Privacy Policy
Last Updated: December 2025
1. Introduction
BookOS ("Company," "We," "Our," or "Us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the BookOS mobile application, web application, and associated services (collectively, the "Service").
Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Service.
2. Information We Collect
2.1 Information You Provide Directly
Account Registration Information:
- Full name
- Email address
- Phone number (with country code)
- Company name
- Company country and timezone
- Company currency
- User role/permissions
- Profile photo (optional)
Property and Operational Data:
- Property names, descriptions, and addresses
- Property contact information
- Unit/room numbers and descriptions
- Guest names, email addresses, and phone numbers
- Reservation dates and details
- Housekeeping assignments and status
- Maintenance tickets and descriptions
- Rate plan information
- Financial transaction records
Payment Information:
We do NOT store any credit card information. All payment processing is exclusively handled by Stripe.
2.2 Information Collected Automatically
Location Data:
- Your IP address is used to automatically detect your country for account setup and localization purposes
- This IP data is not stored permanently and is used only for initial country detection
- Your detected country helps us set the appropriate currency and timezone
Device and Usage Information:
- Device type and operating system
- App version and crash logs
- Feature usage and interactions
- Login and logout timestamps
- IP address and general geographic location (city/country level, not precise)
3. How We Use Your Information
We use the collected information for the following purposes:
3.1 Service Delivery
- Creating and managing your account
- Processing your reservations and transactions
- Sending property management and operational notifications
- Providing customer support
- Generating reports and analytics for your business
3.2 Communication
- Sending transactional emails (confirmations, receipts, password resets)
- Sending SMS messages for reservations and alerts (via Twilio)
- Delivering marketing emails about new features (via Brevo)
- Responding to your inquiries and feedback
3.3 Security and Compliance
- Detecting and preventing fraudulent transactions
- Protecting against security threats
- Enforcing our Terms of Service
- Complying with legal obligations
5. Data Storage and Security
5.1 Data Storage Location
Your data is stored in:
- Firebase Firestore (Google Cloud infrastructure) - Main database
- Firebase Storage (Google Cloud) - Photos, images, and documents
- Geographic Regions: Google Cloud global infrastructure (US, Europe, Asia, Australia)
5.2 Security Measures
We implement the following security measures:
In Transit:
- All data transmitted between your device and our servers uses SSL/TLS encryption
- All API communications are encrypted
- Payment data never touches our servers (handled exclusively by Stripe)
At Rest:
- Firebase encrypts all data at rest
- Access controls restrict who can read/write data
- Authentication is required to access any data
- We do not store any payment or credit card information
Payment Security:
- BookOS has no access to credit card data
- Stripe handles all payment processing and security
- Stripe is PCI DSS Level 1 compliant
- Payment tokenization ensures no sensitive data in our systems
7. Your Privacy Rights
7.1 Access Your Data
You can access and review your personal information by logging into your account at any time.
7.2 Delete Your Account
You have the right to delete your account and all associated data. This can be done through:
- Opening the app
- Going to Settings → Profile
- Scrolling to "Delete Account"
- Following the confirmation prompts
- All data will be permanently deleted immediately
Important: Deleting your account is permanent and cannot be undone.
7.6 Regional Privacy Rights
For EU/UK Users (GDPR):
- Right to access (Article 15)
- Right to rectification (Article 16)
- Right to erasure ("right to be forgotten") (Article 17)
- Right to data portability (Article 20)
- Right to lodge a complaint with your supervisory authority
For California Users (CCPA/CPRA):
- Right to know what personal information is collected
- Right to know whether personal information is sold or disclosed
- Right to delete personal information
- Right to opt-out of sale or sharing of personal information
- Right to correct inaccurate personal information
- Right to limit use and disclosure
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:
We will respond to your inquiry within 30 days.