Privacy notice

Hualio builds and runs websites and booking systems for service businesses. In this notice, “we” means [registered company name and address — to be completed], and “you” means either a business we work with or someone who has enquired about working with us.

For questions about anything below, or to make any of the requests in section 8, write to [data protection contact address — to be completed].

This is the part most privacy notices blur, and it changes your rights, so it is first.

For your own customers, you are in charge and we are not. When someone books an appointment with your business, that person’s details belong to your business. We hold them on your behalf, we act on your instructions, and we do not decide what happens to them. Every business’s records are separated inside the database itself, so one business cannot reach another’s customers even by accident.

For your own account, and for enquiries, we are in charge. The login you use, and anything you send us through the form on our home page, is ours to look after and answer for.

If you enquire through the form on our home page: your business name, your name and your email address, which are required, plus a phone number, your industry, your website and a message if you choose to give them. We keep enquiries so that a second conversation starts where the first one ended.

If you become a customer: the email address you log in with, the details of your business, its locations and opening hours, the services you offer, and the staff, rooms and equipment you book out.

Your customers’ details, held on your behalf: first and last name, email address, phone number, the bookings they have made, whether they turned up, whether they agreed to hear from you, and any private notes your business writes about them.

Technical information: ordinary server logs, and the anonymous measurements described in section 5.

What we never collect: payment details. Hualio does not process payments and takes no percentage of your takings, so no card number, bank detail or billing address is stored anywhere in our systems. Your services can display what they cost — that is a menu, and no money moves through us.

To provide the service you have asked us for: taking bookings, sending confirmations, and letting your customers change or cancel without ringing you. To answer an enquiry you sent us. To keep the service secure and working, which includes checking that a booking form is being used by a person rather than a bot. And to meet our legal obligations, such as keeping business records.

We do not sell your data or your customers’ data. We do not market to your customers. We do not use your customers’ details to train anything.

When you log in we set a small number of strictly necessary cookies — one that keeps you signed in and one that remembers which of your businesses you are looking at. They cannot be turned off without breaking the dashboard, and they do not follow you anywhere else.

We measure how the product is used so that we can fix what is broken. That measurement is about pages and errors, not about individual customers, and it is not used for advertising. There are no advertising cookies and no third-party trackers on this site.

We keep this list short deliberately, and it is complete. Each of these companies processes data only to provide its part of the service, and none of them may use it for their own purposes.

• Supabase — the database, logins and file storage that hold everything described above.
• Vercel — the hosting that serves the website and the dashboard.
• Resend — sending booking confirmations, reschedules and cancellations by email.
• Cloudflare — checking that a form submission comes from a person rather than a bot.
• PostHog — the usage and error measurement described in section 5.

If we ever add to this list we will update this page and tell the businesses we work with.

Bookings are never silently deleted, because a business needs its own history — cancelling a booking marks it cancelled and keeps the record. We keep your business’s data for as long as you are a customer, and for a reasonable period afterwards to settle anything outstanding.

Enquiries that do not become customers are kept while a conversation is realistic and then deleted. Ask us and we will delete yours sooner.

You can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop a particular use of it, or ask for it in a form you can take elsewhere. We do not charge for this and we will not make it difficult.

If you are a customer of one of the businesses we work with, that business decides these questions and we will pass your request to them and help them answer it.

If you are unhappy with how we have handled a request, you have the right to complain to the data protection authority in your country. Requests and complaints go to [data protection contact address — to be completed].

If this notice changes in a way that matters, we will change the date at the top and tell the businesses we work with. We will not make a material change quietly.