1.Who we are; controller vs processor

When you book through a studio's booking page (a URL like booking.openbiz.work/studio-handle), that studio (the "Business") is the controller of your personal data and decides the purposes; OpenBiz-Booking acts as a processor, storing and processing data on the Business's instructions. This Policy covers our platform-level processing; each Business is responsible for its own privacy practices, and we are not responsible for a Business's own practices.

2.Personal information we collect

We follow data minimisation: only a mobile number is required to book (name and email are optional); we do not collect national ID numbers, credit-card numbers or dates of birth. The Service does not handle any payments or deposits, so we hold no payment details.

3.Mobile number as identity anchor & guest merging

We identify customers by mobile number. You can book as a guest without signing in; when you later sign in with the same number, the system automatically merges your earlier guest bookings into one customer record, with no duplicates. Identity verification (SMS code, LINE or Google) is only needed for higher-risk actions such as viewing your booking history or changing personal settings. A Business may also create bookings on your behalf (phone/walk-in); such data is collected by the Business, which must have its own lawful basis.

4.How we use your information

• To create and confirm bookings, preventing double-booking with a database-level concurrency lock (the same slot can't be taken twice).
• To send confirmations, changes and cancellations via LINE (Taiwan) / WhatsApp (Canada) / Email, and an automated reminder roughly 24 hours before the appointment.
• To offer login-free cancellation: we issue a one-time token per booking so you can cancel via a link, without an account.
• To help Businesses care for repeat customers, with notes visible only to that Business.
• To offer an "add to calendar" (.ics) download on the confirmation page — generated in your browser, without linking to or reading your calendar account; note the file contains your booking details (including the name and mobile number you entered) and is saved wherever you choose to import it.
• To keep the Service secure and prevent abuse (e.g. rate limits on the application form and the consent endpoint).

We do not use your personal information for marketing outside the Service, and we never sell your personal information; the Service also has no marketing-messaging feature at present.

5.Customer notes & health information (sensitive)

You may voluntarily add notes (e.g. allergies, special needs). Such information may be sensitive (health) data, collected only with your express consent, used solely for the safety of your service, and visible only to the Business you booked with (never shared by the platform or used for other purposes). These notes are one-way; the Business may not alter their content.

6.Cookies, local storage & consent records

We use cookies and local storage strictly necessary to keep you signed in and run the Service; in addition, only with your consent, we use Google Analytics for anonymous usage statistics (via Google Consent Mode, off until you consent), with no advertising or cross-site tracking. When you make a choice on the banner (accept all / necessary only), we store a consent audit record (your choice, time, policy version, language, page, real source IP, browser and an anonymous client id) as proof of consent; its retention is in Section 9. See our Cookie Policy.

7.How we share data (sub-processors)

• The Business you book with — necessary to serve you.
• Messaging providers — LINE (Taiwan), Twilio (WhatsApp, Canada), Resend (email). For delivery verification we log the recipient identifier (e.g. LINE user ID / email / phone) and the send result in a notification log.
• Infrastructure — SSD Nodes (server hosting, data centre in the Netherlands); Cloudflare R2 (studio image storage and delivery, uploads.openbiz.work).
• Geocoding — when a Business enters its studio address, we send that address to OpenStreetMap (Nominatim, OSMF) to derive coordinates and the timezone.
• Operations monitoring — Sentry (error tracking), Better Uptime (availability) — these error/availability logs are kept free of personal data as far as possible; the notification log above, however, does contain recipient identifiers.
• Website analytics — Google Analytics (Google LLC), enabled only after you consent to analytics, for aggregate (non-personalised) usage statistics such as device, page and approximate location.
• Legal, safety & rights protection — to comply with law/authorities, enforce our Terms, detect or prevent fraud and abuse, or protect any person's rights, property or safety.

We do not share your data with third parties for advertising.

8.Where data is stored & international transfers

Your data is stored on our servers in Europe (the Netherlands), protected to GDPR standards — including for Taiwan and Canada users. A Business's studio address is additionally sent to OpenStreetMap (Nominatim) to determine the timezone. If you consent to analytics, Google Analytics data is also processed by Google on its global infrastructure. For Quebec users, we have assessed these cross-border transfers.

9.Data retention

• Booking records: kept 3 years after service (for repeat-customer care).
• On your deletion request: handled by anonymisation (identifiers removed, statistics kept).
• Business accounts: kept 1 year after deactivation, then anonymised while booking statistics remain.
• Rejected trial applications: kept 6 months.
• Notification logs (incl. recipient identifiers): kept for delivery verification and handled together with the related booking record.
• Cookie consent audit records: kept ~2 years for verification, after which a scheduled job anonymises the IP address and browser information, keeping only the fact of consent.
• Backups: hourly full backups retained 7 days on our servers and 30 days on Cloudflare R2; deleted data may therefore persist in backups for up to ~30 days before full removal.

10.Data security

All connections are encrypted with HTTPS (auto-issued Let's Encrypt certificates); Business passwords are protected with bcrypt plus a pepper (we cannot recover your plaintext password); sign-in uses short-lived tokens (~1 hour) with the refresh token in an HttpOnly cookie; system logs mask mobile numbers (09XX-XXX-XXX); and every record is strictly isolated per studio. Please note, however, that no method of transmission or storage is 100% secure; we apply reasonable safeguards but cannot guarantee absolute security.

11.Automated decisions & analytics

We make no automated decisions or profiling about customers that produce legal or similarly significant effects; slot availability is computed purely from the Business's fixed rules and ad-hoc adjustments (visual slot selection), with no automated scoring or inference about a customer. At the platform-operations level we compute operational metrics — activity, health and churn-risk indicators — about Business accounts (the Businesses themselves, not their customers), solely for our operations and customer-success purposes. Google Analytics (with your consent) only produces aggregate, non-personalised usage statistics and is not used for automated decisions about you.

12.Your rights & how to exercise them

Depending on where you live, you may have rights to access, correct, delete or anonymise, restrict or object to processing, and (Quebec Law 25) data portability.

To exercise your rights, email support@openbiz.work; we respond within 30 days and will export your data (JSON) or anonymise/delete it via our admin tools. (A self-serve "download my data / delete account" option is planned for the member area.) If you are in Canada, you may also complain to the OPC or Quebec's CAI.

13.Children's privacy

The Service is not directed at minors under 18, and we do not actively verify age; where a minor needs to book, this should be done by, or with the consent of, a parent or guardian, with the Business checking at the point of collection.

14.Changes & governing language

We may update this Policy from time to time. Material changes will be posted here with an updated "Last updated" date and, where appropriate, notified by email. This Policy is provided in Chinese and English; in case of any inconsistency, the Traditional Chinese version prevails.

15.Contact us

Data Protection contact (DPO): privacy@openbiz.work
General & rights requests: support@openbiz.work