As a customer:

• Your phone number, to sign in and to identify your bookings — verified by a 6-digit code we generate and store as a one-way hash, never the code itself
• Your name, and optionally an email, when you book an appointment (each business sees the details for their own bookings with you)
• The appointments you book, cancel, or complete, and any review you write
• The operational state needed to make your booking reliable — for example, whether a payment, temporary booking hold, or transactional appointment notification succeeded, failed, or needs recovery
• If you choose to allow them, your preference for optional in-app return invitations from businesses you have booked with, and any individual business you mute
• If you tap "Use my location" (Explore's "Nearest first" sort, Home's "Near you") — see the dedicated note below; short version: we never store this

As a business owner, additionally:

• Your email and password (the password itself is never visible to us — Supabase Auth stores it hashed)
• Your business's name, address, hours, staff, services, and any photos you upload
• A Paystack subaccount code, if you connect one to accept deposits/payments

We use your information to provide the booking service: create and manage appointments, process deposits, send transactional booking messages, support the business you booked with, prevent fraud and misuse, and meet legal or regulatory obligations.

We also use limited booking, payment-state, temporary-hold, and notification-delivery information to detect and resolve reliability incidents. This is operational processing, not behavioural advertising: we do not inspect WhatsApp or private-message content, track you across other sites, or reuse incident information for marketing. Access is limited to authorised people resolving a real platform issue, and they use the minimum information needed for that task.

Optional return invitations stay inside MakeWeBook's Alerts. A business can send one only when you have turned invitations on, have booked with that business, have not muted it, and the sending limit allows it. Turning invitations on does not permit SMS, email, WhatsApp, push notifications, or messages from a business you have not booked with.

A business may use the phone number or email available through a MakeWeBook booking to manage that real current or upcoming appointment, or when you ask it to. It may not use that information for unsolicited calls, texts, WhatsApp messages, email, promotions, or requests to book again outside MakeWeBook. When the appointment details offer an operational call or WhatsApp option, MakeWeBook records only the appointment, channel, reason, and time — never the content of a call or message.

MakeWeBook does not have a “location” field on your account, and nothing runs in the background to track where you are. “Use my location” only ever runs after you tap it, uses your browser's own permission prompt, and the coordinates it returns stay in your browser for that visit — they're used client-side to sort businesses by distance and are never sent to MakeWeBook's servers or saved anywhere. Close the tab and it's gone; open it again tomorrow and you'll be asked again (unless your browser itself already remembers granting permission to this site, which is your browser's own setting, not ours).

• We don't sell your data, to anyone, ever
• We don't run ad-tracking cookies or third-party ad pixels
• We don't use a general analytics tool (no Google Analytics, no Mixpanel, no equivalent) — the only third-party service that ever receives technical detail about your session today is Sentry, and only for genuine errors (see below)
• A business you book with never sees another business's customers, and we never share your booking history across businesses beyond identifying you by your own verified phone number

These are the only third parties MakeWeBook's own systems send data to, and why:

• The business you book with — the name, phone, and (if given) email you provide at booking, and your appointment details. This is the actual product, not a third-party disclosure in the usual sense. The business may use that information to provide and manage your booked service, not for unsolicited marketing or rebooking outside MakeWeBook.
• Paystack — payment processing for deposits/bookings that require one. We never see your full card number.
• Moolre — sends the SMS text for your login code and appointment reminders; your phone number and the message text pass through them to do that.
• Google Maps/Places — used when a business owner sets their address, and to show maps on business pages. If you use “Use my location,” your coordinates go straight from your browser to your device's own location service — not through MakeWeBook's servers at all.
• Supabase — our database, authentication, and file storage provider; effectively all of the above is stored there.
• An email provider (for password resets and business notification emails) and Sentry (error monitoring — receives technical crash details like a stack trace and the page you were on when something broke, not your password or payment details).

MakeWeBook uses one kind of cookie: the session cookie that keeps you signed in. No third-party advertising or cross-site tracking cookies.

A few concrete things, not just a general promise:

• Login codes are stored as a one-way hash (SHA-256), never in plain text, expire after 10 minutes, and are rate-limited per phone number and per IP address
• Business owner passwords are hashed by Supabase Auth, never stored or visible to us in plain text
• Card and mobile money details never touch our servers at all — Paystack handles that directly
• Database access is scoped per-business (row-level security) — one business's data isn't reachable through another's session

You can ask us to access, correct, or delete the data we hold about you. Honestly: MakeWeBook doesn't have a self-serve “delete my account” button yet — for now, email us and we'll handle it manually. That's a real gap we'd rather name than paper over with language implying a feature that doesn't exist.

MakeWeBook isn't directed at children, and we don't knowingly collect data from anyone under 16.

If we materially change what we collect or how we use it, we'll update the date at the top of this page.

We process personal data in accordance with applicable data-protection law in Ghana, including the Data Protection Act, 2012 (Act 843), and other law that applies to the processing in question.

Questions, or a request under section 8: privacy@makewebook.app.