Trust & Compliance

Everything below is true today. We update this page before we change any of it.

• Your records are stored in the United States, in an encrypted managed database, with backups in the same country.
• The BookZync application runs in the United States.
• When the assistant answers a customer, the words of that conversation are processed by our AI providers in the United States. They are not used to train AI.
• Texts and emails your business sends are delivered by messaging providers in the United States.
• Payments are handled by Paddle, our merchant of record; BookZync never sees a card number.
• We do not host data in Canada today.

The full list of the services we rely on, with the country each one runs in, is on the sub-processor list. The named list, including our AI providers, is shared with your business under a confidentiality agreement on request.

• It is never used to train or fine-tune AI models — not ours, not our providers'.
• It is never sold, and never shared with another BookZync customer. Every record is scoped to your business; a request across that line is treated as not found.
• A person who talks to the assistant and does not agree to be kept on file is not kept: their details are removed within 24 hours of a completed visit.
• You can export your customer data at any time and delete any record from your dashboard. On cancellation you have 30 days to export, then we delete (unless the law requires us to keep something longer, for example tax records).

BookZync keeps its own calendar. It does not read Google Calendar, Outlook or your booking software, so it cannot see appointments you booked somewhere else — tell it your busy times and hours in the dashboard, and it books only into the open ones. You can subscribe to your BookZync bookings from Google Calendar, Apple Calendar or Outlook with a private link, so they show up on your phone by themselves (one way, read-only).

• Encryption in transit (HTTPS/TLS) and at rest on our managed database.
• Strict tenant isolation: every record is scoped to your business; cross-tenant access is treated as not-found by design.
• Two-factor authentication for BookZync staff accounts, with step-up verification for sensitive actions, and available for your own dashboard login.
• Every administrative change is recorded in an audit log.
• Error messages are scrubbed so internal details never leak to a browser.
• Security headers on the website, the dashboard and the API; TLS 1.2 and 1.3 only.

• It says it is an AI. The chat window is labelled "AI assistant", and if anyone asks whether they are talking to a person, it answers plainly that it is not, and offers a way to reach your team.
• It quotes only your real services, prices and hours — it is instructed never to invent information.
• It never asks for card numbers, passwords or IDs in chat.
• It asks a new customer for permission before keeping their details on file, and keeps nothing without a clear yes.
• You can read every conversation it has had, and have its behaviour adjusted.

• Every text a business sends through BookZync names the business and says how to stop (reply STOP), even if the business rewrote the wording. Every email says who sent it, why you are getting it, and carries a working unsubscribe link.
• STOP is honoured automatically across every feature; START re-subscribes.
• Marketing texts go only to people who opted in. Appointment reminders and confirmations are sent one at a time by a person on your team, with one tap.
• You remain responsible for your own consent laws (for example TCPA in the US, CASL in Canada); our Terms spell this out.

We do not hold SOC 2 or ISO 27001 certification, and we will never imply otherwise. SOC 2 is planned; we will put the date here when we have one. What you see on this page is what we do right now.

We reply to email within one business day. Our support team has no phone line yet. Security questions or a vulnerability report: [email protected]. Everything else: [email protected].