Privacy policy

1. Who we are and the role we play

Smart Booking is an online scheduling service for businesses that work by appointment: salons, barbershops, aesthetics, clinics, studios and any other trade that books its time.

Two situations differ. For the data of people who sign up as a business's owner or staff, we are the DATA CONTROLLER. For the data of end clients who book an appointment, we are a DATA PROCESSOR acting on the business's behalf: the business decides what it collects and why, and we process it only on its instructions and to provide the service.

If you are a business's client and want to exercise your rights, you can contact the business or write to us and we will route it.

2. What we process

Only what an appointment actually needs:

• From the business: business name, email address, timezone, opening hours, services, prices and staff. We neither ask for nor store a password: signing in uses a 6-digit code sent to that address, of which we keep only an argon2id hash for 10 minutes.
• From the end client: name, phone and/or email, and their appointment history with that business.
• From payments: the gateway's operation reference, the amount and its status. We do NOT store card numbers — card details are entered directly with MercadoPago or PayPal and never reach our servers.
• Technical data: IP address and access logs, used for security, rate limiting and diagnostics.

3. What we use it for

To run the diary and its bookings, send appointment confirmations and reminders over WhatsApp, SMS or email, process deposits and subscriptions, provide support, and keep the service secure.

We do not sell personal data, do not share it for advertising, and do not profile people or make automated decisions with legal effects on them.

4. Legal basis

Business data is processed to perform the service contract and to meet legal obligations. End-client data is processed on the basis of the consent given when booking and the business's legitimate interest in honouring the appointment, under articles 9 and 13 of Ley 18.331.

5. Who we share it with

Only the providers needed to deliver the service, and only the data each one needs:

• Meta Platforms (WhatsApp Business Cloud API) and/or Bird.com: WhatsApp and SMS reminder delivery. They receive the recipient's phone number and the message.
• Outbound email provider (SMTP): confirmations, reminders, sign-in codes and recovery links. Receives the email address and the message.
• MercadoPago and/or PayPal: deposit and subscription payments. They receive the amount and an operation reference.
• The infrastructure provider hosting the service.

6. International transfers

Some of those providers are outside Uruguay. Where the destination country does not offer an adequate level of protection under article 23 of Ley 18.331, the transfer relies on the data subject's consent and on the contractual clauses we hold with each provider.

7. How long we keep it

Booking data is kept while the business's account is active, because it is their client history and their accounting record.

If a business closes its account, we delete its data and its clients' data within 90 days, except what we must keep to meet a legal or accounting obligation.

Database backups are kept for 14 days and then deleted automatically. Data you asked us to delete may persist in a backup until that backup expires.

8. Security

Traffic is encrypted with TLS. We store no passwords, because there are none: administrative sign-in requires a single-use code sent by email, and of that code we keep only an argon2id hash that expires after 10 minutes. Each business is isolated from the others at the database level through row-level security policies, not only in application code.

No system is infallible. If a breach affects your data, we will notify you as the applicable rules require.

9. Your rights

You may at any time request access to, rectification, updating, inclusion or deletion of your personal data, under articles 13 to 15 of Ley 18.331.

Write to us and we will answer within the statutory deadlines. If you believe we handled your request poorly, you may complain to Uruguay's data protection authority, the URCDP (www.gub.uy/unidad-reguladora-control-datos-personales).

10. Cookies

This marketing site uses no cookies and no third-party analytics.

The management app and the public booking page store in your browser only what is needed to keep you signed in and remember usage preferences. These are not advertising or tracking cookies.

11. Changes

If we change this policy we update the date in the header, and where the change is material we email businesses before it takes effect.