Privacy Policy

Last updated: August 2026

In plain English: We collect only what BookMate needs to work — your business details if you're an owner, or your name/contact details if you're booking an appointment. We don't sell data, and we name exactly which outside companies (like Stripe for payments) ever see it.

1. Who this applies to

This policy covers two kinds of people: business owners who create a BookMate account to manage their bookings, and customers who use a business's BookMate page to make a booking. We've tried to be clear below about which section applies to which.

BookMate is provided by Kiwi Code NZ, based in New Zealand. We handle personal information in accordance with the New Zealand Privacy Act 2020.

2. Information we collect

If you're a business owner

Your email address and password (via Firebase Authentication)
Your business name, contact details, logo, and the services/pricing/hours you configure
Payment and billing information, handled directly by Stripe — we never see or store your card details
Basic usage data (e.g. login activity) needed to operate your account

If you're booking an appointment with a business using BookMate

Your name, email address, and (if provided) phone number
Any notes you add to your booking
Whether you've opted in to receive SMS reminders, and when
If the business requires a deposit or full payment to book, your payment/card details — handled directly by Stripe, via that business's own connected Stripe account. Neither BookMate nor the business ever sees or stores your card details.

This information is collected on behalf of, and is controlled by, the business you're booking with — BookMate is the software they're using to manage it.

3. How we use this information

To operate your booking page, manage appointments, and send confirmations/reminders
To process subscription payments and one-off purchases
Where a business has connected their own Stripe account, to pass a customer's payment through to that business's Stripe account for a deposit or full payment at booking — this money and the associated payment details go directly to the business, not to us
To send you service-related emails (e.g. account, billing, or booking notifications)
To respond to support requests
To improve and maintain the reliability of the platform

We do not sell personal information, and we do not use customer booking details for advertising.

4. SMS text messages

We only send SMS reminders to a customer who has actively checked the "text me a reminder" box on the booking form — this is never turned on by default. When you consent, we record that consent together with the date it was given, and keep that record for at least two years, in line with our SMS provider's requirements. You can decline SMS at any time by simply not checking the box, or by contacting the business you're booking with — you'll still receive email confirmations and reminders either way.

5. Who we share information with

We use a small number of trusted service providers to run BookMate. Each only receives the information it needs to do its specific job:

Provider	What they handle
Stripe	Payment processing for your subscription and one-off purchases. If you connect your own Stripe account, it also processes any deposits or full payments your customers pay you directly — that money and payment data goes to your Stripe account, not ours. Card details are always handled entirely by Stripe and never touch our servers.
Google Firebase	Account authentication, database storage, and file storage (e.g. logos and service images).
Resend	Sending transactional emails (booking confirmations, reminders, receipts).
TNZ Group	Sending SMS text reminders, only where a customer has opted in.
Netlify	Hosting the BookMate website and its background functions.

We don't share personal information with any other third party except where required by law.

6. How long we keep information

We retain account and booking information for as long as an account is active, plus a reasonable period afterward for record-keeping and legal purposes. SMS consent records are kept for a minimum of two years as required by our SMS provider. You can request deletion of your data at any time (see below).

7. Your rights

Under the Privacy Act 2020, you have the right to ask what personal information we hold about you, request a correction if it's wrong, and request deletion where reasonably practicable. To do any of this, email hello@kiwicode.net.nz. If you're a customer of a business using BookMate, you're also welcome to contact that business directly, since they control your booking information.

8. Security

We rely on industry-standard security practices from our infrastructure providers (Google Firebase, Stripe) and apply our own access controls to keep data secure. No system is completely immune to risk, but we take reasonable steps to protect the information entrusted to us.

9. Changes to this policy

We may update this policy as BookMate evolves. We'll update the date at the top of this page when we do.

10. Contact

Questions about this policy, or a privacy request? Email hello@kiwicode.net.nz.