Privacy Policy

Last updated: October 18, 2026

This policy adds to the general Pintarlab Privacy Policy.

Who we are

booking is operated by Pintarlab, a brand of CV Solusi Pintar, Indonesia. Contact: support@pintarlab.com.

Two kinds of people, two roles

• You (the provider, our customer): we are the controller of your account data.
• Your clients (people who book with you): you are the controller of their booking data. We process it only to run your booking page and send the booking emails described here.

What we collect about you

• Your email address, hashed password, timezone, and the display name, page link and texts you set.
• Your services, availability and settings, and a log of emails we sent you.
• Server logs (IP address, user agent) are kept up to 30 days for security.

What we collect about your clients when they book

• Name, email address, optional phone number, optional notes, timezone, and the booking details (service, time, status).
• A record of the booking emails sent to them, with delivery events (sent, bounced, marked as spam).
• A one-way hash of the IP address used to book, kept for abuse prevention only.

How we use it

Only to run the service. We show your booking page, prevent double-bookings, send confirmations, reminders and change notices, give you your calendar feed, and protect the service from abuse (rate limits, bounce and complaint handling).

What we don't do

• No selling or renting data, no ad trackers.
• No open or click tracking in emails, no third-party analytics or scripts on booking pages.
• No marketing email to your clients, ever.
• We never connect to or read your calendar.

Suppression list

If an address hard-bounces or marks one of our emails as spam, we keep that address on a suppression list so we don't email it again, even after the account involved is deleted. If someone tells us they didn't make a booking, we stop sending that provider's booking emails to their address. If a client turns off reminders from you, or says they didn't make a booking with you, that choice is kept as long as your account exists (and applies again if you sign up again with the same email address).

Processors

Our VPS hosting provider, our email delivery provider (Brevo), and Lemon Squeezy as Merchant of Record for payments once billing launches.

Cookies

One essential session cookie for providers. Booking pages set no cookies.

Retention & deletion

Data is kept while your account exists. Bookings and their email records are deleted automatically 400 days after the appointment time. Deleting your account immediately removes your account, services, all bookings, and the contents of the emails we sent for you (subjects, messages, calendar files, names and addresses). An email still waiting to go out when you delete (for example, telling your clients you've closed your page) is removed as soon as it's sent. We keep only the suppression list above and minimal send records for up to 90 days to enforce sending limits: the type, status and time of each email and a one-way, keyed hash of the recipient's address, never the address itself. Backups roll off within 30 days.

Your rights

Export (CSV) and delete from Settings, or email us. If you booked with someone through booking, see /recipients or email us. We'll pass requests about your data to the provider you booked with.

Changes

We'll email account holders about material changes. This policy adds to the general Pintarlab Privacy Policy. Questions: support@pintarlab.com.