Privacy policy

Effective 8 September 2026, updated 24 September 2026 (booking tools you connect). HoldFee, Melbourne, Australia. Questions and requests: team@holdfee.app.

Who this covers

Three kinds of people meet HoldFee: business owners who install the plugin and use the service, their clients who receive a secure link and save a card, and visitors to the estimator page on holdfee.app. This policy says what is collected from each, why, where it lives, for how long, and who else sees it.

Business owners

Nothing leaves your site until you act. Installing the plugin and viewing the calculator make no network request. The report is computed on your own server from your own booking tables.
The "Is this number right?" answer sends your yes or no, your own count if you gave one, the report's counts, your booking app and its data grade, the plugin version, your timezone and how long the report took. Nothing about individual bookings or clients.
Registering sends your site address, your WordPress admin email, the site's timezone and locale, and the booking apps installed. From then on a check-in every six hours carries the same facts plus version numbers and timings, so we can tell you when something on your site stops working. If your site has been quiet for seven hours, we load its public wp-cron.php address once an hour, as a visitor's page load would, so WordPress runs the plugin's scheduled scan. That request carries nothing and reads nothing.
With protection on, each new booking and each status change is sent as an event: the booking's reference in your app, the service name, start and end time, price, status, and the client's email address, which is how the secure link reaches them. Names, phone numbers and notes stay on your site.
Your account holds your email (for signing in and notices), a salted hash of your password if you set one (never the password itself), your Stripe account identifier (if you connected an existing Stripe account, that is all Stripe tells us, never your Stripe password), your subscription state, your fee settings and policy text, and an audit trail of what you did on your dashboard.

Booking tools you connect

Bookings you type in (phone, WhatsApp or messages): the client's first name and email, the day and time, and the service and price if you give them. They are kept like any other booking.
Calendly and Google Calendar: you connect them by signing in to that service and allowing HoldFee in, and you can disconnect at any time from your dashboard or from the service itself. HoldFee receives a key to your account there and keeps it encrypted. Your password for that service never reaches us. We read only what a booking needs: each booking's time, the service or event title, and the client's email and name. From Calendly also whether the client or you cancelled or moved it, and your no-show mark. From Google Calendar, the list of your calendars (so you can choose the one your bookings go into) and the events in that calendar with one guest. Events you untick are not used. HoldFee never adds, changes or deletes anything in your calendar or your Calendly.
Cliniko: you connect it by pasting an API key from your Cliniko account (My info, Manage API keys), which you can archive there at any time. HoldFee keeps it encrypted. We read only each appointment's time and type, whether it was cancelled (and when, with the reason you recorded) or marked did not arrive, the patient's name, email and mobile, and whether the appointment's invoice is paid, and its total. Never notes, cases or anything clinical. HoldFee never adds, changes or cancels anything in your Cliniko.
YouCanBookMe: you connect it by pasting your account ID and an API key from YouCanBookMe (My Account, Security), which you can delete there at any time. HoldFee keeps the key encrypted. We read only each booking's time, its booking page or appointment type, whether it was cancelled (and by whom, and when) or marked a no-show, whether it was paid online, and the client's first name, email and phone. HoldFee never adds, changes or cancels anything in your YouCanBookMe.
SuperSaaS: you connect it by pasting your account name and the API key from your SuperSaaS account (Account Info), which you can replace there at any time. HoldFee keeps the key encrypted. We read only each booking's time and schedule or service, its status and price, whether it was deleted (and by whom, and when), and the client's name, email and phone. To tell your staff from your clients, we also read the list of your SuperSaaS users and keep only a salted hash of each superuser's login name and email, never the names or emails themselves. HoldFee never adds, changes or cancels anything in your SuperSaaS.
Zoho Bookings: you connect it by signing in to Zoho and clicking Accept, which you can take back in your Zoho account at any time. HoldFee keeps the permission encrypted and follows your account's own Zoho region. We read only each booking's time, service and status, whether it was cancelled (and by whom, and when) or marked a no-show, whether it was paid online, and the client's name, email and phone. HoldFee never books, moves or cancels anything in your Zoho Bookings.
Google user data. HoldFee's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use it only to protect your bookings as described here, never for advertising, never sold, and no person reads it except to fix a problem you ask us to look at, for security, or where the law requires.

Clients of a business

The secure link opens a page showing the business's cancellation policy. If the client accepts and saves a card, we keep a consent record: the policy text as shown, the acceptance wording, the time, the IP address and browser identifier of the acceptance, the card's brand and last four digits, and Stripe's reference for the card. A copy of what the client saw is kept as an evidence bundle for the business in case of a dispute.
Card numbers never reach HoldFee. The card form is Stripe's, loaded from Stripe, and the number goes to Stripe directly and HoldFee holds only a reference. Stripe's own privacy policy covers what Stripe collects, including the fraud-prevention data its form gathers.
Clients receive emails about their booking: the secure link (and one reminder if it is left unopened for a day), a notice before any fee, a receipt, and a request to authorise a payment if their bank asks for it. No marketing.

Visitors to the estimator page

A booking export dropped on holdfee.app/estimate is read in your browser. Only dates, statuses and prices are sent to compute the number. Names, emails and phone numbers are stripped before anything leaves the page. We record which steps a visitor took (counts and timings, no file contents). If a visitor asks for the report by email, we keep that address and the report's totals. Where a column heading cannot be recognised, the heading alone (never a cell) may be sent to an AI model to classify it.

Where data lives and for how long

The service and its database run on Render in Singapore. Evidence bundles are stored in object storage on Cloudflare and deleted 18 months after the consent they belong to. Server logs are kept for 90 days and carry no card, key or client name. The record of each call we make to Stripe is kept for 90 days.
Booking and consent records are kept while the business's site is registered and for 18 months after, which is the window in which a card payment can be disputed. A business can ask us to delete earlier, subject to that window for records tied to a charge.
Uninstalling the plugin tells the service to stop protecting the site. It does not by itself delete records tied to charges, for the same reason.

Who else sees it

Only the providers the service runs on, each for its part and under its own terms: Stripe (payments, cards, payouts, disputes), Render (hosting and database), Cloudflare (domain, network, evidence storage), our email delivery provider (the notices above), and, for unrecognised column headings on the estimator page only, Anthropic. We do not sell data and do not share it with anyone else except when the law requires.

Cookies

The salon owner's dashboard uses one sign-in cookie. The card page loads Stripe's form, which sets Stripe's cookies for fraud prevention. No advertising or tracking cookies.

Your rights

You can ask what we hold about you, ask for it to be corrected or deleted (within the retention window above for records tied to a charge), and ask us to stop emailing you. Write to team@holdfee.app. We answer within 30 days. If you are in Australia and unhappy with our answer, you can complain to the Office of the Australian Information Commissioner. If you are in the UK or EU, you have the rights the GDPR gives you and can complain to your local authority.

Changes

When this policy changes, the date at the top changes and registered businesses are told by email. Older consent records keep the policy text that applied when the client accepted.