Privacy Policy
What we collect when businesses, their clients and visitors use BookVault AI, why, who processes it for us, and the choices you have.
Last updated October 29, 2026
Draft for review. This document describes how BookVault AI works today and is being reviewed before it is final. Questions are welcome at support@bookvaultai.com.
This policy explains what personal information BookVault AI collects when businesses, their clients and visitors use our website and software, how we use it, who processes it for us, how long we keep it, and your choices.
The short version
- We use personal information to run BookVault AI. We do not sell it, and we do not use it for advertising.
- Card details go straight to Stripe; we never see or store full card numbers.
- Businesses control the information they keep about their clients; we process it for them.
- Our texts end with “Reply STOP to opt out”.
- Write to support@bookvaultai.com for a copy of your information or to have it deleted.
Who this policy covers
BookVault AI is booking and business software. Three groups of people use it:
- Businesses: the owner who signs up and the staff they invite (managers, front desk, providers). For their account information we decide how it is used.
- Their clients: people who book online, chat with a business's assistant, or receive reminders, quotes or arrival links. The business decides what it collects about its clients and uses BookVault AI to process it on its behalf. If you are a client, the business you booked with is your first contact for questions about your information; we help businesses answer those requests.
- Visitors to this website.
What we collect
Business accounts
- Owner and business details: name, business name, e-mail, phone number (confirmed with a text code), website and address.
- Staff details the business adds: names, e-mail addresses, phone numbers, photos, bios, specialties, working hours, time-off requests and, if the business uses payroll, payment amounts and dates.
- Sign-in details. Passwords are stored only as one-way hashes (Argon2), never in readable form.
Information businesses keep about their clients
- Names, phone numbers, e-mail addresses and addresses.
- Appointments and their services, times, notes and payment status; waitlist entries and group bookings.
- Anything a business writes or uploads to a client record, such as notes and files, and for business clients a company name, billing e-mail and tax ID.
- Quotes, and the client's signature when they accept one (typed or drawn), with the IP address and browser of the device used.
- Gift card purchases, including the recipient's name, e-mail and message.
Online booking, chat and messages
- When a client books online: their name, phone number, e-mail, the service and the time they chose.
- When someone uses a business's chat assistant: the messages they type are sent to our AI provider to write the replies. We do not store chat transcripts. If they ask to book, their name, phone number, e-mail, the service and the time they asked for are saved for the business as a booking request.
- Texts and e-mails sent through BookVault AI, and replies to them, are logged for the business (who, when and the message).
Payments
- Card details are typed into forms provided by Stripe and go straight to Stripe. We never receive or store full card numbers; we keep Stripe's reference numbers for the customer and the card.
- Businesses take payments from their clients through their own connected Stripe account: deposits, and no-show or late-cancellation fees charged to a saved card when the business requires a card to book. In-person card payments go through Stripe card readers.
- A business's BookVault AI subscription is charged to the card it saves with us, through Stripe.
Location
- If a business uses live arrival tracking and a staff member turns on location sharing, we receive that device's location while sharing is on. We keep only the latest position. A client with a tracking link sees an approximate location (to about 1 km) for a limited time.
- Addresses may be sent to Google Maps to work out travel times between jobs.
Google Calendar, if you connect it
- We receive your Google account's e-mail address and your list of calendars, and we add, change and remove events in your calendar for your appointments. Those events include the client's name, contact details, notes and the service address. We do not read the other events in your calendar.
Technical information
- For each sign-in: IP address, browser, operating system and device type, and security logs of sign-ins and administrative actions.
- IP addresses, and for some limits an e-mail address or phone number, used for a short time to stop abuse such as repeated sign-in attempts.
- Pages viewed and page-speed measurements, through Vercel Web Analytics and Speed Insights, which do not use cookies.
- Error reports through Sentry. For some visits, and for visits with an error, these can include a recording of how the page was used, with all text masked and images blocked.
When you contact us
- Contact form: your name, e-mail, company and message.
- Support requests and bug reports from the app: your name, e-mail, role, business, description and the page you were on.
- The “Ask Vaulty” chat on this website: your messages are sent to our AI provider to write the replies.
How we use it
- To provide BookVault AI: bookings, schedules, reminders, messages, payments, quotes, calendar sync and arrival tracking.
- To keep accounts safe: verification codes, sign-in sessions, rate limits and bot checks.
- To bill subscriptions, and to send service e-mails such as account activation, password resets, staff invitations, receipts and trial reminders.
- To answer support requests, and to find and fix problems (error reports and page-speed data).
- To meet legal obligations and enforce our terms.
What we do not do
- We do not sell personal information, and we do not share it for advertising.
- We do not show ads, and this website uses no advertising or cross-site tracking cookies.
- We do not use your data or your clients' data to train AI models.
- We do not share mobile numbers, or consent to receive texts, with anyone for their marketing.
Text messages
Businesses can send appointment reminders and messages by text through BookVault AI, and we text a code to confirm an owner's phone number at sign-up. How often you receive texts depends on your bookings. Message and data rates may apply.
Our texts end with “Reply STOP to opt out”. Reply STOP to stop texts from that number. For help, contact the business that texted you, or write to support@bookvaultai.com.
How long we keep it
- Sign-in sessions end after 24 hours; text verification codes expire after 10 minutes and password reset links after 1 hour.
- Staff invitations expire after 7 days.
- Arrival tracking links expire an hour after the appointment ends; records of who opened them are deleted after 7 days.
- Uploaded import files are deleted after 7 days; payment-event records from Stripe after 90 days.
- Account, client, appointment and payment records are kept while the business account is open. They are not deleted automatically when an account closes: ask us and we will delete them, except records we must keep by law, such as tax and payment records.
Security
Data travels over HTTPS. Passwords are hashed with Argon2, and the keys that connect your Google and Stripe accounts are encrypted. Staff see only what their role allows, and sign-ins are protected by rate limits and bot checks. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires.
Your choices and rights
You can see and correct most of your information in the app. To get a copy of your information, or to have it deleted, write to support@bookvaultai.com. Depending on where you live, for example in California or the European Union, you may also have the right to know what we hold about you, to correct or delete it, to receive a copy, and to object to or limit how we use it. We will not treat you differently for using these rights.
If you are a client of a business that uses BookVault AI, ask that business first: it controls your information. If you write to us, we will pass your request to the business.
Health information and children
BookVault AI is not built to meet HIPAA requirements, and its health and wellness setup is not available yet. Please do not use it to store medical or other health information.
BookVault AI is made for businesses, not for children. Some businesses serve minors, such as tutors and coaches; they are responsible for any consent the law requires before they enter a minor's information.
Where data is processed
BookVault AI is run from the United States, and the services above may process data in the United States and other countries.
Changes to this policy
When we change this policy we will update the date at the top. If a change is significant, we will tell account owners by e-mail or in the app before it takes effect.
Contact us
Questions or requests about privacy: support@bookvaultai.com. BookVault AI, Middleton, Idaho, United States.