Privacy Policy

Booked55 ("we," "us," or "our") operates the Booked55 platform, including the web application, website, API, and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service.

We are committed to protecting your privacy and handling your data with transparency. Please read this policy carefully. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, password, and organization details when you register.
• CRM data: Contacts, companies, deals, events, tasks, activities, pipelines, campaigns, newsletters, sequences, notes, tags, and files you upload. For each contact this can include their name, email addresses, phone numbers, employer, job role, social profiles, where and when you met, notes you write about them, and files you attach.
• Contacts imported from your device: If you choose to add people from your phone's address book, the app reads your contacts on your device so you can pick who to import. Only the people you actually select are sent to us — we do not upload your address book, and we do not read it in the background. You can revoke this access at any time in your phone's settings.
• Voice input: If you press the microphone button on a note or description field, your device records while you hold it on and streams the audio to our speech-to-text provider, which returns text. The recording is never stored — by us or, once transcribed, by them — and only the text lands in the field you were typing in. There is no background listening and no wake word, and you can revoke microphone access at any time in your browser or phone settings.
• Data about other people: Most CRM data is personal information about your contacts rather than about you. You decide what to record about them, and you are responsible for having a lawful basis to do so — we process it on your instructions. See Section 13.
• Communication data: Email content when you use our Gmail integration, campaign messages, and email templates.
• Payment information: Billing details processed through our third-party payment provider. We do not store full credit card numbers on our servers.
• Support communications: Messages you send to our support team.

1.2 Information Collected Automatically

• Usage data: Pages visited, features used, clicks, and navigation patterns within the platform.
• Device information: Browser type, operating system, device type, and screen resolution.
• Log data: IP address, access times, referring URLs, and error logs.
• API request logs: For security, debugging, and abuse detection we log requests to our API — the endpoint, method, status, response time, your user, session and organization identifiers, IP address, browser, and the request and response content. Because that content is the CRM data of the request, these logs can contain personal information. They are automatically deleted after 90 days.
• Session records: When you log in we store the session, your IP address, browser, and operating system, so you can review and revoke active sessions.
• Cookies and similar technologies: We use cookies for authentication, preferences, and analytics. See Section 8 for details.

1.3 Product Analytics (PostHog)

We use PostHog, a product analytics service, to understand how users interact with our website and web application. PostHog helps us improve the Service by collecting information about your use of the platform, including:

• Page views: Which pages and screens you visit within the Service.
• Clicks and interactions: Buttons clicked, links followed, and navigation paths through the platform.
• Session recordings: Recordings of your screen activity within the Service (such as mouse movements, scrolling, and clicks) to help us identify usability issues and improve the user experience. Sensitive fields such as passwords are masked.
• Feature usage: Which features you use and how often, to help us prioritize product improvements.

On the public marketing website, PostHog only sets cookies and records sessions once you have accepted analytics cookies in the consent banner. Until then it runs without any cookies or local storage and sees only anonymous page views for that visit.

PostHog data is used solely for product analytics and improvement. We do not use PostHog data for advertising, and we do not sell analytics data to third parties. When you are logged in, PostHog may associate analytics events with your account identifier and email address. PostHog's privacy policy is available at posthog.com/privacy.

1.4 Visitor Tracking and Advertising on Our Marketing Website

On our public marketing website (booked55.com pages such as the home page, blog, and pricing) we use two advertising and marketing technologies. Both run only after you accept advertising cookies in the consent banner, and neither is present in the logged-in web application.

• Google Ads conversion measurement (the Google tag): lets us see whether a visit that came from one of our Google ads led to a sign-up, so we can tell which ads are worth running. Google sets cookies for this and receives your IP address and the page you visited. Until you consent, the tag sends Google only cookieless, aggregated signals (Google "consent mode") that cannot identify you. The same tag runs on the sign-up and onboarding pages of the dashboard (dashboard.booked55.com) so that a completed sign-up can be counted; it honours the choice you made here and asks nothing further. Google's privacy policy is available at policies.google.com/privacy, and you can also opt out of personalised advertising at adssettings.google.com.
• Apollo.io website tracker: records the pages a visitor views along with their IP address and uses it to infer the company a visitor may be browsing from, so we can understand which businesses are interested in Booked55. Apollo's privacy policy is available at apollo.io/privacy-policy.

You can change your choice at any time from the "Cookie settings" link in the website footer, or here: Manage cookie preferences. Declining does not affect your use of the product.

1.5 Information from Third-Party Integrations

When you connect third-party services (such as Gmail or Google Calendar), we access data as authorized by you through OAuth. We only request the minimum permissions necessary for the integration to function. You can disconnect these integrations at any time from your account settings.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your CRM data as directed by you (contact management, pipelines, campaigns, etc.)
• Enable AI-powered features such as email drafting, company search, and contact enrichment
• Send transactional emails (account confirmations, password resets, billing receipts)
• Provide customer support
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address security issues and abuse

We do not sell your personal information. We do not use your CRM data or relationship data to train AI models for use by other customers or third parties.

3. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you signed up for.
• Legitimate interests: Analytics, security monitoring, and service improvements, where these do not override your privacy rights.
• Consent: Where you have given explicit consent, such as connecting third-party integrations or opting into marketing communications.
• Legal obligation: Where we are required to process data by applicable law.

4. Data Sharing and Disclosure

We may share your information in the following circumstances:

• Subprocessors: Third-party companies that process data on our behalf so the platform can function. Each is contractually obligated to protect your data and may only use it to provide services to us. They fall into six categories: infrastructure and storage, AI providers, data enrichment, email and calendar integrations, payment processing, and analytics and monitoring.
• Analytics provider: We share usage and interaction data with PostHog for product analytics as described in Section 1.3.
• Within your organization: Other users within your Booked55 organization can access shared CRM data as configured by your organization's admin.
• Legal requirements: When required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

We do not share your CRM data with other Booked55 customers or use it for cross-account purposes, and we do not sell personal information to anyone.

5. Data Retention

We retain your personal information and CRM data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account and CRM data: Retained while your account is active. When you delete your organization, records are marked deleted immediately and removed or anonymized within 90 days, except where we must keep them for legal, accounting, or regulatory reasons.
• Uploaded files: When you delete a file, or delete your organization, the file becomes inaccessible immediately and is permanently erased from our storage provider within 30 days.
• API request logs: Automatically deleted 90 days after they are written.
• Sessions: Expire automatically, and you can revoke any active session yourself at any time.
• Billing records: Retained as long as required by tax and accounting law, typically seven years.

You may request deletion of specific data at any time by contacting us at the email address listed below. You can also delete individual contacts, files, and other records directly in the app.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

For California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us using the details in Section 14.

For Canadian Residents (PIPEDA)

If you are a Canadian resident, you have the right to access your personal information, challenge its accuracy, and withdraw consent for its collection, use, or disclosure. We collect and use personal information only for purposes that a reasonable person would consider appropriate in the circumstances. To exercise your rights, contact us using the details in Section 14.

7. Data Security

We implement technical and organizational measures designed to protect your personal information, including encryption of data in transit (TLS/SSL), access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. For more details on our security practices, see our Security page.

8. Cookies and Analytics Technologies

We use the following types of cookies and similar technologies:

• Essential cookies: Required for authentication, security, core platform functionality, and to remember the cookie choice you made. These cannot be disabled.
• Analytics cookies (PostHog): PostHog sets cookies and local storage entries to track page views, user sessions, and feature usage across our website and web application. These help us understand how the Service is used so we can improve it. PostHog may also use session recording technology as described in Section 1.3. On the marketing website these are set only with your consent.
• Advertising cookies (Google Ads, Apollo.io): On the marketing website only, and only with your consent, as described in Section 1.4. They let us measure whether our advertising leads to sign-ups and which companies are interested in Booked55. We do not sell your data and we do not use these cookies to show you Booked55 ads on other sites (retargeting).

When you first visit booked55.com you are asked which non-essential cookies you allow. Nothing non-essential is set until you answer, and "Reject non-essential" is always available with one click. Your choice is stored for 180 days and can be changed at any time from the "Cookie settings" link in the website footer or here: Manage cookie preferences.

Inside the logged-in application, analytics runs as described in Section 1.3; you may request opt-out of session recordings by contacting us.

9. AI Features and Your Data

Booked55 uses artificial intelligence throughout the product. AI features include:

• The AI assistant — a chat assistant inside the app that can read and modify your CRM data on your instructions.
• Email and campaign drafting, rewriting, and review.
• Business-card scanning — images you scan are read by an AI vision model to extract contact details.
• Contact and company enrichment and AI-assisted company search.
• CSV import mapping, data cleanup, pipeline coaching reports, and task suggestions.
• Dictation — when you press the microphone button on a note or description field, what you say is streamed to a speech-to-text provider and returned as written text.

These features are powered by third-party AI providers, not by models we run ourselves. When you use an AI feature, the data needed for that specific request — which may include contact details, email content, notes, uploaded files, images you scan, or audio you dictate — is transmitted to one of those providers to generate the result. We currently use Anthropic, AssemblyAI, Cerebras, Google, and Perplexity; the Subprocessors page records which one is used for what.

Under our agreements with these providers, your data is processed solely to fulfil your request and is not used to train their models, nor to train models for other customers or third parties.

AI features run only when you invoke them. We do not process your CRM data through AI in the background. If you prefer that none of your data is sent to an AI provider, do not use the AI features; the rest of the CRM works without them.

The microphone is on only while you are dictating. It starts when you press the microphone button and stops when you press it again, when you leave the field, or when you switch away from the app. There is no background listening and no wake word. The audio is streamed directly from your browser or phone to our speech-to-text provider; we never receive or store a recording, and only the resulting text is saved — into the field you were typing in, and nowhere else. Your device will show its own recording indicator whenever the microphone is live.

AI output can be wrong. Enrichment results, drafted emails, extracted card details, and analysis are generated by statistical models and may be inaccurate or incomplete. Review AI output before relying on it, especially before sending it to a client or saving it as a record about a person.

Human review of safety concerns. If a conversation with the AI assistant suggests a risk of harm to you or someone else, our system may notify a member of the Booked55 team so a person can review it. This is a safety measure, not general monitoring — we do not read your conversations routinely.

If you connect Booked55 to external AI clients through our MCP (Model Context Protocol) server, data shared with those clients is governed by the respective client's privacy policy in addition to this one. You control which tools and data are exposed through the MCP integration.

10. International Data Transfers

Your data may be processed in countries other than your country of residence, including the United States and Canada. When we transfer data internationally, we implement appropriate safeguards to protect your information, including contractual obligations with our service providers.

11. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice on the Service prior to the change becoming effective. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

13. Your Contacts' Data (Controller and Processor)

Booked55 is a CRM, so most of the personal data in it is about people who never signed up for Booked55 — your contacts. It matters who is responsible for that data:

• For your own account data (your name, email, billing details, how you use the app) we are the controller — we decide how it is used, and this policy governs.
• For the CRM data you enter about your contacts and companies, you are the controller and we are your processor — we store and process it on your instructions and do not decide what it is used for.

As controller of your CRM data, you are responsible for having a lawful basis to collect and store information about your contacts, for telling them how their data is used where the law requires it, and for responding when one of them asks to access or delete their information. We will help you meet those requests — you can edit and delete contact records directly in the app, and you can contact us for assistance.

If you are a contact stored in someone's Booked55 account and want your information accessed, corrected, or deleted, the fastest route is to contact the business that holds your details, since they control that record. You may also write to us at the address below and we will forward your request to them and assist.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a privacy concern, please contact us:

Email: [email protected]
Website: booked55.com/contact

If you are located in the EEA and believe we have not adequately addressed your data protection concern, you have the right to lodge a complaint with your local data protection authority.