Privacy Policy
Last updated: August 2, 2026
Who we are
fullbook ("we", "us", "our") provides CRM and marketing software for local service businesses. This policy describes how we handle personal information when you visit our public website, use free tools, create an account, or use the fullbook platform.
For data protection inquiries, contact our Data Protection Officer at dpo@fullbook.co.
Information we collect
- Account information: Name, email, phone number, business name, and password when you create an account
- Billing information: Payment method details processed securely by Stripe — we never store full card numbers
- Customer data: Information you upload to the CRM (contacts, reviews, campaigns). You are the data controller for this data; we process it on your behalf
- Usage data: Pages visited, features used, browser type, IP address, and device information for service operation and security
- Communications: Support tickets, emails, and feedback you send us
How we use information
- Provide, maintain, and improve the fullbook platform
- Process payments and manage subscriptions
- Send transactional emails (account confirmations, billing receipts, security alerts)
- Send marketing communications (with your consent; unsubscribe anytime)
- Generate AI-powered insights and content (campaign suggestions, review analysis)
- Detect and prevent fraud, abuse, and security incidents
- Meet legal obligations (tax reporting, law enforcement requests)
We do not sell personal information to third parties.
Data storage and security
- Location: Data is stored on Supabase (PostgreSQL) hosted on AWS (us-east-1, US)
- Encryption in transit: All connections use TLS 1.3
- Encryption at rest: Database storage encrypted with AES-256
- Backups: Daily encrypted backups retained for 30 days
- Access control: Row-level security (RLS) enforces strict tenant data isolation — your data is never accessible to other accounts
Data retention
We retain personal information only as long as necessary for the purposes described in this policy:
| Data category | Retention period |
|---|---|
| Active account data | Retained while your account is active |
| Deleted account data | Purged within 90 days of account deletion |
| Backups containing deleted data | Rotated out within 30 days of deletion |
| Server & access logs | Retained for 90 days, then automatically deleted |
| Payment records | Retained for 7 years (tax/legal compliance) |
| Marketing consent records | Retained for 3 years after last interaction |
Third-party services (subprocessors)
We share data with the following service providers to operate the platform. Each provider is bound by data processing agreements:
| Service | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Database hosting & authentication | All platform data, auth credentials | US (AWS us-east-1) |
| Stripe | Payment processing | Billing details, subscription data | US |
| Mailgun | Transactional & campaign email delivery | Email addresses, email content | US |
| Twilio | SMS delivery | Phone numbers, SMS content | US |
| Anthropic | AI content generation (Claude) | Campaign prompts, review text for analysis | US |
| Apify | Web scraping (Google Business Profile data) | Business URLs, public listing data | EU |
Full list: Subprocessors page. We will notify registered users by email at least 30 days before adding a new subprocessor.
Cookies
- Essential cookies: Authentication session tokens and CSRF protection — required for the platform to function
- Preference cookies: Theme selection and UI state — improve your experience
- Analytics: We do not currently use third-party analytics cookies. If we add analytics in the future, we will update this policy and request consent where required
You can control cookies through your browser settings. Disabling essential cookies will prevent you from using authenticated features. See our Cookie Policy for details.
Your rights
Depending on your location, you may have rights under GDPR, CCPA, or other privacy laws:
- Access: Request a copy of data we hold about you
- Rectification: Correct inaccurate personal information
- Erasure: Request deletion of your data ("right to be forgotten")
- Portability: Export your data in a machine-readable format
- Restriction: Limit how we process your data
- Objection: Object to data processing based on legitimate interest
- Withdraw consent: Unsubscribe from marketing or revoke consent at any time
Authenticated customers can submit data export and deletion requests under Settings → Privacy after logging in. For all other requests, email privacy@fullbook.co. We will respond within 30 days.
California residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act. We do not sell personal information. You may request disclosure of data collected in the past 12 months, request deletion, and opt out of any future sale of data. To exercise these rights, email privacy@fullbook.co or use the in-app privacy settings.
Children's privacy
fullbook is designed for business use and is not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
Changes to this policy
We may update this privacy policy from time to time. Material changes will be communicated via email or an in-app notification at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Contact
Questions about this policy: privacy@fullbook.co
Data Protection Officer: dpo@fullbook.co