Privacy Policy, how we handle your data

1. Who we are

Gaplessly ("we", "us") operates a booking and reservation platform that businesses use to take appointments and table reservations from their own customers. Gaplessly is the trading name of Bruno De Angelis Oliveira Melani, a sole trader (ABN 20 158 630 795), based in Australia. This policy is written against the Australian Privacy Act 1988 and the Australian Privacy Principles, with additional sections for visitors covered by New Zealand’s Privacy Act 2020, Canada’s PIPEDA, the EU/UK GDPR and California law. As a small business we may not be bound by the Australian Privacy Principles, but we handle personal information as if we were, and we will update this policy if that changes.

Questions about this policy, or any request about your own information, go to privacy@gaplessly.com.

2. The two roles we play, and why this one matters

Gaplessly is used by two very different groups of people, and our responsibilities are not the same for each. Getting this distinction right matters more than anything else in this policy.

• If you run a business on Gaplessly (you signed up, you have a dashboard login), then we are the controller of your account information. This policy governs it directly.
• If you booked an appointment or a table with a business that happens to use Gaplessly, that business is the controller of your booking. We are its processor: we store and transmit your details at its direction, including any feedback or review request it chooses to send you, and we do not decide what happens to them. Ask that business for its own privacy policy, and send requests to delete or correct a booking to them, not to us. If you contact us anyway we will pass the request on and tell you we have.

Everything below distinguishes "account data" (yours, if you run a business) from "booking data" (your customers', held on your behalf).

Our Data Processing Terms set out that processor relationship and apply automatically as part of the Terms of Service. If you are a staff member invited by a business, the Staff Notice explains how we handle your login. If you need a signed data processing agreement, for example because the GDPR applies to your business, ask at privacy@gaplessly.com; it will not change any of the commitments already made here.

3. What we collect

4. Website analytics

On the booking pages we host for our customers we run one analytics tool: a private, self-hosted instance of Umami, an open-source product, run on our own infrastructure rather than a third party's. It counts page views, visitors, which pages are popular, where visitors came from, and coarse device and country information, so a business can see how its own booking page is doing. It also records how far a visitor gets through the booking form, meaning which step they reached and whether they finished, never anything typed into it, so a business can see where people stop booking.

It does not set a cookie, and it does not need your consent, because of how it is built rather than because we have decided not to ask. A visitor is counted using a hash of their IP address, browser and the day, computed once and never stored, then discarded and recomputed fresh the next day: there is no persistent identifier, on your device or in our records, connecting one day's visit to the next, and nothing here can follow you to another website. That is a materially different thing from Google Analytics, Meta Pixel or a session recorder, and this tool is still none of those.

On this marketing site only, and never on a booking page, a business's own website or the dashboard, we use Google Analytics to understand how people find and use our own pages: which pages they read, where they came from, and whether they went on to request access. Unlike the tool above, it sets Google's own first-party cookies (_ga and _ga_ followed by our property ID, each lasting up to two years) so a returning visitor is counted once. In the regions listed in the Cookie Policy's section 1 it sets no cookie until you accept, and until then sends Google only the cookieless, identifier-free signals that section describes. We use it for our own measurement only, not for advertising, and Google processes what it collects on our behalf, so Google is listed with our other sub-processors in section 7. See the Cookie Policy's section 4 for how to block it.

A business can separately choose to connect its own Meta Pixel or Google Ads tag to its booking page and website, so its own ad campaigns can be measured, and its own Google Analytics, so it can see its visits in its own account on top of the tool above (Settings > Booking rules > Ad tracking & analytics). That is real third-party tracking, off by default, it only ever runs on a page whose owner switched it on, and in the regions listed in the Cookie Policy's section 1 sets no cookie until you accept (the Cookie Policy's section 1 explains the cookieless signals Google's tags send before that). See the Cookie Policy's section 4 for what that means for you as a visitor, and how it differs from the analytics tool above.

A business can also separately choose to connect its own Microsoft Clarity project to its booking page and website (Settings > Booking rules > Heatmaps & recordings). That is a different thing again from either of the two above: not ad measurement, but a heatmap and session-recording tool, so a business can watch (anonymised, aggregated or as a session replay, depending how the business has configured its own Clarity project) how visitors actually move through its page. Whatever masking setting the business picks in its own Clarity project, the booking page marks a guest's name, contact details, notes, payment details and private manage-booking link as masked, so Clarity never uploads them, and card numbers are typed into Stripe's own secure field, which Clarity cannot record at all. A page whose address is itself a private link, such as managing a booking or spending a gift card, never loads it. Off by default, and it only ever runs on a page whose owner switched it on. Microsoft is the operator of Clarity and processes what it collects under its own privacy terms; we do not receive, store or read what Clarity records. See the Cookie Policy's section 4 for what that means for you as a visitor.

Separately again, we run PostHog, a product analytics and session-recording tool, on this marketing site and on the dashboard itself, so we can see how our own product is actually used and improve it. This one is not a business's own account: it runs for every visitor to this site and every signed-in user of the dashboard, after they accept where the Cookie Policy's section 1 says we ask. Unlike the booking-page analytics tool at the top of this section, it sets cookies. On the dashboard, where every screen holds a business's client records, it masks all text and every form field before a recording leaves the browser, so a recording shows where people click and how they move through the app, never whose details were on screen. On the dashboard it is also linked to your account ID, your business and your role in it, so we can see how each business uses the product; your own name and email are not sent to it. PostHog processes what it collects for us in the United States. It receives your IP address, which it uses to work out an approximate location, such as the country and city, for each visit. Its requests go to relay.gaplessly.com, an address on our own domain that PostHog operates and forwards straight to PostHog, so it is PostHog receiving the data either way. It never runs on a booking page or a business's own website; those stay governed only by whatever that business has itself connected. See the Cookie Policy's section 4 for what this means for you.

5. What else we do not collect, and do not do

Stated plainly because the absence is easy to disbelieve and each of these was verified against the code rather than assumed. Ad tracking and Clarity (section 4) are the two items below with a real, opt-in exception, called out where they apply:

• We do not sell personal information, and we have never done so. We do not share it in the specific sense the CCPA defines either, UNLESS a business you are visiting has connected its own Meta Pixel, Google Ads tag, Google Analytics or Microsoft Clarity project: doing so sends your visit to that business’s own ad, analytics or Clarity account, run by Meta, Google or Microsoft for their own purposes, which the CCPA treats as sharing. See "Your rights" below for how to opt out.
• We do not use your data, or your customers’ data, to train machine-learning models.
• We never see a full payment card number. Card details are entered directly into Stripe’s hosted fields and never touch our servers.
• We do not build cross-site profiles ourselves, and beyond the analytics tools and the opt-in ad tracking and Clarity described above, we set no cookie that would let us follow a visitor to another website.
• We do not make decisions about you using automated means alone that significantly affect you. Rules that run automatically, such as which booking times are free or who is offered a waitlist spot, apply the settings a business chose. Our AI features answer questions for a business’s staff and never decide anything about you on their own; the AI Terms explain them.

6. Why we use it, and our lawful basis

We do not market to the customers of businesses on our platform, and we never use their details for our own purposes. Most messages those customers receive are transactional: a confirmation, a reminder, a change, or a request for feedback about a visit that happened. A business may also send marketing messages to its own customers using our tools, but only to people who have agreed to receive them, or who are covered by a written permission declaration the business made to us. Every marketing message carries a working unsubscribe link, and unsubscribing stops that business from sending any more. Unsubscribing applies to that business only, because each business holds its own customer records. A reply of STOP to a text message stops that business texting reminders. The business is the sender and is responsible for its own list; we provide the tools, the unsubscribe and the record of it.

We record what happens to each email after it is sent: whether it was delivered, bounced or marked as spam, and, for marketing messages only, whether it was opened and whether a link in it was clicked, measured with a small image and links that pass through our email provider. A business sees these as totals for its own emails, never as a list of who opened what, and we keep only which kind of mailbox an email went to (Gmail, Outlook and so on), not the address. An address that bounces stops receiving that business's marketing until it is corrected. Marking a message as spam unsubscribes you from that business, and our email provider may also stop delivering mail from our platform to that address.

7. Who we share it with

We use the following sub-processors. This is the complete list, also published with its date as our Sub-processor list; we do not have undisclosed ones. We send each only what its job needs, and each handles it under its own terms with us.

A business can choose to connect its own Google Calendar or Microsoft Outlook calendar (Developer > Integrations, off by default), so its bookings appear there. When an administrator connects one, they sign in with that provider and grant two permissions: to create, update and delete calendar events, and to see the list of their calendars. We use them only to copy that business's bookings into the calendar it chose and keep them current: each event holds the booking's time, a short title such as the service and staff member or the party size and table, and its status, never a customer's name, contact details or private notes. We do not read, store or analyse the other events in that calendar. We store the connection's sign-in tokens encrypted, together with the identifiers of the events we created so we can update or remove them. We do not sell this data, use it for advertising, or use it to train machine-learning models, and no person at Gaplessly reads it except where needed for security, to comply with the law, or with the business's permission. Disconnecting revokes our access with the provider and erases the stored tokens; events already copied stay in the calendar until the business deletes them. Gaplessly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Beyond these, we disclose personal information only where the law compels us to, or where it is necessary to establish or defend a legal claim. If we are ever party to a merger or acquisition, information may transfer as part of that business, and we will say so here before it takes effect.

8. Where your data is stored, and when it leaves Australia

Your database records and uploaded files are stored in Sydney, Australia, and the application serving them runs in Sydney too. That is deliberate: it keeps booking data in the country most of our customers operate in.

Six qualifications, stated because a policy that claimed "all data stays in Australia" would be false. First, the background service that sends your email and SMS notifications runs on a server in Kuala Lumpur, Malaysia; a notification's contents pass through it in transit. Second, the booking-page analytics tool described at the start of section 4 runs on that same Kuala Lumpur server, so the same-day, non-reversible visitor hash it computes is generated there rather than in Sydney, before being discarded the following day. Third, Stripe, Resend, Google, Sentry and PostHog process data in the United States. Fourth, a business that connects its own Meta Pixel, Google Ads tag, Google Analytics or Microsoft Clarity project sends your visit to Meta, Google or Microsoft directly, processed wherever that company processes it, under that company's own policy rather than ours. Fifth, when a staff member asks the in-app AI assistant a question, the data needed to answer it, such as a client's name, email, phone number or a business's revenue figures, is sent to OpenRouter, which routes it to whichever underlying language model is currently answering; that model may be based in the United States or China, and which one is used can change over time. Sixth, our nightly database backup is made and encrypted on a GitHub server in the United States, and the encrypted copy is kept there for 90 days; email to our own contact addresses passes through ImprovMX in the United States or the European Union; and this marketing site's own visits, measured by Google Analytics as described in section 4, are processed by Google in the United States. Where information covered by the GDPR is transferred outside the EEA or UK, we rely on the European Commission's Standard Contractual Clauses.

9. How long we keep it

Closing an account is the point where these two duties pull against each other, so it is worth being exact about what happens. Any live subscription is cancelled immediately and we stop charging you. If teammates remain, your profile and your uploaded files are deleted outright. If no one else is left in your organization, its business closes first: the booking page goes offline, upcoming bookings are cancelled and their guests told, and for 30 days you can sign in and reopen it. When those 30 days have run, the whole workspace, your profile and your uploaded files are deleted outright. The invoices for what you already paid are not: they are our own tax records as much as yours, we are required to keep them for seven years, and an erasure request cannot reach them. They sit with Stripe, they are not a login, and nothing in them can be used to access the service. What we can do there, we do: once the workspace is deleted, any saved card is removed, your contact details are cleared off that billing record, and it is stamped with the date, so it can be purged once the seven years have run rather than sitting there indefinitely. An invoice already issued is frozen as it was written, which is the property that makes it a record.

Backups are a genuine exception worth naming: a deleted record can persist in an encrypted backup for up to 90 days after deletion before it ages out. It is not restored to the live system and is not otherwise accessible.

10. Security

• Every tenant’s data is isolated at the database level by row-level security, not only by application code. A query that escaped our application would still return nothing belonging to another business.
• All traffic is served over TLS, and data is encrypted at rest.
• Passwords are hashed; we cannot read them. Two-factor authentication is available on every account and we recommend turning it on.
• Access to production data by our staff is limited to those who need it to run the service.

No system is perfectly secure. If a breach affects you and meets the threshold for notification, we will tell you and the relevant regulator: within 72 hours where the GDPR applies, and as the Notifiable Data Breaches scheme requires in Australia.

11. Your rights

Wherever you live, you can ask us to give you a copy of the information we hold about you, correct it if it is wrong, or delete it. Write to privacy@gaplessly.com and we will respond within 30 days. We do not charge for this, and we will not treat you differently for asking.

If the GDPR applies to you, you additionally have the rights to restrict or object to processing, to data portability in a machine-readable format, and to withdraw consent where consent was the basis for processing. You may also complain to your national supervisory authority.

If you are a California resident, you have the rights to know, delete and correct, and to opt out of sale or sharing. As set out in section 5, we do not sell personal information and do not share it either, with one opt-in exception: a business you are visiting may have connected its own Meta Pixel, Google Ads tag, Google Analytics or Microsoft Clarity project (section 4). A Global Privacy Control signal from your browser is honoured as that opt-out automatically. To opt out of that sharing, write to privacy@gaplessly.com and we will action it.

Our privacy officer is the person who runs Gaplessly, reachable at privacy@gaplessly.com. If you are unhappy with how we have handled a privacy matter, tell us first and we will try to put it right. In Australia you may then complain to the Office of the Australian Information Commissioner at oaic.gov.au, in New Zealand to the Privacy Commissioner at privacy.org.nz, and in Canada to the Office of the Privacy Commissioner of Canada at priv.gc.ca (or, in Alberta, the Information and Privacy Commissioner at oipc.ab.ca).

One limit, repeating section 2 because it is where these requests most often land in the wrong inbox: if you are the customer of a business that uses Gaplessly, we cannot action a deletion or correction of your booking on our own initiative. That business decides. Write to them, or write to us and we will forward it.

12. Children

Gaplessly is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16 in the course of running an account. A business using our platform may take a booking that names a minor (a parent booking a child's appointment, for instance), and that information is handled as booking data under that business's control. If you believe we hold information about a child in error, write to privacy@gaplessly.com and we will delete it.

13. Changes to this policy

We will post any change on this page and move the "last updated" date at the top. If a change materially affects your rights we will email account holders before it takes effect rather than relying on you to notice.