Privacy policy

This policy explains what personal information ProTyz (“ProTyz”, “we”, “us”) collects through protyz.com, the ProTyz dashboard and mobile app, and the booking websites we host for service businesses, and how we use it.

1. Who this covers

ProTyz serves two kinds of people, and we treat their data differently:

• Businesses (“providers”) who sign up to run bookings, clients and staff on ProTyz.
• Clients who book a service with one of those businesses through a website we host. For client data, the business you booked with is the controller and we act as its processor: we store and process that data on the business's instructions. Questions about your booking, and requests to see or delete your record, should go to that business first.

2. What we collect

• Account details — name, email, phone, business name and address, service area, password (stored as a salted hash), and, if you sign in with Google, the profile fields Google shares with us.
• Booking data — client names, contact details, addresses, appointment times, service notes, before/after photos, ratings and reviews, and quotes.
• Team data — staff names and contact details, work schedules, GPS check-in/check-out locations (only while a team member is checked in to a job), hours and payroll figures.
• Payments — Pro subscriptions and domain purchases are processed by Stripe. We never see or store full card numbers; we keep the plan, invoice history and last four digits.
• Messages — email and SMS we send on a business's behalf (confirmations, reminders, review requests), replies clients send back, and support tickets or contact-form messages you send us.
• Usage data — pages visited, browser and device type, IP address, and error logs, used to keep the service running and improve it.

3. How we use it

• To provide the service: publish booking websites, take bookings, send confirmations and reminders, coordinate teams, run payroll exports, and process subscriptions.
• To help businesses grow: surface re-engagement opportunities from a business's own client history. We never share one business's clients with another.
• To communicate with you: account notices, replies to support requests, and occasional product updates (you can opt out of the latter).
• To keep the platform safe: fraud and spam prevention, rate limiting, security monitoring, and legal compliance.

We do not sell personal information, and we do not use client booking data for advertising.

4. Who we share it with

Only service providers we need to run ProTyz, each bound by their own privacy and security commitments:

• Hosting and database — Vercel and Supabase (data stored in the United States).
• Email delivery — SendGrid. SMS delivery — Twilio.
• Payments — Stripe. Domain registration — our registrar partner, for businesses who buy a custom domain.
• Maps and address lookup — Google Maps, for service-area and route features.

We may also disclose information when required by law, to enforce our terms, or as part of a merger or acquisition (we would notify you first).

5. SMS and email consent

Clients receive booking texts only after they provide a phone number while booking and, where required, verify it. Every SMS includes an opt-out instruction; replying STOP ends messages from that business. Message and data rates may apply.

6. Cookies

We use a small number of strictly necessary cookies (sign-in session, security tokens, your preferences). We do not run third-party advertising cookies on protyz.com. Businesses may add their own analytics to their sites; their policy governs those.

7. Retention

We keep account and booking data for as long as the account is active. When a business closes its account, we delete or anonymise its data within 90 days, except records we must keep for tax, legal or fraud-prevention reasons. Backups roll off within 35 days.

8. Your rights

Depending on where you live (including under GDPR, UK GDPR, CCPA/CPRA and similar laws) you may have the right to access, correct, export, restrict or delete your personal information, and to object to certain processing. Businesses can export their data from the dashboard at any time. To exercise any right, contact us; we will respond within 30 days and will never discriminate against you for making a request. Clients of a business should contact that business, and we will help it respond.

9. Security

All traffic is encrypted in transit (TLS) and data is encrypted at rest. Access to production systems is limited to staff who need it and is logged. If we learn of a breach affecting your data we will notify you and any relevant authority as the law requires.

10. Children

ProTyz is for businesses and their adult clients. We do not knowingly collect personal information from anyone under 16; if you believe we have, tell us and we will delete it.

11. Changes

We will post any changes here and update the date above. For material changes we will also email account holders before they take effect.

12. Contact

Privacy questions and requests: use the contact form or write to ProTyz at the address on our terms of service.