Privacy Policy
Last updated: June 1, 2026
1. Data controller
The data controller for personal data collected through SHOOW.APP ("SHOOW") is the service owner, reachable at hello@shoow.app.
2. Data we process
Depending on service usage, we may process:
- Business accounts: name, email, hashed password, and business details (trade name, phone, business type, booking settings).
- End customers: name, phone and, when applicable, email, entered by the business when creating bookings.
- Bookings and payments: date, time, amounts, booking status, and payment references handled by Stripe.
- Technical data: IP address, access logs, and strictly necessary cookies for session and security.
3. Purposes and legal basis
- Providing the SaaS booking management service (contract performance).
- Sending end-customer notifications by email or WhatsApp when requested by the business (business legitimate interest / contract performance).
- Collecting deposits through Stripe Connect (contract performance).
- Handling support requests and legal obligations.
4. Processors
To operate the service, we use providers that may access limited data:
- Stripe - payment processing and connected accounts.
- Resend - transactional email delivery.
- Twilio - WhatsApp messaging when configured.
- Hosting provider - app and database hosting.
These providers act under their own privacy policies and data processing agreements where applicable.
5. Retention
We keep data while the business account is active and for as long as needed to meet legal obligations, resolve incidents, or handle claims. After account closure, data is deleted or anonymised within a reasonable period unless legal retention is required.
6. Your rights
You can exercise rights of access, rectification, erasure, objection, restriction and portability by writing to hello@shoow.app.
End customers should first contact the business responsible for their booking; SHOOW acts as processor or facilitator depending on the case.
7. Security
We apply reasonable technical and organisational measures: encryption in transit (HTTPS), hashed passwords, role-based access control, and auditing of sensitive integrations.
8. International transfers
Some providers may process data outside the European Economic Area. In those cases, GDPR safeguards apply (standard contractual clauses or other valid mechanisms).
9. Changes
We may update this policy. The current version will be published on this page with the latest update date.