What we collect, and what we don't.

Last updated November 11, 2026

Two kinds of people use ApptHQ

Businesses, who create accounts and run their calendar, and clients, who book an appointment at a business. This policy covers both.

What we collect from businesses

Your name, email, password (stored only as a salted hash), business name, address, phone, hours, services, staff names, and your subscription status. If you connect Stripe or Square we store the account or merchant identifier and, for Square, encrypted access tokens so deposits can be created on your behalf. We never see or store card numbers.

If you give a staff member their own sign-in, we store that person's email and send them an invite email with a link to set a password. Each staff member's name, and the photo and bio you add for them, are shown on your booking page.

Images you upload (your logo, cover photo, gallery and staff photos) are stored with Vercel and are public. Anyone who has the link to an image can open it.

What we collect from clients

The name and mobile number a client types when booking, an optional email, any notes they add, and the appointment itself. When a business travels to its clients, the booking form also asks for the street address of the visit. Businesses may add their own notes about a client.

When a day is full, someone who has not booked can join that day's waitlist with a name, an email and an optional mobile number. We send one email if a time opens that day, with a link to take themselves off the list. Waitlist entries are deleted 30 days after the day they asked for.

A client's details are visible to the business they booked with. The service providers listed below store or deliver them for us. A business can also create private calendar links for its team, and anyone who has one of those links can see that business's bookings, with client names and phone numbers, until the business resets the link. ApptHQ does not run a marketplace, does not build profiles across businesses, and does not use client data for advertising.

How we use it

To run the service: show the calendar, prevent double bookings, send booking confirmations when an email is given, let clients manage their appointment, bill businesses, and keep the service secure. That's it.

A client who gives an email may get these emails from a business using ApptHQ: a booking confirmation, and then reminders before the appointment, a review request after a visit, and a note when it is time to book again, the last three each with an opt-out link.

To limit repeated attempts at signing in, signing up, resetting a password, booking, joining a waitlist and opening a calendar link, we keep a count against the IP address a request came from and, for sign-in and password reset, the email address that was typed. These are kept to limit repeated attempts and are not used for anything else.

Who else sees it

Service providers that host and run ApptHQ: Vercel (hosting, uploaded images and backups), Neon (database), Resend (email delivery), Whop (billing for your ApptHQ plan, which receives the owner's email at checkout), and Stripe or Square (deposits, only when a business connects them). Each processes data only to provide its service to us. We do not sell personal information and we do not share it with advertisers.

Cookies

We set two cookies. One keeps a business owner or staff member signed in and lasts 30 days. The other remembers which demo business a visitor opened, lasts four hours, and holds nothing about the visitor. The public booking page sets no tracking cookies. We do not run third-party analytics or ad pixels.

Keeping and deleting

Data is kept while a business's account is open. A client can ask the business to delete their record, or email us and we will route the request. The owner can close the business from Settings. New online bookings stop right away. The owner can still sign in. Thirty days later a scheduled job deletes that business, its clients, its appointments, and the login if it has no other business. Closing the business does not cancel a Whop subscription.

A backup of the database and uploaded images is made every night and held in private storage. The last 14 nightly backups are kept, so something deleted from the live service can remain in a backup for about two weeks.

Your rights

You can ask what we hold about you, ask us to correct or delete it, or object to how we use it. California residents have these rights under the CCPA; we honor them for everyone. Email hello@letslaunch.co.

Changes

If this policy changes in a way that matters, we will email business owners before it takes effect.

Who to contact

Let's Launch, a brand of Project Array LLC, Los Angeles, California. hello@letslaunch.co.