Privacy policy
Last updated 18 October 2026
Who we are
Bookmerce is an appointment booking app for Shopify stores, made by IT Brain. This policy explains what the app stores, why, and for how long. It covers merchants who install Bookmerce, the customers who book with those merchants, and visitors to this website.
For customers' details, the store you book with decides what is collected and why; we store and handle those details for the store, on its instructions. Questions about a booking are best sent to that store.
What we store about stores
- Store details from Shopify: the store's address (myshopify domain and main domain), name, contact email, currency, time zone, language and country, and when the app was installed or uninstalled.
- Shopify access: the key Shopify gives the app to act for the store, and basic details of the person who installed it (name and email), as Shopify provides them.
- Your set-up: services, prices, opening hours, locations and their addresses, settings and message wording.
- Staff: the names you enter, and an email and phone number if you add them.
- Calendar connections, if you connect one: the calendar account's email address, and the access keys for it, stored encrypted. From the calendar we keep only the start and end times of busy periods, never what the events are called or who is in them.
What we store about customers
- Contact details: name, email and phone number, as entered on the booking form or filled in from their store account.
- Their Shopify customer ID, when they were signed in to the store, so their bookings appear in their account.
- Bookings: the service, date and time, staff member, location, status, the amount paid and how, and any note or answers to the store's questions.
- Messages: a record of the booking messages sent to them (which message, to which email or phone, when, and whether it was delivered).
We never see or store card details. Paid bookings are paid in the store's own Shopify checkout.
How we use it
Only to run the booking service for the store: showing free times, taking and confirming bookings, sending booking messages, keeping calendars in sync, and helping the store when it asks us for support. We don't sell data, we don't use it for advertising, and we don't share it with other stores.
Shopify privacy requests
Shopify sends apps three privacy requests. This is what Bookmerce does with each:
- Customer data request (a customer asks a store what it holds about them): we send the store the details and bookings we hold for that customer. Stores can also export bookings themselves at any time.
- Customer erasure (a store or Shopify asks to erase a customer): we erase the customer's name, email, phone number and Shopify customer ID, the notes and answers on their bookings, and the record of messages sent to them. The bookings stay without any personal details, so the store's calendar and totals remain correct.
- Store erasure (sent by Shopify 48 hours after a store uninstalls the app): we delete everything we hold for that store, including all its customers and bookings.
Services we use
We use a small number of service providers to run Bookmerce. Each one only receives what it needs for its job. To get the names of our current providers, email [email protected].
| Provider | What for | When |
|---|---|---|
| Shopify | The platform the app runs in; checkout and payments | Always |
| Hosting provider | Running the app | Always |
| Database provider | Storing the data described above | Always |
| Email delivery provider | Sending booking emails | Always |
| Google, Microsoft | Calendar sync | Only for staff whose calendar the store connects |
| Text message provider | Sending text messages | Once text messages are live, and only if the store switches them on |
How long we keep it
- While the app is installed, we keep a store's data so its calendar and history work.
- A customer's details are erased when the store or Shopify asks, as described above.
- 48 hours after a store uninstalls the app, Shopify asks us to delete the store's data and we delete all of it. Stores can export their bookings first.
- Our database provider keeps short-term backups so mistakes can be undone. Deleted data leaves those backups when they expire, within 30 days.
How we protect it
- Every connection to the app and between our services is encrypted.
- Each store's data is kept apart by the database itself, so one store can never read another's.
- Calendar access keys are encrypted before they are stored.
- Only the people who run Bookmerce can reach the database, and only to keep the service working or to help a store that asks.
This website
bookmerce.com sets no cookies and uses no analytics or tracking. Our hosting provider keeps standard server logs (such as IP address and pages requested) for a short time to keep the site running and secure.
Your rights
If you booked with a store that uses Bookmerce, ask that store to see, correct or erase your details; it can do this in Shopify, and we act on its request. You can also write to us and we'll pass your request to the store.
If you're a merchant, write to us about your store's data at any time.
Changes and contact
If we change what we store or who we share it with, we'll update this page and its date, and tell merchants in the app before the change applies.
Questions: [email protected]