Privacy Policy

1. Who this covers

Business owners and their staff who use Patrons ("owners"), and the people who book those businesses through Patrons ("customers"). For customers, the business you book is in charge of your information and Patrons handles it on the business’s behalf. You can contact either of us about it.

2. What we collect from owners

Account information: your name, email address and business name. We sign you in with a one-time link sent to your email, so there’s no password to store.

Business information: what your public website says, any documents you upload (price lists, menus, schedules), your answers during setup, and your settings and rules.

Calendar access: if you connect Google Calendar, we see when you’re busy (not what your events are called or who’s attending) and we add bookings to a separate "Patrons bookings" calendar we create in your account. Access tokens are encrypted.

Imported data: if you switch from another booking platform, the files you upload (such as customer lists and appointments).

Payment information: handled by Stripe. We learn which plan you’re on, never your card number.

3. What we collect from customers

When you book: your name, email and/or phone number, the service and time you chose, any notes you add, and your booking history with that business.

Your choices: whether you’ve agreed to marketing messages from that business, and when you unsubscribe.

Reviews you leave after a visit.

Your contact details are encrypted when stored.

3a. When you use Discover or ask Tobi

Discover (our directory of local businesses) works without an account. We keep what you search for and ask Tobi, which businesses you open, and which ones you go on to book, so we can improve recommendations and show businesses how many people we sent them.

We don’t ask for your name or contact details there. Each visit is tied to a code that changes every day, and we don’t keep your IP address. If you type personal details into a question, please don’t; we trim what we keep.

If you choose "Use my location", your location stays in your browser to sort places by distance. It isn’t sent to us. Places you save are kept in your browser too.

Business details on Discover come from each business’s own public website and from Overture Maps (open data). Businesses can ask us to correct or remove their listing at hello@patrons.co.

4. How we use information

To run bookings: showing open times, checking the business’s calendar for conflicts, confirming, rescheduling and cancelling, and adding bookings to the business’s calendar.

To let AI assistants answer questions about a business and book it, using the business information and rules the owner has set. Assistants receive what’s needed for the request, never other customers’ details.

To send messages from Tobi on the business’s behalf: confirmations, reminders and changes; a review request after a visit; and, only if you’ve agreed, one follow-up after a visit or an offer the business has approved. Every marketing email has an unsubscribe link.

To show owners their dashboard: bookings, where they came from, reviews and loyalty results.

To keep Patrons secure and working, and to email owners about their account.

5. Who we share it with

The business you book with (for customers), and AI assistants that request information or make a booking, limited to what’s needed.

Service providers who help us run Patrons and may only use data on our behalf: hosting and database (Vercel, Supabase), email delivery (Resend), payments (Stripe), calendar providers the owner connects (Google), and Anthropic’s Claude API, which we use to read business websites and documents during setup.

We don’t sell personal information, and we don’t share it for anyone else’s advertising.

6. Google user data

Patrons’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar access only to check when an owner is busy and to create, update and remove the bookings we add, and for no other purpose. We don’t use this data for advertising, don’t sell it, and don’t let people read it except where the owner asks us to, for security, or where the law requires.

7. Security

Calendar tokens and customer contact details are encrypted at rest. We ask for the minimum access we need, log every action taken on a business’s behalf, and limit who can access data. Owners can disconnect their calendar at any time.

8. Keeping and deleting data

We keep an owner’s data while their account is open. When an account closes, or when an owner or customer asks, we delete personal information within a reasonable time, except records we must keep for legal, tax or security reasons (such as billing history and the audit log of bookings).

Customers can unsubscribe from marketing at any time using the link in any marketing email.

9. Your rights

You can ask to see, correct, export or delete your information by emailing hello@patrons.co. Depending on where you live, you may have additional rights under laws such as the CCPA or GDPR; write to us and we’ll honor them. Customers may also contact the business they booked with.

10. Children

Patrons isn’t directed at children, and we don’t knowingly collect information from anyone under 13. Owner accounts are for adults only.

11. Changes to this policy

We’ll post updates here with a new effective date, and email owners about material changes.

12. Contact

Questions about this policy, or to use any of the rights above: hello@patrons.co