Privacy Policy

This Privacy Policy explains how [Bokalio Legal Entity Name] ("Bokalio", "we") collects and uses personal data when you use Bokalio — whether as a business Owner running a Bokalio account, or as a Customer booking through a Bokalio-powered widget.

1. Who this applies to

This policy covers both business Owners (organizations using Bokalio to manage bookings) and Customers (people booking a product through an Owner's widget). Where it matters, sections are marked for which group they apply to.

2. What we collect

3. How we use it

• To provide the booking platform itself — creating accounts, processing bookings, sending confirmations.
• To process payments, via Stripe and/or PayPal, and to calculate and pay out amounts owed to Owners and resellers.
• To communicate with you about your account or booking, including via the Lio AI assistant when an Owner uses it.
• To detect fraud and keep the platform secure.
• To measure and improve the platform (aggregated or pseudonymized where possible).
• To meet legal obligations (e.g. tax records, responding to lawful requests).

4. Who we share it with

• The Owner you book from — a Customer's booking details are shared with that specific Owner so they can fulfil the booking. See our Data Processing Agreement for the terms governing that.
• Payment processors — Stripe and/or PayPal, to process payments and payouts.
• Service providers who host our infrastructure, send email/SMS, or provide analytics, under contracts requiring them to protect your data.
• A reseller, only the minimum booking details needed for them to see a booking they facilitated.
• Authorities, where required by law.

We don't sell personal data.

5. International transfers

Where data is transferred outside the EU/UK/EEA (for example to a service provider based in the United States), we rely on an appropriate safeguard such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, as applicable.

6. How long we keep it

We keep account and booking data for as long as the account is active, plus a period afterward to meet legal, tax, and dispute-resolution obligations (typically [X years] — to be confirmed with local requirements). You can request earlier deletion subject to Section 8.

7. Security

We use reasonable technical and organizational measures (encryption in transit, access controls, and similar) to protect personal data, but no system is 100% secure — we'll notify affected users and authorities where required by law if a breach creates a real risk to you.

8. Your rights

If you're in the EU, UK, or EEA

Under GDPR / UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion ("right to be forgotten"), subject to legal retention needs;
• Restrict or object to certain processing;
• Data portability;
• Lodge a complaint with your local data protection authority.

If you're a California resident

Under the CCPA/CPRA, you have the right to:

• Know what personal information we collect, use, and disclose;
• Request deletion of your personal information;
• Correct inaccurate personal information;
• Opt out of the "sale" or "sharing" of personal information — we don't sell personal information, and don't knowingly share it for cross-context behavioral advertising;
• Non-discrimination for exercising these rights.

To exercise any of these rights, contact us using the details in Section 10.

9. Children

Bokalio isn't directed at children, and we don't knowingly collect data from anyone under 16.

10. Contact

Data protection contact: [privacy@bokalio.example], [Registered Address]. [If required: EU/UK representative details.]