1. Introduction & Application Identity
This Privacy Policy applies to the BooKi online appointment scheduling and business management platform ("BooKi", "Platform", "we", "us", or "our"), designed, owned, and operated by Ki Software, a division of Ki Business Solutions (official website: https://kibusiness.co; software solutions: https://software.kibusiness.co).
BooKi is hosted and made publicly available at https://booki.kibusiness.co, with authorized tenant management portals hosted at https://bookiapp.kibusiness.co. This Privacy Policy governs the manner in which BooKi collects, accesses, uses, processes, maintains, protects, and discloses personal data and Google user data obtained from users, customers, and business service providers.
We are dedicated to safeguarding your privacy and ensuring full compliance with the European Union General Data Protection Regulation (GDPR), the Turkish Law on the Protection of Personal Data (KVKK No. 6698), and Google's API Services User Data Policy.
2. Personal Data We Collect
To deliver seamless appointment bookings, customer communication, and calendar management, BooKi collects the following categories of information:
A. Information Provided Directly by Users
- Account Registration Details: Full name, business trade name, professional title, phone number, email address, physical location or salon address, and encrypted authentication passwords.
- Customer & Appointment Records: Client names, phone numbers, email addresses, selected services, assigned staff members, appointment dates and times, duration, session notes, and transaction values.
- Customer Inquiries & Support Data: Text, logs, and correspondence transmitted when contacting our customer support or submitting feedback.
B. Technical & Operational Data
- Device and Access Logs: IP address, browser type, operating system version, referring URLs, request timestamps, and security cookies used strictly for rate-limiting, session maintenance, and intrusion prevention.
3. Google User Data Accessed, Used & Disclosed
BooKi provides an optional, user-initiated integration with Google APIs (primarily Google Calendar) allowing businesses and service providers to synchronize their appointments with their personal or corporate Google Calendar. When you choose to link your Google Account with BooKi, our application requests access to specific scopes only upon your explicit consent.
🛡️ Google API Services User Data Policy & Limited Use Compliance
BooKi's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We strictly access only the minimum necessary Google user data required to provide and improve user-facing features of our appointment scheduling service.
| Google OAuth Scope | Google User Data Accessed | Purpose & Specific Use |
|---|---|---|
openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profile
|
Google User ID, primary email address, verified profile name, and account avatar. | To securely authenticate user identity, facilitate single sign-on (SSO), associate your BooKi user profile with your Google identity, and prevent unauthorized account access. |
https://www.googleapis.com/auth/calendarhttps://www.googleapis.com/auth/calendar.events
|
Calendar titles, calendar identifiers (IDs), event summaries, descriptions, start/end dates and times, event location, and attendee response status. |
Two-Way Real-Time Calendar Synchronization: 1. Automatically creates, updates, or cancels events on your designated Google Calendar whenever an appointment is booked, rescheduled, or cancelled on BooKi. 2. Reads busy/free time slots from your connected Google Calendar to automatically block unavailable hours on BooKi, preventing overlapping bookings or double-booking. |
https://www.googleapis.com/auth/contacts.readonly(Optional Admin Add-on) |
Customer names, phone numbers, and email addresses. | Allows providers to easily import client contacts to dispatch appointment confirmations and SMS/WhatsApp reminders, strictly when explicitly enabled by the administrator. |
https://www.googleapis.com/auth/spreadsheetshttps://www.googleapis.com/auth/drive.file(Optional Admin Add-on) |
Spreadsheet rows, column data, and Google Drive files created or selected specifically by the user for BooKi. | Enables automated daily export of appointment logs, commission summaries, and revenue reports to a dedicated Google Sheet chosen by the business owner for bookkeeping. |
https://www.googleapis.com/auth/tasks(Optional Admin Add-on) |
Task titles, due dates, and task completion flags. | Creates actionable task checklist reminders for upcoming customer sessions in Google Tasks. |
4. Prohibited Uses of Google User Data
In strict alignment with Google Cloud Verification standards and Google API Services User Data Policy, BooKi enforces the following strict prohibitions:
- No Sale of Google Data: We will NEVER sell, rent, lease, trade, or monetize Google user data, contact records, or calendar information to third parties, data brokers, or marketing intermediaries under any circumstance.
- No Advertising or Marketing: Google user data is NEVER used, transferred, or disclosed for serving advertisements, personalized ads, retargeted advertisements, or interest-based marketing campaigns.
- No Creditworthiness or Financial Scoring: Google user data is never used to assess creditworthiness, lending eligibility, or insurance risks.
- Strict Limitation of Use: All Google user data is utilized solely and exclusively to deliver, maintain, and enhance user-facing scheduling, calendar synchronization, and booking features requested directly by the user.
🤖 Explicit Affirmation on Artificial Intelligence (AI) & Machine Learning (ML)
BooKi explicitly affirms that Google Workspace APIs and data obtained from Google APIs are NOT used to develop, build, improve, fine-tune, or train generalized, foundational, or non-personalized artificial intelligence (AI) and/or machine learning (ML) models.
No customer calendar data, attendee identities, or appointment descriptions are ingested into public or private model training pipelines.
5. Data Sharing, Transfer & Third-Party Disclosures
We do not transfer or disclose your Google user data to third parties for purposes other than those specified in this policy. We share data only in the following strictly confined circumstances:
- Infrastructure Sub-Processors: Secure, enterprise-grade cloud hosting providers (e.g., ISO 27001 / SOC 2 certified data centers) who process data strictly on our behalf under binding data processing agreements that mandate stringent security and confidentiality.
- Legal Mandates: Where strictly required to comply with a valid court subpoena, warrant, or binding statutory obligation issued by a competent governmental authority.
6. Technical Security & Protection Mechanisms
We implement rigorous technical, organizational, and physical security measures to safeguard Google user data and personal information against unauthorized access, loss, or alteration:
- Encryption in Transit: All communications between your browser, our application servers, and Google APIs are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS) with forward secrecy.
- Encryption at Rest: All stored OAuth tokens (access tokens and refresh tokens) as well as sensitive customer personally identifiable information (PII) are encrypted at rest using AES-256-GCM (Galois/Counter Mode) with secure cryptographic key management.
- Cryptographic Integrity & Search: Blind indexing using HMAC-SHA256 ensures that searches can be executed without decrypting or exposing sensitive data in clear text.
- Access Control & Isolation: Multi-tenant isolation ensures data belonging to one business is strictly inaccessible to another. Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA) protect administrative endpoints.
7. Data Retention & Deletion (User Control & Rights)
Google user data and calendar synchronization tokens are retained only for as long as your BooKi account remains active and the Google integration remains connected.
How to Disconnect Google Integration and Delete Stored Data:
- In-App Disconnection: You can disconnect your Google Calendar at any time directly from the BooKi dashboard by navigating to Settings > Integrations > Google Calendar and clicking "Disconnect". This action immediately, permanently, and irrevocably purges your stored OAuth tokens from our database and terminates all calendar synchronization.
- Google Account Revocation: You can independently revoke BooKi's access at any moment via your Google Account Security Dashboard at https://myaccount.google.com/permissions.
- Complete Account & Data Erasure: To request complete deletion of your BooKi account, appointments, and all associated personal data, submit an erasure request via our online portal or email our Data Protection Team at [email protected] or [email protected]. All verified deletion requests are completely executed within 30 days.
8. User Rights Under GDPR & KVKK
Depending on your jurisdiction, you possess the following statutory rights regarding your personal data:
- The right to be informed regarding whether your personal data is processed.
- The right to access and obtain a copy of your personal data.
- The right to rectify inaccurate, out-of-date, or incomplete data.
- The right to request the deletion or destruction of your personal data.
- The right to restrict or object to the processing of your data.
- The right to data portability in a machine-readable format.
9. Contact Information & Data Protection Officer
If you have any questions, inquiries, or complaints concerning this Privacy Policy or our data handling practices, please reach out to us:
Ki Software / Ki Business Solutions
Application Name: BooKi Appointment & Booking Platform
Company Website: https://kibusiness.co
Application Website: https://booki.kibusiness.co
Privacy Inquiries & Data Erasure: [email protected]
General Inquiries: [email protected]
Support Hotline: +90 506 250 55 62