Privacy Policy
Last updated: June 2026
This policy applies to advancebooking.app and all booking pages powered by AdvanceBooking.
1. Who We Are (Data Controller)
AdvanceBooking is operated by AdvanceBooking Pte Ltd. We operate the merchant booking platform at advancebooking.app.
Data Protection Officer / Privacy Contact: legal@advancebooking.app
You may contact us at any time to exercise your rights, ask questions about this policy, or report a concern. We will respond within 30 days.
2. Personal Data We Collect
We collect different categories of data depending on how you use the platform:
When you make a booking
- Name, email address, phone number
- Appointment notes you provide
- Birthday month (optional — used only for birthday discount eligibility)
- Delivery address (only when booking includes a physical product)
- Marketing communications preference (opt-in checkbox)
When you use our services
- Booking history and appointment records
- Credit balance and transaction history
- Gift card and package purchase records
- Referral code linkage
Technical data
- IP address (collected for security and rate-limiting; retained for up to 24 hours then automatically deleted)
- Session cookies (essential only — to keep you signed in)
If you register as a merchant
- Business name, email, phone, and address
- Billing and subscription information (processed by our payment processor)
- Calendar OAuth tokens (if you connect an external calendar — stored encrypted)
3. Why We Process Your Data (Lawful Basis)
| Purpose | Lawful Basis |
|---|---|
| Making and managing your bookings | Contractual necessity |
| Sending booking confirmations and cancellation notices | Contractual necessity |
| Sending appointment reminder emails (D-7, D-1, D-0) | Legitimate interest / consent (you may opt out at any time) |
| Maintaining your credit balance and booking history | Contractual necessity |
| Sending birthday discount notifications | Consent (you provide your birthday month voluntarily) |
| Security, fraud prevention, and rate limiting | Legitimate interest |
| Improving the platform and fixing bugs | Legitimate interest |
| Billing merchants for the AdvanceBooking subscription | Contractual necessity |
4. Who We Share Your Data With
We do not sell, rent, or trade your personal data. We share data only with the following service providers who process it on our behalf, under contractual obligations to keep it secure:
Database & authentication provider
Stores all application data including customer records, bookings, and merchant settings; handles admin sign-in sessions
Processed in: United States (AWS)
Transactional email provider
Delivers booking confirmation, receipt, and account emails on our behalf
Processed in: United States
Payment processor
Processes merchant subscription payments only — no customer payment card data is stored by us
Processed in: United States
Cloud hosting & content delivery provider
Serves the web application and API; requests may transit global edge nodes
Processed in: United States (edge network, Singapore region for compute)
Calendar integration provider
Only engaged if a merchant connects an external calendar — appointment details are written to the merchant's calendar account
Processed in: United States
All providers listed above are located in the United States. By using our platform, you acknowledge that your data may be transferred to and processed in the United States. We rely on standard contractual clauses and/or the providers' DPAs to ensure appropriate protection for such transfers.
5. How Long We Keep Your Data
| Data type | Retention |
|---|---|
| IP addresses | Up to 24 hours (auto-deleted daily) |
| One-time login tokens (OTPs) | Until expiry (auto-deleted) |
| Pending security actions | Until expiry (auto-deleted) |
| Customer records and booking history | For the duration of the merchant account, then 3 years after last activity, then anonymised |
| Financial / credit transaction records | 7 years (required for accounting and tax compliance) |
| Merchant account and billing data | For the duration of the subscription, then 7 years |
| Calendar OAuth tokens | Until merchant disconnects the calendar integration |
6. Cookies
We use essential cookies only — specifically, a session authentication cookie set by our authentication provider to keep you signed in. We do not use any tracking, advertising, or analytics cookies. You can clear cookies at any time via your browser settings; doing so will sign you out.
7. Your Rights
Under the Singapore Personal Data Protection Act 2012 (PDPA) and applicable data protection laws, you have the following rights:
Right of access
Request a copy of the personal data we hold about you.
Right to correction
Ask us to correct inaccurate or incomplete personal data.
Right to erasure
Request deletion or anonymisation of your personal data. We will fulfil this request within 30 days except where retention is required by law (e.g. financial records).
Right to withdraw consent
Where processing is based on consent (e.g. marketing emails, birthday notifications), you may withdraw consent at any time by clicking the unsubscribe link in any email or by contacting us.
Right to data portability
Request your personal data in a structured, machine-readable format.
Right to lodge a complaint
You may lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at pdpc.gov.sg.
To exercise any of these rights, contact us at legal@advancebooking.app.
8. Security
We implement technical and organisational measures to protect your personal data, including: encryption of sensitive tokens at rest (AES-256-GCM), TLS encryption in transit, row-level security on all database tables, rate limiting on public APIs, and multi-factor authentication support for merchant accounts. No payment card data is stored by us — all payment processing is handled directly by our payment processor.
9. We Do Not Sell Your Personal Information
We do not sell, rent, or share your personal information with third parties for their own marketing or commercial purposes. This applies to all users regardless of location, including residents of California (CCPA/CPRA) and other jurisdictions with similar protections.
10. Children's Privacy
Our platform is not intended for use by children under 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us at legal@advancebooking.app and we will delete it promptly.
11. Changes to This Policy
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top and notify merchant account holders by email at least 14 days before the changes take effect. Continued use of the platform after that date constitutes acceptance of the revised policy.
12. Contact Us
For any privacy-related queries, data subject requests, or to report a concern:
AdvanceBooking Pte Ltd
Singapore
Email: legal@advancebooking.app
We aim to respond to all privacy requests within 30 days.