address (email scope): Used to identify your account, associate calendar events with the correct user, and send booking-related communications.
• Basic profile information (profile scope): Your Google name and profile picture are used to populate your BookMyDay profile and display your identity to attendees during the booking flow.
• Google Calendar — full access (https://www.googleapis.com/auth/calendar scope): We read your calendar to check real-time availability and prevent double-bookings. We also create, update, and delete calendar events on your behalf when bookings are made, rescheduled, or cancelled. Only calendars you explicitly authorise are accessed; event content unrelated to BookMyDay-managed bookings is never read or stored.
• Google Meet (via Google Calendar API): When you enable Google Meet as a location for an event type, we automatically generate a unique Google Meet conference link and attach it to the calendar event. We do not join, record, access, or store the content of your Google Meet sessions.

BookMyDay's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google APIs is used only to provide and improve the scheduling features described in this policy and is never used for advertising, sold to third parties, or transferred to any party except as necessary to operate the Service.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Provide and operate the Service: Process bookings, sync calendars, create and manage calendar events, generate Google Meet links, send confirmations and reminders, and deliver core scheduling functionality.
• Manage your account: Authenticate your identity, maintain your profile, and process subscription payments.
• Communicate with you: Respond to support requests, send service-related notices (e.g., maintenance alerts, policy changes), and, with your consent, deliver marketing communications about new features or promotions.
• Improve and develop the Service: Analyse usage patterns, conduct A/B testing, identify bugs, and develop new features to enhance the user experience.
• Ensure security: Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms of Service.
• Comply with legal obligations: Respond to lawful requests from regulatory bodies, courts, and law enforcement agencies.

3. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data with the following categories of recipients:

• Service Providers: Third-party vendors who assist us in operating the platform, including cloud hosting (e.g., AWS, Google Cloud), email delivery (e.g., SendGrid), payment processing (e.g., Stripe, Razorpay), analytics (e.g., Google Analytics), and customer support tools. These providers are contractually obligated to process data only on our behalf and in accordance with this policy.
• Booking Participants: When a booking is made, relevant information (e.g., name, email, event details) is shared between the organiser and the attendee to facilitate the appointment.
• Business Transfers: In the event of a merger, acquisition, reorganisation, or sale of assets, your data may be transferred as part of the transaction. We will notify you of any such change and the choices you may have.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• With Your Consent: We may share data for purposes not described here with your explicit consent.

Data obtained from Google APIs is used only to provide the scheduling and calendar features of the Service. It is never shared with third parties for advertising, sold, or transferred for any purpose unrelated to operating BookMyDay.

4. Data Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS 1.2+ and data at rest using AES-256.
• Role-based access controls limiting employee access to personal data on a need-to-know basis.
• Regular security audits, penetration testing, and vulnerability assessments.
• Secure development practices including code reviews and automated security scanning.
• Incident response procedures to promptly address and notify affected parties of security breaches.

While we strive to use commercially acceptable means to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your personal data for as long as your account is active or as reasonably necessary to provide the Service to you. Specifically:

• Google OAuth tokens: Stored only for the duration required to maintain your active calendar connection. Tokens are revoked and deleted immediately upon disconnecting your Google account from BookMyDay.
• Account data: Retained for the duration of your active account and for 30 days following account deletion to allow for recovery.
• Booking data: Retained for 12 months after the event date for reporting and audit purposes, unless you request earlier deletion.
• Payment records: Retained for 7 years as required by applicable tax and accounting regulations.
• Usage and analytics data: Retained in aggregated, de-identified form indefinitely for product improvement.
• Support communications: Retained for 24 months after the last interaction.

You may request deletion of your data at any time by contacting us. We will comply within 30 days, subject to legal retention obligations.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Right to Restriction: Request that we restrict processing of your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format (e.g., JSON or CSV).
• Right to Object: Object to processing of your data for direct marketing or based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. You may also revoke BookMyDay's access to your Google account at any time via your Google Account permissions page.

To exercise any of these rights, please contact us at contact@bookmy.day. We will respond within 30 days of receiving your request.

7. Cookies and Tracking Technologies

We use cookies and similar technologies (web beacons, pixels, local storage) to enhance your experience, analyse usage, and deliver relevant content. For detailed information about the types of cookies we use and how to manage your preferences, please refer to our Cookie Policy.

8. International Data Transfers

BookMyDay is operated from India by Offer18 Tracking Platform Pvt. Ltd. If you access the Service from outside India, your data may be transferred to, stored, and processed in India or other countries where our service providers maintain facilities. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer data internationally, we implement appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by relevant regulatory authorities.
• Data Processing Addendums with all sub-processors, as outlined in our Data Processing Addendum.
• Compliance with applicable data protection frameworks and adequacy decisions.

9. Children's Privacy

BookMyDay is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 18, we will take immediate steps to delete that information. If you believe a child has provided us with personal data, please contact us at contact@bookmy.day.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated policy on this page with a revised "Last updated" date.
• Notify you via email or an in-app notification at least 14 days before the changes take effect.

Your continued use of the Service after the effective date of the updated policy constitutes your acceptance of the changes.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Offer18 Tracking Platform Pvt. Ltd.
0354, Street No - 3, DCM Colony,
City - Malout, Punjab, India - 152107
Email: contact@bookmy.day
Website: bookmy.day