Privacy Policy

RTP Bookings lets businesses ("Businesses") publish an online booking page and lets their customers ("Customers") book and pay for appointments. This policy explains what data we handle for each.

• Account details: name, email address, password (stored hashed), business name, contact details, address and business type you choose to enter.
• Services, prices, opening hours and team members you configure.
• Billing: your subscription is processed by Stripe. We store your Stripe customer and subscription identifiers, never your card number.

When a Business connects Google Calendar, we request the calendar.readonly and calendar.events scopes. We use them only to:

• Read free/busy information from the calendars you select, so customers cannot book a time you are already busy. We do not read event titles, descriptions or attendees of your existing events, and we do not store your calendar contents.
• Create, update and delete the calendar events that correspond to bookings made through RTP Bookings.

Your Google access and refresh tokens are stored encrypted at rest and are deleted when you disconnect Google Calendar or delete your account. We never sell, share or transfer Google user data to third parties, and we do not use it for advertising or to train machine-learning models. RTP Bookings's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Name, email address, optional phone number and notes entered when booking, plus the booking time and service.
• Payment is processed by Stripe on the Business's connected Stripe account. We store the payment identifier, not card details.
• Your browser timezone, used only to display times correctly.

Customer data is shared with the Business you booked with (it appears in their dashboard, their calendar and their confirmation emails) and with Stripe to take payment.

Some Businesses offer appointment texts through RTP Bookings (registered messaging brand: RTP Bookings). A Customer opts in by entering a mobile number on the booking form and ticking the box that says they want confirmations and reminders by text; the box is optional and booking works without it. We then send a confirmation for the booking and up to two reminders before the appointment. Message frequency varies, up to 3 texts per booking. Message and data rates may apply.

Reply STOP at any time to opt out (one final message confirms it), or HELP for help (CANCEL, END, QUIT and UNSUBSCRIBE also opt out). Appointments are cancelled or moved through the link in each text. Consent and opt-out records are kept with the Customer's record so the Business can honour them.

A Business may also offer a second, separate and optional box for occasional offers, promo codes and invitations to rebook by text (up to 4 messages a month). Only Customers who tick it receive offers; replying STOP to an offer stops offers. See our Offers by text page.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile numbers and consent are shared only with the Business you booked with and with our messaging provider (Twilio) to deliver the texts. See also our SMS program page.

Businesses on a plan that includes it can give their team the RTP Bookings iPhone app. It signs in with the same email and password as the web app and shows the same bookings and customers. In addition to the data above, the app handles:

• The phone's name, so a Business can see which phones are signed in and sign one out.
• Approximate location, only while a card payment is being taken with Tap to Pay on iPhone, because the card networks require it. It is used by Stripe to process that payment and is not stored by us.
• A push-notification token, if the person allows notifications, used only to tell that phone about new, moved and cancelled bookings. It is deleted when the phone signs out.

The app contains no advertising and no tracking, and shares nothing with third parties beyond Stripe, for payments, and Apple, to deliver notifications. Deleting the Business's account deletes everything the app stored.

We send transactional emails only: booking confirmations, reminders, changes and cancellations, account and billing notices, and calendar-connection links to team members. We do not send marketing email.

On rtpbookings.app itself (this website, the sign-up and the Business dashboard) we may use Google Analytics, Google Ads conversion measurement, Google Tag Manager and the Meta Pixel to understand how people find us and which pages they use. These tools receive the pages viewed, the device and browser, an advertising click identifier when you arrived from an ad, and, when a Business signs up or starts a plan, that event with the plan's price. We keep the click identifier and campaign tags of the visit a Business signed up from, so we know which advertising works. None of this covers customers booking through a Business's booking page: that page carries only the tags the Business itself has chosen to add.

You can limit this with your browser's tracking settings, Google's Analytics opt-out add-on, or by clearing cookies; the website works the same without them.

Stripe (payments and subscriptions), Google (calendar; website analytics and advertising measurement), Meta (advertising measurement), Twilio (text messages), our hosting provider, and our email delivery provider process data on our behalf under their own terms.

Booking records are kept while the Business's account is active so it can keep its history. A Business can disconnect Google Calendar at any time from Integrations, which deletes the stored tokens. To delete an account or a customer record, email support@rtpbookings.app and we will do so within 30 days.

All traffic is encrypted with TLS. OAuth tokens are encrypted at rest. Access to production systems is restricted to the operator.

We will post any changes to this policy on this page. Last updated November 2026.