Privacy Policy

1. Who we are

CalyPad is operated by Number Pii. For our marketing site and platform account data we act as the data controller. For the customer data a business (a tenant) manages through CalyPad, that business is the controller and CalyPad acts as its processor. You can reach us about privacy at privacy@calypad.com.

2. Information we collect

• Account data for businesses: name, email, phone, business details, and login credentials.
• Customer booking data: name, phone number, email, appointment history, and loyalty activity.
• Messaging data: SMS consent status, the time and IP address consent was given, and message delivery logs.
• Legal acceptance records: Terms and Privacy consent status, document versions, acceptance time, IP address, and browser user agent.
• Payment data: handled by our payment processor, Stripe. We do not store full card numbers.
• Technical data: device, browser, and usage information collected to operate and secure the service.

3. How we use your information

• To provide bookings, loyalty, and account features.
• To send one-time passcodes and account or appointment notifications you have requested.
• To send marketing or loyalty messages where you have opted in.
• To secure the service, prevent fraud, and meet legal obligations.

4. SMS and text messaging

CalyPad sends three categories of text message: one-time passcodes for login, transactional messages about a booking you made (such as confirmations and reminders), and marketing or loyalty messages where you have given consent. Consent for marketing messages is collected through a clear opt-in during the booking flow, and we record the time and IP address of that consent.

Message frequency varies based on your activity. Message and data rates may apply. You can opt out of messages at any time by replying STOP, or by using the opt-out link or account setting where a reply is not supported. Reply HELP for help, or contact support@calypad.com.

We do not share mobile information with third parties or affiliates for marketing or promotional purposes. We share the minimum data necessary with our messaging provider solely to deliver the messages you receive. Text messaging originator opt-in data and consent are not shared with any third party for marketing purposes.

5. Legal bases (UK and EU)

Where UK GDPR or EU GDPR applies, we rely on: performance of a contract (to provide the service and transactional messages), consent (for marketing messages and certain cookies), and legitimate interests (to secure and improve the service). You may withdraw consent at any time.

6. How we share data

We use service providers that process data on our behalf under contract, including Stripe for payments, our SMS provider for message delivery, and Supabase for hosting and database services. We do not sell personal data.

7. Retention

We keep personal data only as long as needed for the purposes above or as required by law. Guest booking data is deleted automatically after a per-business retention window. Legal acceptance records are kept as long as needed to evidence consent and resolve disputes. Message logs are kept for up to 24 months to support delivery monitoring and dispute resolution, then deleted automatically.

8. Your rights

Depending on your location you may have rights to access, correct, delete, or restrict the use of your data, to object to processing, and to data portability. You can opt out of marketing at any time. To exercise a right, contact privacy@calypad.com. You may also complain to your local data protection authority, such as the UK Information Commissioner's Office.

9. International transfers

Where data is transferred outside the UK or EEA, we use appropriate safeguards such as standard contractual clauses.

10. Security

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, and tenant data isolation.

11. Changes and contact

We may update this policy and will revise the date above when we do. Questions can be sent to privacy@calypad.com. See also our Terms of Service and SMS Policy.