1. Who we are

Booked.so (“we,” “us,” or “our”) is a multi-tenant social media management and calendar scheduling platform.

Contact: dev@booked.so

2. Information we collect

Account information: name, email address, and password (hashed) when you create an account
Connected social platform data: OAuth tokens for the social platforms you connect, profile names, account IDs, posting permissions
Content you create: posts, images, captions, and scheduling metadata you upload for distribution
Usage data: pages visited, features used, timestamps, and IP addresses (for security and rate-limiting)
Cookies and browser storage: cookies that keep you signed in, and cookies and browser storage used to measure how our website (Google Analytics) and the app (PostHog) are used
Communications: messages you send to our support team

3. How we use information

Provide and operate the Booked.so service
Publish content to your connected social platforms on your behalf
Send service-related notifications (billing, security alerts, policy updates)
Improve our service through aggregated usage analytics
Comply with legal obligations and respond to lawful requests

Data from Google APIs

When you connect Google Calendar, Booked.so creates, updates, and deletes the calendar events for bookings made through Booked.so, and reads back the Google Meet link of those events. We do not read your other calendar events.

Booked.so’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

We never use data received from Google APIs to develop, improve, or train generalized artificial intelligence or machine-learning models, and we never send it to AI services.

Data from YouTube

Booked.so uses YouTube API Services. When you connect a YouTube channel, Booked.so:

reads the channel’s name, handle, profile image, and subscriber count, to show which channel is connected;
uploads the videos you schedule, with the title, description, tags, and privacy setting you choose;
reads the view, like, and comment counts of the videos it published for you;
reads the comments on your channel’s videos, including each commenter’s public name, profile image, and channel ID, so you can answer them from your Booked.so inbox, and posts the replies you write.

We store the connection’s access tokens encrypted and use this data only to provide these features to you. We share it with no one except YouTube itself, when we publish or reply on your behalf, and the providers that host our service. Google’s handling of your data is described in the Google Privacy Policy, and using YouTube through Booked.so is subject to the YouTube Terms of Service.

You can remove Booked.so’s access to your YouTube data at any time: disconnect the channel in Booked.so, which deletes our copy of your tokens, the comments we copied into your inbox, and the view and like counts we collected, and revokes our access at Google; or revoke it from Google’s security settings at https://security.google.com/settings/security/permissions. Questions or complaints about how we handle your data go to dev@booked.so.

4. Information sharing

We share information only as required to provide the service:

Social platforms: when you publish content, the content and required metadata is transmitted to the relevant platform (Facebook, Instagram, LinkedIn, YouTube, etc.)
Service providers: infrastructure, email delivery, and analytics providers under data processing agreements
Legal compliance: when required by law, subpoena, or court order

We do NOT sell your personal information to third parties.

5. Data retention

Account data: retained while your account is active and for 90 days after termination
Connected platform tokens: retained while connections are active; deleted immediately when you disconnect, and for Google services such as YouTube we also revoke our access at Google
YouTube comments in your inbox, and the commenters’ names and images: kept for at most 30 days, and deleted as soon as you disconnect the channel. If you revoke our access from Google instead, everything we hold from that channel is deleted within 30 days
Posted content metadata: retained for 12 months for analytics, then anonymized
Billing records: 7 years (legal requirement)

6. Your rights

Wherever you live, you may:

Access the personal data we hold about you
Correct inaccurate data
Delete your account and associated data (see Data Deletion)
Export your content and connection data
Withdraw consent for processing
Object to direct marketing

Email dev@booked.so to exercise any of these rights. We respond within 30 days and never charge for a first request.

GDPR (EEA & UK)

If you are in the European Economic Area or the United Kingdom, Booked.so processes your personal data under the GDPR / UK GDPR. Our legal bases are performance of a contract (to operate the service you signed up for), legitimate interests (security, fraud prevention, and product improvement), and consent (optional marketing). You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to lodge a complaint with your local supervisory authority. International transfers rely on the Standard Contractual Clauses described in §8.

CCPA / CPRA (California)

If you are a California resident, you have the rights to know what personal information we collect and why, to access and delete it, to correct inaccuracies, and to opt out of the “sale” or “sharing” of personal information. Booked.so does not sell or share your personal information, and we will never discriminate against you for exercising any privacy right. You may designate an authorized agent to make a request on your behalf.

7. Security

TLS encryption for all data in transit
Encrypted-at-rest storage of OAuth tokens
Two-factor authentication for account access
Rate-limited authentication endpoints
Regular security audits

8. International transfers

Data is processed in Singapore and the United States. If you are in the EEA, UK, or other jurisdictions with data-transfer requirements, we provide Standard Contractual Clauses on request.

9. Children

Booked.so is not intended for users under 18. We do not knowingly collect data from minors.

10. Changes

We will notify users by email at least 30 days before material changes to this policy.

11. Contact

Booked.so
dev@booked.so

Legal entity details are available on request via dev@booked.so.