Privacy Notice

Last updated: 7 May 2026

1. Who we are

This Privacy Notice explains how Clyde Side Events Scotland Ltd, trading as BookAvi ("BookAvi", "we", "us"), of 41 John Street, Gourock, Scotland — contactable at info@bookavi.com — collects and uses personal data when you use our booking and customer-management software. The data controller for personal data about BookAvi account holders is Clyde Side Events Scotland Ltd, trading as BookAvi. Booking businesses using BookAvi are normally the controllers of their own customers' data, and BookAvi processes that customer data as a data processor on their behalf.

2. What data we collect

Account data — name, email, phone, business name, password (hashed), business type, country.
Content data — services, packages, bookings, enquiries, customer records and form submissions you create.
Communications — support messages, emails you send to us.
Usage and device data — IP address, browser type, pages viewed, device identifiers, telemetry needed to operate and secure the Service.
Payment data — collected directly by Stripe (our payment processor); we receive only the subscription status, plan, customer ID and invoice metadata.

3. Why we use it (legal basis)

To provide the Service — performance of contract.
Account creation, billing administration — performance of contract / legal obligation.
Security, fraud prevention, abuse detection — legitimate interests.
Service improvement and analytics — legitimate interests.
Customer support — performance of contract / legitimate interests.
Marketing emails — consent (you can withdraw at any time).

4. Who we share data with

Stripe, our payment processor, for payment processing, subscription management and invoicing.
Service providers and subprocessors we use to run BookAvi (hosting, database, email delivery, error monitoring, analytics). The current list is published on our Subprocessors page.
Professional advisers (legal, accounting) where necessary.
Authorities where required by law.

We do not sell your personal data.

Connecting your own email account

You can choose to connect your own Google Workspace, Gmail, Microsoft 365 or Outlook account so that customer emails are sent from your business address. If you do:

You sign in with the provider directly. We never ask for, see or store your email password.
We ask only for permission to send email on your behalf. We do not request permission to read, change or delete the messages in your mailbox.
The provider gives us a secure access credential, which we store encrypted and use only on our servers to send your emails. It is never shown in the app or in your browser.
The email address, recipient details and message content are shared with that provider so it can deliver the message, exactly as if you had sent it yourself.
You can disconnect at any time from Settings, or remove access in your own Google or Microsoft account settings. When you disconnect, we delete the stored credential and keep only a record that the connection existed and when it was used.
Where these providers process data outside the UK/EEA, the safeguards described below apply.

We do not use a connected mailbox for anything other than sending the customer communications you or your automations trigger in BookAvi.

5. International transfers

Some of our subprocessors are located outside the UK/EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

6. Retention

We keep account and content data for as long as your account is active. After account closure we retain data for up to 30 days to allow recovery, then delete or anonymise it, except where we are required to retain it for legal, tax or accounting reasons (typically up to 7 years for invoices).

7. Data retention periods

Concrete retention periods for the main categories of data we hold:

Booking, enquiry and invoice records — kept while your account is active, then retained for a further 7 years for UK tax and accounting purposes before deletion.
Email delivery logs — kept for 12 months.
Public form and API audit logs — kept for 90 days.
Payment event logs — kept for 24 months.
Account-deletion requests — honoured after a 30-day cooling-off period, during which your data is read-only and the request can be cancelled at any time.

You can export your data or request deletion of your account at any time from the "Your data" page in your BookAvi account, or by emailing info@bookavi.com.

8. Your rights, in short

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure — ask us to delete your data, subject to our legal retention obligations above.
Portability — receive your data in a structured, machine-readable format via the "Your data" export.
Objection — object to processing based on legitimate interests or direct marketing.

9. Your rights

Subject to applicable law (including UK GDPR and EU GDPR), you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time. You can exercise these rights by emailing info@bookavi.com. We will respond within one month. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk).

10. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, hashed passwords, and audit logging. No system is perfectly secure; please use a strong, unique password.

11. Cookies

We use a small number of essential cookies to keep you signed in and to remember your preferences. We do not use marketing cookies. You can manage cookies in your browser settings.

12. Changes

We may update this notice from time to time. Material changes will be notified by email or in-app at least 14 days before they take effect.

13. Contact

Questions about your data? Email info@bookavi.com.