Data and privacy
What the service stores for a business, what it deliberately does not store, and what is reachable from outside.
What is stored
| Data | Contents |
|---|---|
| Customers | name, e-mail address, phone, free-text notes. One record per e-mail address per business. |
| Appointments and bookings | time, service, staff member, number of persons, status, the customer's note, chosen extras |
| Payments | amount, VAT split, status, coupon code, and a frozen snapshot of what was charged |
| Packages and event tickets | planned visits, ticket codes, attendee status |
| the subject and body of every message sent, with delivery status (the send log in the admin) | |
| API keys | name, scopes, the key itself hashed (shown once at creation), revocation time, and an entry per write made with it |
| Calendar feed | per staff member an unguessable token for their iCal feed; the feed contains that person's appointments only |
| Online meetings | meeting links are generated per appointment and appear in mails and in the admin |
Not stored: card or bank details. Online payments happen on the payment provider's own page; only the amount, the status and the provider's reference come back to us — enough to refund and to reconcile.
Isolation
- Every record belongs to exactly one business. An account can only see its own data, in the admin and on every API call.
- The public API is bound to one account by its public key; one key can never read or write another account's data.
- A staff login sees only the appointments of the staff members linked to it.
- Payment settings can only be changed by an owner or admin (see the role table in
05-admin-guide.md).
What is publicly reachable
| URL | Shows | Protections |
|---|---|---|
/b/<token>, /o/<token> |
one booking, or all appointments of one order: service, date, time, staff, status | 48-character random token, noindex, nothing else |
/p/<token> |
remaining visits of a package, plus the customer's first name | same |
/w/<token> |
a freed seat, first come first served | same |
| public API | the catalogue and free times of the business behind the key | the key holder only; an allowlist of embedding sites per account |
/api/ical/<token> |
one staff member's appointments as an iCal feed | 48-character token, noindex; revocable per staff member in the admin |
No endpoint returns customer lists, e-mail addresses or payment details.
Deleting data
- Deleting a customer removes that customer and their bookings; the admin asks for confirmation first.
- Deleting a service removes the appointments for that service.
- Deleting a whole business account is done by nisebookings on request; it removes all of its data.
- Mail that was already sent exists in the recipient's inbox; the send log disappears with the account.