1. Who We Are

Rexabook is a trading-style of TECH CONSULTING ENTERPRISE LTD, a company registered in England and Wales (company number 17084084), with its registered office at 3rd Floor, 207 Regent Street, London, Greater London, W1B 3HH.

We are the data controller for your account information (the business owner) and a data processor for your clients' personal data, which you control.

Contact: hello@rexabook.com

We have assessed that we are not required to appoint a Data Protection Officer under UK GDPR. Data protection queries can be directed to the contact address above.

2. What Data We Collect

2.1 Business Owner Data (you)

When you create an account, we collect:

Email address and password (hashed with PBKDF2-SHA256)
Business name and URL slug
Phone number (optional - used for trial onboarding messages)
Payment information (processed by Stripe - we never see your full card details)

2.2 Client Data (your customers)

When your clients book appointments, the following data is stored in your isolated tenant database:

Name, phone number, email address
Booking history (dates, services, status)
Email message delivery logs (sent / delivered / bounced)
Marketing-email opt-in and opt-out flags (recorded when the client opts in or out via the booking flow, the self-serve notification preferences, or an unsubscribe link in a marketing email - see §7.3)
Intake form responses (if configured)
Notes and tags (added by you)

You are the data controller for your clients' data. We process it on your behalf as a data processor.

2.3 Technical Data

We automatically collect:

IP addresses (for rate limiting and security - not stored long-term)
Device tokens (for push notifications, if enabled)
Browser/device type via Cloudflare analytics (aggregated, not individual)
Advertising-measurement data via the Meta Pixel, where you have consented (or, outside the UK/EU/EEA/Switzerland, where you have not opted out): pages viewed on our marketing site and owner dashboard, and trial-signup / subscription events. For a subscription we also send Meta a securely hashed (irreversible) form of your account email so it can attribute the conversion - never your email in plain text. This never runs on your clients' booking pages. See §8.

3. How We Use Your Data

Purpose	Legal basis
Providing the booking service	Contract performance
Sending booking confirmations and reminders to your clients	Legitimate interest (service delivery)
Processing payments via Stripe	Contract performance
Sending you trial onboarding and billing communications	Legitimate interest (customer relationship)
Rate limiting and abuse prevention	Legitimate interest (security)
Drafting suggested replies to contact-form enquiries using the AI Receptionist (on the contact-form / email channel only - see §7.4)	Legitimate interest (service delivery, when the AI is enabled for the conversation)
Push notifications about bookings	Consent (you enable this in the app)
Measuring the effectiveness of our advertising (Meta Pixel & Conversions API - see §8)	Consent in the UK, EU/EEA and Switzerland (via our cookie banner); legitimate interest under an opt-out model elsewhere

4. Data Isolation

Rexabook uses a multi-tenant architecture. Each business ("tenant") is assigned a unique tenant identifier, and businesses' data is distributed across a small number of separate database shards on Cloudflare's infrastructure. Within a shard, businesses share the same tables, with each record tagged by its tenant identifier.

Isolation is enforced in software: every database query is routed through a single access-control point that automatically restricts it to the calling tenant's records, and each request is authenticated and scoped to one tenant. As a result, one business cannot access another business's data.

5. Where Data Is Stored

All data is processed and stored on Cloudflare's global network. Cloudflare Workers run in V8 isolates at the edge. D1 databases are SQLite-based and replicated across Cloudflare's infrastructure.

Rexabook sends SMS (text-message) notifications to clients about their bookings - see §7. WhatsApp and voice are not currently active. The sub-processors below cover the channels and integrations active at launch; the list will be updated if and when additional channels (WhatsApp, voice) are enabled.

Third-party sub-processors:

Sub-processor	Purpose	Location
Cloudflare, Inc.	Hosting, database (D1), object storage (R2), CDN, edge compute, transactional email (Cloudflare Email Sending)	USA
Stripe Payments UK Ltd / Stripe, Inc.	Payment processing, subscription billing, Stripe Connect payouts	UK / USA
Twilio Inc.	SMS (text-message) delivery for recipients outside the UK, and as a UK fallback	USA
PureSMS (puresms.uk)	SMS (text-message) delivery for UK recipients	UK
Google LLC	Firebase Cloud Messaging (push notifications, when you install the owner mobile app), Google Calendar sync (optional), Google Places reviews (optional)	USA
Meta Platforms Ireland Ltd / Meta Platforms, Inc.	Advertising measurement (Meta Pixel & Conversions API) - only where you have consented or, outside the UK/EU/EEA/Switzerland, have not opted out (see §8)	Ireland / USA

5.1 International Transfers

Personal data processed through Rexabook may be transferred outside the United Kingdom to sub-processors based in the United States. Where such transfers occur, they are protected by one or more of the following lawful transfer mechanisms:

the UK International Data Transfer Addendum to the EU Standard Contractual Clauses;
the EU-US Data Privacy Framework and its UK extension, where the recipient is self-certified; or
the UK International Data Transfer Agreement (IDTA).

Copies of the relevant transfer mechanisms are available on request from hello@rexabook.com.

6. Data Retention

Active accounts: data retained for the lifetime of the account
Cancelled accounts: all of the business's data is deleted from our systems within 30 days of account closure
Password reset tokens: automatically expire after 15 minutes
Rate-limiting data: automatically expires after the rate window (15-60 minutes)
Stripe data: retained by Stripe per their privacy policy

7. Messaging (Email & SMS)

7.1 What email we send

Rexabook sends email on two distinct paths:

To your clients (on your behalf, from your business) - relating to a specific booking: booking confirmations, booking reminders, reschedule notifications, and cancellation notifications. The customer-facing inbox also receives the AI-receptionist draft replies described in §7.4.
To you (the business owner) - about your account: account-setup messages during onboarding, trial-nurture and billing communications, owner / staff / quota / low-balance notifications, and the daily digest.

Email is delivered through Cloudflare Email Sending, a transactional email service operated by Cloudflare, Inc. as listed in §5.

7.2 How consent is collected

A client's email address is provided to the business owner at the point the client makes or requests a booking - either directly through the Rexabook public booking page, or via the business owner's own intake process (in person, by phone, or through another channel operated by the business owner). By providing their email address in connection with a booking, the client consents to receive transactional email messages from the business owner relating to that booking.

Rexabook records this consent against the client record in the business owner's data and enforces it at send time. Business owners are responsible, as data controller for their clients' data, for ensuring that the consent they collect is valid under applicable law.

7.3 Opting out

Transactional booking email (booking confirmations, reminders, reschedules, cancellations) is essential to the operation of the Service and cannot be opted out of while the booking remains active. Each transactional booking email includes a "Cancel or manage notifications" link to the customer's self-serve notification preferences, where the customer can cancel the booking or change which optional notifications they receive going forward.

Marketing email (review requests, rebooking nudges, loyalty reward notifications, loyalty stamp-expiry warnings) is opt-in and each message includes an unsubscribe link to the same self-serve notification preferences. Opt-outs are processed automatically and immediately: the client record is flagged as opted-out and no further marketing email is sent to that address, regardless of any instruction from the business owner.

Operational email (account-setup messages to the business owner, trial-nurture emails, billing alerts, owner / staff / quota / low-balance notifications) is sent to the business owner rather than the customer and is necessary to operate the Service. It is not subject to an unsubscribe link; if the business owner wishes to stop receiving these, they can close the account (see §14).

7.4 Message frequency and content

Message frequency varies based on the client's booking activity with a given business owner. Rexabook does not charge recipients for email messages.

We do not read, mine, or use the content of email conversations between business owners and their clients for any purpose other than operating the service. This includes the AI Receptionist feature, which classifies incoming enquiry replies to draft suggested replies in the owner's inbox (the owner reviews every draft before sending, and may disable the AI on a per-conversation basis). The AI Receptionist runs only on the contact-form / email channel at launch; it does not have access to message content on any other channel until those channels are re-enabled in a future update. We do not use email content or addresses to train machine-learning models.

7.5 No sharing of email information with third parties for marketing

No email information - including email addresses, opt-in flags, and consent records - will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing is limited to sub-processors that directly support the delivery of the email service (specifically Cloudflare, Inc., as listed in §5), and is not shared with any third party for their own marketing, promotional, or commercial purposes. This restriction applies to all categories of email sent through Rexabook.

7.6 Retention of email data

Email delivery logs (sent / delivered / bounced status) are retained alongside the corresponding booking record in the business owner's data for the lifetime of the account and are deleted within 30 days of account closure (see §6). Opt-out flags are retained for as long as the client record exists, in order to honour the opt-out.

7.7 What SMS we send

Rexabook sends SMS (text messages) to a client's mobile number on the business owner's behalf, relating to a specific booking: booking confirmations, reminders, reschedule and cancellation notices, and - where the business owner uses card-on-file features - late- cancellation and no-show charge notices. These are transactional service messages. SMS is delivered through PureSMS (UK recipients) and Twilio (recipients elsewhere, and UK fallback), as listed in §5.

Optional marketing SMS (e.g. offers or reminders to rebook) is sent only to clients who have separately opted in (see §7.8).

7.8 How SMS consent is collected

A client's mobile number is provided to the business owner when the client makes or requests a booking - through the Rexabook public booking page or the business owner's own intake process. Transactional booking SMS is sent on the basis of the booking relationship (contract / legitimate interest); in the United States, where required by carrier (A2P 10DLC) rules, transactional booking SMS is sent only after the client gives an explicit, unticked opt-in at booking. Marketing SMS always requires a separate, explicit opt-in (an unticked checkbox at booking, or a toggle in the client's self-serve notification preferences). At the point of booking the client is shown a clear notice that they will receive text updates about the booking and how to stop them. Rexabook records this against the client record and enforces it at send time. Business owners are responsible, as data controller for their clients' data, for ensuring the notice and consent they rely on are valid under applicable law.

7.9 Opting out of SMS (STOP) and help (HELP)

A client can stop all texts at any time by replying STOP to any message; the opt-out is processed automatically and immediately and no further SMS is sent to that number, regardless of any instruction from the business owner. Replying HELP returns information about the messaging programme. Marketing SMS can also be switched off via the client's self-serve notification preferences without stopping transactional booking texts.

7.10 SMS message frequency and rates

Message frequency varies based on the client's booking activity with a given business owner. Message and data rates may apply - these are set by the recipient's mobile carrier; Rexabook does not charge recipients for receiving texts.

7.11 No sharing of mobile information with third parties for marketing

No mobile information - including mobile numbers, SMS opt-in flags, and consent records - will be shared with or sold to third parties or affiliates for marketing or promotional purposes. Information sharing is limited to the SMS sub-processors that directly deliver the messages (PureSMS and Twilio, as listed in §5) and is not shared with any third party for their own marketing, promotional, or commercial purposes. This restriction applies to all categories of SMS sent through Rexabook.

8. Cookies and Advertising Measurement

We do not use Google Analytics. We use one third-party measurement tool - the Meta (Facebook) Pixel - to understand how effective our own advertising is (for example, how many people who see an advert go on to start a trial or subscribe). It runs only on our marketing site (rexabook.com) and on the business owner sign-up and dashboard pages (app.rexabook.com). It does not run on your clients' booking pages - your customers are never tracked by our pixel.

When active, the Meta Pixel:

sets cookies in your browser (such as _fbp) and reads them on later visits;
sends Meta a record of certain actions - pages viewed, a trial being started, and a subscription being taken out - so we can attribute them to our adverts;
for a subscription conversion, also sends Meta the same event from our server (Meta's Conversions API) including a securely hashed (one-way, irreversible) form of your account email so Meta can match the conversion to your ad click. We never send Meta your email address in plain text.

Your choice. In the UK, the EU/EEA and Switzerland the pixel does not run until you accept it via the cookie banner shown on your first visit. You can decline, and it stays switched off; you can change your mind at any time by clearing the site's storage in your browser (which re-shows the banner) or by using your browser's cookie controls. In other countries the pixel runs under an opt-out model. For visitors in the United States we additionally enable Meta's Limited Data Use setting. Meta uses this data as an independent/joint controller under its own Data Policy; Meta is listed as a recipient in §5.

The booking application also uses localStorage to store your authentication token and your cookie-consent choice. These are strictly necessary for the service to function and do not require consent under UK GDPR / PECR.

9. Your Rights (UK GDPR)

As a UK-based service, we comply with the UK General Data Protection Regulation. You have the right to:

Access - request a copy of your personal data
Rectification - correct inaccurate data
Erasure - request deletion of your data ("right to be forgotten")
Portability - receive your data in a machine-readable format
Object - object to processing based on legitimate interest
Restriction - request we limit processing of your data

To exercise any of these rights, contact us at hello@rexabook.com. We will respond within 30 days.

For your clients

Your clients should contact you (the business owner) to exercise their data rights, as you are the data controller for their information. If a client contacts us directly, we will direct them to you.

Right to complain to the ICO

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concerns before you contact the ICO.

10. Automated Decision-Making

We do not use your personal data, or your clients' personal data, for automated decision-making that produces legal or similarly significant effects, and we do not carry out profiling within the meaning of Article 22 UK GDPR.

11. Security

We take security seriously:

Passwords are hashed with PBKDF2-SHA256 (100,000 iterations)
Authentication uses HMAC-SHA256 signed JWTs
Sensitive tokens (OAuth tokens and any future WhatsApp Business Account credentials, when the WhatsApp integration is enabled in a future update - see terms §5) are encrypted with AES-256-GCM at rest
All traffic is encrypted via HTTPS (Cloudflare edge TLS)
Worker-to-worker communication is authenticated with shared secrets
Rate limiting protects against brute-force attacks
Every database query is routed through a single access-control point that scopes it to the authenticated tenant, preventing cross-tenant data access

12. Children

Rexabook is a business tool and is not intended for use by anyone under 18 years of age. We do not knowingly collect data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least 14 days before they take effect. The "last updated" date at the top of this page will always reflect the most recent version.

14. Contact

For privacy-related questions or to exercise your data rights, contact us at:

hello@rexabook.com