Privacy Policy

Last updated: October 2026. Bookting is operated by JOTO LTD, the data controller for platform accounts and data processor for venue customer data.

What we collect

• Venue owners: email, password (hashed), business name and settings, Stripe account ID.
• Customers booking with a venue: name, email, optional phone, waiver signature name, booking details, promo/voucher codes used.
• Technical: cookies (session only), IP and browser data for security, utm_source parameters a venue adds to its links.

How we use it

To operate bookings, send confirmations and reminders, process payments via Stripe, allocate capacity and check-in, and show venue owners their bookings. We do not sell personal data and do not use customer data for our own marketing.

Sharing

With Stripe (payments), Resend (email delivery), Neon/Vercel (hosting), and the venue you booked with. No other third parties.

Retention and rights

We keep data while a venue uses Bookting. You can request access, correction, or deletion of your data at any time — contact support@bookting.co or the venue you booked with. Under GDPR you also have the right to complain to your supervisory authority (ICO in the UK).

Security

Passwords are hashed (bcrypt), sessions are httpOnly cookies, payments never touch our servers (handled by Stripe Checkout), and all traffic is TLS.