Privacy policy

willowappt (“we”, “us”, “our”) is a software-as-a-service product providing appointment management tools for businesses. Our service is available at willowappt.com and app.willowappt.com. For data protection purposes we are the data controller for information collected on this website and the data processor for information your business holds in the willowappt application.

Contact us at [email protected].

Account data: When you sign up we collect your name, email address, password (hashed — never stored in plain text), and business name.

Usage data: We collect log data including IP addresses, browser type, pages visited, and timestamps for security and debugging. We do not use this data for advertising.

Business data you enter: Client names, contact details, appointment records, notes, and financial data entered into the application. You are the data controller for this data; we process it on your behalf.

Payment data: Billing and payment processing is handled entirely by Stripe. We do not see or store your full card number.

Cookies: We use a minimal set of functional cookies required for authentication and session management. See our Cookie policy.

• To provide and operate the willowappt service
• To send transactional emails (account verification, password reset, billing receipts)
• To respond to support enquiries
• To detect and prevent fraud and abuse
• To comply with our legal obligations

We do not sell your personal data to third parties. We do not use your data or your clients' data for advertising.

• Contract: Processing necessary to provide the service you signed up for (account creation, billing, core functionality).
• Legitimate interest: Security monitoring, fraud prevention, service improvement.
• Legal obligation: Compliance with HMRC record-keeping requirements (financial records retained for 6 years).
• Consent: Marketing communications (you can opt out at any time).

You have the right to:

• Access the personal data we hold about you (Article 15)
• Rectify inaccurate data (Article 16)
• Erase your personal data (“right to be forgotten”) — subject to our legal obligation to retain financial records for 6 years (Article 17)
• Restrict processing in certain circumstances (Article 18)
• Portability — receive your data in a machine-readable format (Article 20)
• Object to processing based on legitimate interest (Article 21)

To exercise any of these rights, email [email protected]. We will respond within 30 days. If you are not satisfied with our response you have the right to lodge a complaint with the ICO (ico.org.uk).

Account data is retained for as long as your account is active. If you close your account, personal data is deleted within 90 days except where we have a legal obligation to retain it. Financial transaction records are retained for 6 years as required by HMRC.

We may update this policy from time to time. Material changes will be notified by email to account holders at least 30 days before they take effect.