Data Processing Terms, your customers’ data

Part of the Terms of Service. Applies automatically; nothing to sign.

Last updated 3 October 2026

1. When these terms apply

These terms apply automatically to the personal information of your customers, and of anyone else whose details you put into Gaplessly, for as long as we hold it. You decide why and how it is used; we handle it on your behalf and at your direction. In Australian terms you are the entity responsible for it, and in New Zealand terms we hold it as your agent. If you need a signed copy for a regulator or a client, ask at privacy@gaplessly.com.

2. What we handle

Item	Detail
People	Your customers and guests, people on your waitlist, people who enquire, and your staff
Information	Names, email addresses, phone numbers, booking history, notes, tags, intake and booking answers, feedback, payment records (never full card numbers), and anything else you choose to record
Sensitive information	Only what you choose to collect, such as allergies, dietary needs or health notes in a booking answer or client note
Purpose	Providing the service to you: taking and managing bookings, sending messages you set up, payments, reports and support
Duration	For as long as your account holds it, then as section 8 describes

3. What we commit to

We use this information only to provide the service to you, as you instruct through your settings, your use of the service and this agreement, or as the law requires. If we think an instruction breaks the law, we will tell you.
We do not sell it, use it for our own marketing, contact your customers for our own purposes, or use it to train AI models.
Only people who need access to run or support the service can reach it, and they keep it confidential.
We protect it with reasonable security: each business’s data is isolated at the database level, traffic is encrypted in transit, data is encrypted at rest, and two-factor sign-in is available on every account.
We help you respond when one of your customers asks to see, correct or delete their information. The dashboard lets you export, edit and delete a client yourself. If a request reaches us, we pass it to you within 5 business days and tell the person we have.

4. Your part

Collect only what you need, tell your customers what you collect and why (the privacy notice we generate for your booking page helps), and get consent where the law requires it, including before recording health, allergy or religious information.
Only send marketing to people who agreed to receive it, as the Acceptable Use Policy explains.
Keep your staff’s access to what their role needs.
When you enter details someone gave you another way, such as a phone booking, a booking made for someone else, or a list you import, make sure those people know you hold them and where to find your privacy notice. Importing a list does not give you consent to market to it.

5. Sub-processors and overseas transfers

We use the providers on our Sub-processor list, which names each one, what it does and where it processes data. Most of your data is stored in Sydney, Australia, but some providers process it overseas, including in the United States, Malaysia and, for the AI assistant, possibly China. We tell you this so your own privacy notice can tell your customers where their information may go.

At least 30 days before we add a provider that will handle your customers’ information (or as soon as we can, if an urgent replacement is needed to keep the service running), we update the list and its date and email account owners. If you object on reasonable grounds and we cannot address it, you can end the agreement and we will refund any amount you prepaid for the time after that.

6. If something goes wrong

If we become aware of unauthorised access to, or loss of, your customers’ information, we will tell you without undue delay, aiming to do so within 72 hours of confirming it, with what we know and what we are doing about it. We will help you assess whether it must be notified under Australia’s Notifiable Data Breaches scheme or New Zealand’s Privacy Act 2020, and work with you on notifying the people affected where that is needed.

7. The AI assistant

If you or your staff ask the in-app assistant a question, the customer information needed to answer it is sent to AI model providers, as the AI Terms explain. You can choose not to use the assistant with customer information.

8. When the agreement ends

Export what you need before you close your account: closing it deletes your workspace, including your customers’ information, straight away. A deleted record can remain in our encrypted backups for up to 90 days before it ages out, and is not restored or used. Billing records about your own subscription are kept as the Privacy Policy describes.

9. Questions and information

We will answer reasonable questions about how we protect your customers’ information, at privacy@gaplessly.com. The liability terms in section 16 of the Terms of Service apply to these terms.