Privacy Policy

Bukr is operated by Saba Firoze under the Bukr brand. This policy explains how the platform handles personal information when business owners set up services and customers book or manage appointments.

Service providers also receive and use customer information to deliver their services. They are responsible for explaining their own privacy practices, including information collected outside Bukr. Contact us about platform handling, and the relevant business about its independent handling of your information.

Account information: your email address, account identifier, authentication/session information and verification or security records. Sign-in uses email verification codes; Bukr does not ask you to create a separate account password.

Business information: business and contact names, contact email, booking address, timezone, services, prices, descriptions, service locations, working hours, policies, uploaded logos, brand colors and connection settings. Published business details and logos can be viewed by people visiting a business’s booking page.

Booking information: customer name and email, selected business and service, dates/times, location, appointment status, policy versions and recorded acceptance where applicable. We also store recurring rules, appointment changes, owner-entered reasons, policy exceptions and the history needed to manage reservations.

External payment records: amounts, deposits, payment method labels, optional references, package/session allowances, subscription periods, balances, credits and allocation history entered by a business. These are records, not card-processing instructions. Bukr’s current payment-record features do not request full card numbers, card security codes or bank-login credentials.

Communications and technical information: support correspondence, email recipients and content, notification timestamps, delivery results, retry records, calendar sync identifiers and error/status records. Hosting and authentication providers may also process IP addresses, browser/device details, request timestamps and security logs to operate and protect the service.

We receive information you enter, information a business enters about its customers and appointments, and information produced when the platform processes a booking or change.

A business may create an appointment before a customer has a Bukr account. We use the supplied booking email to send notices and link the appointment when that email is verified. Receiving an owner-created appointment or attached policy does not by itself prove that the customer accepted the policy.

If an owner authorizes Google Calendar, we receive the limited calendar and authorization information described below. We also receive email delivery/failure events from our email provider. Please provide accurate information and only enter information you are authorized to share.

We use information to authenticate users, operate business booking pages, calculate availability, confirm and manage appointments, maintain recurring reservations and external payment records, and show each participant the records they are authorized to access.

We send verification codes, booking confirmations and appointment-change notices. A customer booking generates a customer receipt and owner notice; changes notify the other party. Owner-created recurring series receive an initial summary, without a new summary for every rolling extension.

We also use information to provide enabled calendar features, recover failed operations, investigate problems and misuse, respond to support or privacy requests, maintain business records, resolve disputes and meet applicable legal obligations. We do not use booking or Google Calendar information for advertising or to train general-purpose AI models.

Connecting Google Calendar is optional and separate from email login. Owners choose a calendar they own. Busy-time filtering and appointment-event sync are independent controls and are not automatically enabled by connecting.

We request permission to list calendars you own, check availability and read/create/change/delete events on calendars you own. Calendar-list information includes identifiers, names, primary-calendar status and access role so we can display and verify your selection.

For availability, we normally read busy intervals. Where a calendar has Bukr-linked events, we request event identifiers, start/end times, cancellation/transparency status and calendar timezone to distinguish those events from external busy time. We do not request external event descriptions or attendee lists for this busy-time calculation.

For a linked appointment, we may read its Google event to verify that it belongs to Bukr, check its current status and update or delete the correct version. We do not offer general browsing or copying of unrelated calendar-event content.

We store the selected calendar identifier/name, connection status and encrypted authorization tokens needed for access while you are offline. We also store linked appointment/event identifiers, target calendar, sync versions, attempts and results. Calendar availability responses are processed to calculate slots; Bukr does not keep a separate archive of unrelated Google event descriptions.

When an owner enables event sync, new appointments can create Google events containing the customer name, service, location, appointment times, a booking reference and a private Bukr management link. Owners must consider who can access their selected Google calendar before enabling this feature. Bukr does not add customers as Google event attendees or send Google invitation emails through this sync feature.

Only newly created appointments while sync is enabled are linked; existing bookings are not imported. Rescheduling updates a linked event and cancellation removes it. Each new recurring occurrence may be a separate event. Changing an event directly in Google does not change the booking in Bukr.

We limit Google API data use and sharing to the calendar features described here and follow the Google API Services User Data Policy, including its Limited Use requirements (opens in a new tab). We do not sell Google API data or use it for advertising, credit decisions or general-purpose AI training.

Access by people to Google API data is limited to circumstances permitted by that policy, such as your permission for a specific support request, necessary security investigations or legal requirements. Transfers are limited to providing the requested features, protecting against abuse, meeting legal obligations or other circumstances permitted by that policy.

The relevant service provider receives its customers’ booking details and business-entered records. A customer can access their own appointments after email verification. Public booking pages show published business/service information, not a public customer appointment list.

We use Supabase for account authentication, application data and uploaded file storage; Vercel for hosting and application delivery; Resend for hosted transactional email; and Google for an owner-authorized Calendar integration. Providers process the information necessary for those functions under their own service arrangements and policies.

Booking emails necessarily disclose their contents to the recipient and email-delivery providers. Delivery or email-interaction diagnostics may be processed according to the sending service’s configuration. Support messages sent to our Gmail support address are handled through Google’s email service.

We may disclose information where required by applicable law or necessary to address fraud, abuse or security incidents, or when you authorize a particular disclosure. We do not sell your personal information. A business’s exports, forwarded emails or independently shared calendars are also subject to that business’s practices.

Bukr uses authentication/session cookies to keep you signed in and a short-lived security cookie during Google authorization. These support access control and protect the connection process. Blocking necessary cookies may prevent login or calendar connection from working.

The current application does not include advertising pixels or an advertising/behavioral-analytics SDK. Infrastructure providers may still use operational and security technologies to deliver the service. This statement does not mean that every third-party service stores no technical information.

You can manage cookies through your browser. Signing out ends the app session but does not delete the account, booking history, business records or information already sent to a provider or email recipient.

We use authenticated access controls, private storage for protected records and encrypted storage for Google authorization tokens. No system can guarantee absolute security. Keep access to your email account secure and do not send us verification codes or calendar credentials.

Information may be processed outside India depending on the locations and configurations of hosting, database, email and integration providers. We do not promise that all data is stored only in India.

We retain account, booking, audit, payment-record, email and calendar-link information for operating the service and, where needed, handling disputes, security issues and legal obligations. Retention varies with the record type, why it is needed and applicable obligations.

When you request deletion, we assess which records can be removed or anonymized and which must be retained. Deletion may take additional time in backups, delivery-provider records or records a business must lawfully retain. Contact us for a retention or deletion request; we will explain any information that must be retained.

You may contact us to request access to or correction of your personal information, account closure, deletion, withdrawal of an optional permission, or help raising a privacy concern. We will assess requests under the law applicable to you and may need to verify identity or authority before disclosing or changing records.

Ask the business to correct service information or externally collected payment records it entered. We can help investigate platform handling. Account closure does not automatically cancel appointments or end an agreement with a service provider; arrange those changes separately.

Owners can pause calendar sync or disconnect Google Calendar in Connections. Google access can also be revoked in Google Account permissions (opens in a new tab). A completed Bukr disconnect clears the stored connection credentials; if revocation fails, limited encrypted material may be retained temporarily to finish disconnecting.

Pausing or revoking access does not automatically erase existing Google events, past email messages or the underlying Bukr booking and audit records. Ask separately for deletion of applicable retained records. Calendar copies and emails held by other parties may need to be addressed with those parties.

Privacy requests can be sent to sabafiroze@gmail.com. State the relevant account email and the request, but do not send passwords, verification codes, full payment-card details or unnecessary identity documents. We will request additional verification securely if needed. Nothing here limits a complaint or other remedy available under applicable law.

Bukr account operation is intended for adults. A parent or legal guardian may arrange a service for a minor through the adult’s account and email, subject to the provider’s requirements. Businesses should enter only the information needed for the booking and obtain any permissions required by law.

Do not include unnecessary health information, government identifiers, card security codes or other sensitive information in booking titles, descriptions, payment references or calendar locations. Tell us if a child has independently created an account or information has been submitted inappropriately so we can investigate.

We will update the date on this page when we revise the policy. Material changes to data handling will be communicated where appropriate, and additional permission will be requested where required. We will not use a policy update as permission for an undisclosed new use of Google API data.

This policy describes platform information handling; the Terms of Service and an individual business’s booking policies address separate matters.