Privacy Policy · ZeloBooking

Two kinds of information — and who is responsible

Our own customers and visitors — business owners and their team who use ZeloBooking, people who visit zelobooking.com, sign up for our newsletter, chat with our assistant or contact us. For this information Zeloxa Labs LLC decides how it’s used (we are the “controller” or “business”).
Clients of those businesses — people who book, fill in forms or are added as clients by a business that uses ZeloBooking, and visitors to a business’s ZeloBooking website. The business decides how its client information is used and is responsible for it; we handle it on the business’s behalf and only to provide the service (we are its “processor” or “service provider”). If you booked with a business and have a question about your information, please contact that business first — we’ll help them answer you.

What we collect

From businesses and their team

Account details: name, email address, password (stored only as a secure hash) and, for our own platform team, a two-step sign-in code.
Business details: business name, type, address, time zone, phone, services, prices, products, working hours, settings and the website content you create.
Team details the business adds: names, email addresses, photos, schedules, services and role.
Mobile numbers you choose to add for account text messages, and your consent to receive them.
Billing information for your ZeloBooking plan, credits and website template purchases. Card payments are handled by our payment processor (Stripe); we never see or store full card numbers.
For business texting and phone features (when available): carrier-registration details (legal name, tax ID, address and contact), stored encrypted and shared only with the carriers and our messaging provider for that registration. If you move an existing number to ZeloBooking: your current carrier’s account details (account number, PIN), a recent bill and the account holder’s name and email. We pass these to our telecom provider for the move and don’t keep the account number, PIN or bill ourselves.
Messages and files you send to our support team and, if a live help session is recorded, that recording — see support conversations and screen sharing.
Records of important account actions (an audit log), such as exports and deletions.

About clients, on behalf of the business

Name, email address and, if given, mobile phone number.
Appointment details: services, times, the staff member, notes, note photos and booking history.
Amounts a business records for its own reporting, and loyalty points or promo codes it uses. ZeloBooking does not take payments for appointments.
Consent and intake forms a business asks you to fill in and sign. They can include health-related answers the business asks for; signed forms are encrypted and locked once signed.
Your choices about reminders and marketing messages, with the time, wording and (for texts) the number you agreed with.
If you call or text a business that uses ZeloBooking (when available): the phone number, time and length of calls and texts and the texts themselves. Calls with the business’s team aren’t recorded. Voicemails you leave, and conversations with a business’s AI receptionist, are recorded and/or transcribed so the business can respond — you’re told at the start of the call.
If you create a client account (account.zelobooking.com): your email address, used to sign you in with a one-time link or code and to show you the bookings, points and offers businesses hold under that email. We are responsible for the sign-in itself; each business remains responsible for its own records about you.
Sign-in by text (when available): if you choose to sign in with your mobile number instead of your email, we send a one-time code to that number through our messaging provider (Twilio) and use the number to sign you in and to show you the visits a business has confirmed under it (for example when you checked in at its kiosk or texted it). These are one-time verification texts, not marketing; message and data rates may apply. To protect against abuse we count code requests per number, device and network address.

Automatically

Basic technical information needed to run and secure the service — for example IP address, browser type and the pages requested, in security and error logs that are kept for a limited time.
When you give consent to messages or sign a form: the time, IP address and browser, kept as proof.
Cookies that keep you signed in and remember your cookie choices (see cookies).
Website visit statistics for business websites, which are cookie-less: we don’t store IP addresses or browser details with them, only an anonymous visitor code that changes every day. Visitors can switch them off in “Your privacy choices”.

How we use information

To provide ZeloBooking: bookings, calendars, reminders, forms, websites, support and the other features a business uses.
To send messages you or the business asked for, such as confirmations, reminders and account alerts, and service notices (for example about your trial, billing or security).
To keep the service secure, prevent fraud and abuse, and fix problems.
To bill businesses for their plan, credits and purchases.
To improve ZeloBooking using our own account data and aggregated, de-identified usage information.
To tell business customers and newsletter subscribers about ZeloBooking — you can opt out at any time.
To meet legal obligations and enforce our terms.

We do not sell personal information. We do not use clients’ information to market our own products to them, and we don’t use a business’s client data for any purpose other than providing the service to that business.

Cookies and analytics on zelobooking.com

Our own website uses only essential cookies unless you agree to more. If we use analytics (Google Analytics) or advertising measurement (the Meta Pixel), they load only after you choose “Accept” for that category in our cookie banner — “Reject non-essential” is always one click. Your choice is stored in a first-party cookie (zb_consent) for six months, and you can change it any time from “Cookie settings” at the bottom of every page. We honour the Global Privacy Control signal: when your browser sends it, advertising cookies stay off.

If you sign up for the ZeloBooking newsletter we store your email address, when and where you signed up, and the consent wording you saw. You’re only added after you confirm by clicking the link we email you. Every newsletter has an unsubscribe link, which works immediately; we keep a record of the unsubscribe so we don’t email you again. We never sell your address.

Our website assistant (Zelo)

The Ask Zelo chat on zelobooking.com answers questions about ZeloBooking using an AI model that runs on our hosting provider’s network (Cloudflare Workers AI). Your questions are sent to the model to write an answer, but we don’t keep chats, and the provider doesn’t use them to train models. If you type a card number, ID number or password, we remove it before it’s sent. Answers can be wrong — please check anything important with us. If you choose to fill in the contact form in the chat, we keep what you enter (your name, email or phone, business details) together with that conversation so our team can follow up with you. We only use it to contact you about ZeloBooking; it doesn’t add you to our newsletter. We delete it after 24 months, or sooner if you ask.

Inside the app, Ask Zelo helps a business’s team find their way around. It is given help articles and a summary of the business’s settings — never client names, contact details, notes or messages — and we don’t keep its chats. Other AI features a business chooses to use (for example writing social media captions or graphics) also run on Cloudflare Workers AI, using only the content the business provides for them.

Connected calendars (Google Calendar, Outlook)

Business owners and team members can choose to connect their own Google or Microsoft calendar in Settings → Integrations. With that permission, ZeloBooking:

reads your email address (to show which account is connected) and the list of your calendars (so you can choose which ones to check);
reads only the busy/free times of those calendars, so clients can’t book you when you’re busy. We never read event titles, descriptions, attendees or locations;
only if you turn on “Add my bookings to this calendar”: creates, updates and removes events for your own ZeloBooking appointments (the service and the client’s first name). We don’t change or delete any other event.

We store your sign-in tokens encrypted, the busy times (start and end only) and the ids of the events we created. This data is used only to protect your availability and show your appointments, is never sold, never used for advertising, never used to train AI models, and is not shared with anyone except the hosting providers that run ZeloBooking. Disconnecting the calendar (Settings → Integrations → Disconnect) stops access right away and deletes the stored tokens and busy times; you can also remove access in your Google or Microsoft account settings.

ZeloBooking’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Support conversations and screen sharing

Owners, admins and front desk staff can contact the ZeloBooking support team from Help & support in the app. Your messages, and any photos, screen recordings or PDFs you send (in the app or through an upload link support sends you), are kept with your case and read by people on our support team, who may also add their own notes to it. Your business’s owners, admins and front desk can see the files in its cases too. Ask Zelo, the in-app help assistant, is separate: we don’t keep its chats, and it never sees your support conversation.

To help with a case, support may ask to see your screen (live help). This works only inside ZeloBooking:

Support sees only the ZeloBooking tab where you pressed Allow — not your other tabs, apps or desktop — and nothing is shared until you press it. A banner shows for the whole session, and you can stop at any time.
Support can click, scroll and type for you only if you allow that separately, and you can take back control at any time. Owner-only steps — such as passwords and sign-in, billing, publishing your website, exporting or deleting client data and messaging clients — stay with you, and changes support makes are logged as made during live help.
Passwords, card numbers, PINs, signatures and other private fields are always hidden. Client phone numbers and emails are hidden too, unless support turns them on to help you — that’s logged, and they stay hidden in the recording.
A session is recorded only if the request you’re asked to allow says so, and the banner then shows “Recording” (recording is off unless support turns it on for that session). Recordings are kept for support and quality checks; only our support team can watch them, and every view or download is logged. You can ask for a copy of a session’s recording by replying in your case.

Client information that support sees or receives while helping a business is handled on that business’s behalf, only to give the help it asked for. Support files and recordings are stored privately, never on public links, and deleted 90 days after the case closes — or sooner if you ask in your case.

Text messaging (SMS)

ZeloBooking sends text messages only to people who agreed to receive them: business owners and staff for account notifications (for example new bookings and cancellations), and clients for appointment reminders or, if they separately opted in, offers from a business. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. See exactly how people opt in on our text message consent page.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We share mobile numbers only with the carriers and messaging provider needed to deliver the messages you asked for.

We use service providers (“subprocessors”) to run ZeloBooking. They may use information only to provide their service to us, under contracts that require them to protect it:

Supabase — database, sign-in and private file storage.
Cloudflare — hosting, security and bot checks, content delivery and storage for public website media, PDF creation, live help connections and the AI models behind Ask Zelo and other AI features (Workers AI).
Amazon Web Services (Amazon SES) — sending emails.
Stripe — card payments to ZeloBooking (plan subscriptions, credits and website templates).
Twilio — text messages, phone numbers and calls, including voicemail transcription, and the one-time codes for sign-in by text (when available).
Vapi and its AI speech and language providers — the AI phone receptionist (when available).
Google and Microsoft — only if you connect a calendar (see connected calendars).

A business can also choose to send its data to other services it connects (for example Zapier, when available, or analytics tools on its website); those services handle it under their own terms. Business websites built with ZeloBooking load fonts from Google Fonts and some starter photos from Unsplash, which receive the visitor’s IP address to deliver them.

We may also share information if the law requires it (for example a valid court order), to protect people’s safety or our rights, or as part of a merger, acquisition or sale of our business, in which case this policy continues to apply and we’ll tell you. A business can see its own clients’ information; no business can see another business’s clients.

How we protect information

Encryption in transit (HTTPS) and at rest.
Each business’s data is kept separate by access rules enforced in the database itself.
Signed consent forms and connected-account credentials are additionally encrypted by us, and form links need a PIN sent to the client.
Access is limited by role, our platform team uses two-step sign-in, and sensitive actions are logged.

No system is perfectly secure, but we work to protect information and to fix problems quickly. If a security incident affects personal information we hold, we’ll notify the affected businesses (and, where the law requires, individuals and authorities) without undue delay, and help businesses inform their clients. See our Security page.

How long we keep information

Account and business information: for as long as the account is active or as needed to provide the service. After an account is closed we delete or de-identify its data within 90 days, unless the business asks us to restore it in that time. A business can ask us to delete or anonymize its data at any time and we do so within 30 days of the request.
Client records: for as long as the business keeps them. Businesses can download or delete an individual client’s data themselves at any time; proof of consents, opt-outs and signed forms is kept without the client’s name where the business needs it as a legal record.
Billing and tax records: as long as the law requires (usually up to 7 years), even after an account is closed.
Contact details left with our website assistant: up to 24 months, then deleted automatically.
Newsletter: until you unsubscribe, plus a record of your consent and unsubscribe.
Support: messages are kept with the business’s account; files and live help recordings in a support case are deleted 90 days after the case closes (solved cases close on their own after 14 days without new messages), and files uploaded but never sent are deleted after 24 hours.
Connected calendars: until you disconnect, then deleted right away.

Your choices and rights

Opt out of text messages by replying STOP; opt out of marketing emails with the unsubscribe link. We’ll still send messages needed for your account or booking.
Ask to access, correct, download or delete your information. Business customers can contact us; clients should contact the business they booked with, or us and we’ll pass it on and help the business respond.
Delete your ZeloBooking account yourself at any time, in the app or on the web — see how to delete your account for what is deleted and what each business keeps.
Turn off non-essential cookies with “Cookie settings” on zelobooking.com, or with “Your privacy choices” on a business’s website.

US state privacy rights (including California)

Depending on where you live (for example California, Colorado, Connecticut, Virginia and other states with privacy laws), you may have the right to know what personal information we have about you and how we use it, to get a copy, to correct it, to delete it, and to opt out of “sale”, “sharing” for cross-context behavioral advertising, targeted advertising and profiling.

We don’t sell personal information, and we don’t use it for profiling that has legal or similar effects. If we turn on advertising cookies (such as the Meta Pixel) on zelobooking.com, they load only after you accept them; this may count as “sharing” under California law, and you can opt out at any time by choosing “Reject non-essential” in “Cookie settings” or by turning on Global Privacy Control.
We use sensitive information (such as account passwords, or a tax ID for carrier registration) only to provide the service and as the law allows — never to infer things about you.
To make a request, email privacy@zelobooking.com. We’ll confirm your identity (usually by asking you to reply from the email on the account) and respond within 45 days, or tell you if we need up to 45 more. You can use an authorized agent with your signed permission. If we decline your request, you can appeal by replying with “Appeal” in the subject line, and we’ll answer within the time the law sets.
For information a business holds about its clients, we act as its service provider: we pass requests to that business and help it respond.

We won’t treat you differently for using these rights.

Children

ZeloBooking accounts are for adults running or working in a business. The service is not directed to children under 13, and we don’t knowingly collect their information directly from them. Businesses that serve minors are responsible for getting a parent’s or guardian’s consent where required, and for booking through a parent or guardian. If you believe a child has given us information, contact us and we’ll delete it.

Where information is processed

ZeloBooking is run from the United States. Information is stored and processed in the United States and in other countries where our service providers operate, with the protections described in this policy.

Business websites built with ZeloBooking

Businesses can publish their own website and booking page with ZeloBooking. The business is responsible for its website and for its own privacy notice, which ZeloBooking helps it create. If a business adds its own analytics, advertising or other tools, the recognised ones load only after visitors consent, and the business is responsible for describing them in its privacy notice.

Changes to this policy

We’ll post any changes here and update the effective date. For significant changes we’ll notify business customers by email or in the app before they take effect.

Contact us

Privacy questions or requests: privacy@zelobooking.com. General support: support@zelobooking.com.
Zeloxa Labs LLC