Privacy notice

1. Who this notice covers

Meli Labs Ltd operates ClickNBook at https://clicknbook.app and is the controller for platform account and operational data. This notice describes the platform’s use of information on our website and mobile app. The business you book with also uses your details to provide its services and is responsible for its own privacy information. Contact support@clicknbook.app with questions or requests about platform data.

2. Information we use

We use account and contact details, business profiles, services and opening hours, booking details, payment references and statuses, subscription records, images you upload, and reviews you submit. We record booking and operational events, email delivery statuses and security checks to investigate failures and prevent misuse. Stripe handles card details; ClickNBook stores payment references rather than full card numbers.

We count discovery, profile and checkout visits using temporary session identifiers held in app memory, without analytics cookies or browser storage. A session may be linked to its booking to count verified payments. These session records are removed after 30 days by a scheduled cleanup. We also record provider setup milestones, review reports and support decisions. Session counts are estimates, not unique people.

When PostHog is configured, we forward selected operational events using salted identifiers. If you opt into optional app analytics, we also measure page and screen visits and selected checkout interactions. Signed-in activity can be connected across web, mobile and backend using a pseudonymous account identifier. We exclude contact details, form contents, search text and URL parameters from these events. If you allow Session recordings, PostHog receives masked recordings of public discovery screens and interactions so we can investigate navigation issues. We mask text, inputs and images, exclude private account, authentication and checkout screens, and disable console and network-content recording. Skipping or choosing Deny does not start optional analytics or recordings. Select choices opens initially unticked Usage analytics and Session recordings options. Confirm choices saves your selection; editing alone does not enable tracking. Saved choices are restored when you reopen preferences. Allow all enables both. PostHog retention is managed separately from our backend records. You can withdraw optional app analytics through Analytics preferences. Withdrawal stops new optional client collection and discards buffered web events. Native events and recordings already collected with consent may remain queued for delivery. Withdrawal does not delete previously collected events or stop selected backend operational analytics forwarding.

3. Why we use it

We use information to provide accounts, bookings, payment coordination, subscriptions and support under our contract with you. We rely on legitimate interests for service reliability, fraud prevention, security and investigation of problems, while considering your rights. We use information to meet legal obligations where applicable. Booking confirmations, reminders and changes are service emails; the launch service does not send marketing campaigns. We ask for your consent before starting optional web or mobile product analytics to understand navigation and checkout interactions and improve the service. You can decline or withdraw this consent without losing access to accounts or bookings.

4. Who receives it

Your booked business receives the contact and booking information needed for your appointment. Public business profiles, portfolio images and submitted reviews are visible to website visitors. We currently use Vercel for website hosting, Convex for application data and backend hosting, Stripe for payments, and Resend for service email delivery. When analytics is configured, PostHog receives the selected pseudonymous events described above. See PostHog's privacy information. We will update this notice if our service providers change. Providers may process information internationally; applicable contractual safeguards and transfer arrangements must be maintained for the services we use.

5. Retention and security

We keep information for as long as needed to provide the service, handle booking or payment disputes, protect accounts and meet applicable legal obligations. Retention depends on the record and reason for keeping it. We restrict access by role and use verification checks, but no system can guarantee absolute security. Contact support to request account or data deletion; some transaction records may need to be retained. PostHog events follow the retention settings of our analytics project; the 30-day cleanup of backend visit sessions does not automatically delete copies already sent to PostHog. Withdrawing optional analytics stops future optional client collection. Contact support to request deletion of previously collected data.

6. Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it. We may need to verify your identity to protect your information. You can complain to the UK Information Commissioner’s Office at ico.org.uk.

7. Updates

We will update this notice when the service or our use of information changes. Contact us before uploading sensitive personal information that is not needed for a booking.

8. Contact

For platform support, privacy requests or billing questions, email support@clicknbook.app. Include your booking reference where relevant. Never send card details or verification codes.