BK Modules LLC, a limited liability company organized under the laws of the State of New Mexico (United States), with registered address at 102 Gold Ave SW Albuquerque - NM - 87102, telephone +1 (813) 214-0078, is the controller of personal data collected through https://bookflowr.com/.

For any privacy or data protection question, contact us at bookflowr@bookflowr.com. Users located in the European Economic Area (EEA) may direct requests to the same email; we will respond within a maximum of 30 days.

• Account data: name, email, hashed password (bcrypt), preferred language, and business details if you register as a professional.
• Billing data: legal name, tax ID, billing address, and payment method, processed through Stripe (PCI-DSS Level 1 certified; we do not store full card numbers).
• Usage and technical data: IP addresses, session identifiers, browser type, operating system, pages visited, access timestamps, and in-platform events.
• Communications: support messages, survey responses, and any information you voluntarily share.
• End-customer data of the business: when you use BookflowR to manage your own customers (bookings, notifications, history), BK Modules LLC acts as a data processor; you are the data controller.

• Service provision (art. 6.1.b — contract performance): creating and managing your account, providing panel access, processing bookings and subscriptions.
• Billing and tax compliance (art. 6.1.c — legal obligation): issuing and retaining invoices, responding to authority requests.
• Security and fraud prevention (art. 6.1.f — legitimate interest): event logging, abuse detection, access audits, and service integrity.
• Essential operational communications (art. 6.1.b — contract performance): account verification, system alerts, and billing notices.
• Marketing and newsletter (art. 6.1.a — consent): only if you expressly opt in; you may withdraw consent at any time.
• Service improvement and aggregate analytics (art. 6.1.f — legitimate interest): anonymized usage statistics to improve the platform.

We retain your account data while it remains active. After closure, identifying data is deleted or anonymized within thirty (30) days, except data we must retain by law:

• Invoices and tax records: minimum 6 years (EU accounting/tax obligation).
• Security and audit logs: up to 12 months.
• Support communications: up to 3 years from last contact.

Technical and statistical records (visits to your website, sent notices, assistant conversations) are kept between three (3) and thirteen (13) months depending on their type and are then deleted or anonymously aggregated.

We rely on providers acting as data processors under contract (art. 28 GDPR):

• Stripe, Inc. (United States), with Stripe Payments Europe Ltd. (Ireland, EU) for EEA users — payment processing and billing.
• Cloud infrastructure providers — hosting and databases, preferably within the EU.
• Transactional email providers — system email delivery.
• Meta Platforms Inc. (WhatsApp Cloud API) and Telegram — only if the business enables these notification channels.
• Google LLC — embedded maps and, if the business enables it, analytics (GA4) and tags (GTM).

BK Modules LLC does not sell or share personal data with third parties for their own commercial purposes.

BK Modules LLC is established in the United States. Data is transferred to and processed in the US and, where applicable, within the EU. To ensure the lawfulness of transfers from the EEA, we rely on the following mechanisms:

• EU-US Data Privacy Framework (DPF, July 2023): for providers certified under the DPF.
• EU Standard Contractual Clauses (SCCs) approved by the European Commission: for providers not covered by the DPF.
• European Commission adequacy decisions: where applicable to the recipient country.

If you are in the European Economic Area, you may exercise the following rights at any time:

• Access: obtain confirmation of whether we process your data and receive a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data when no longer necessary or when you withdraw consent.
• Objection: object to processing based on legitimate interest.
• Restriction: request suspension of processing under certain circumstances.
• Portability: receive your data in a structured, commonly used format.
• Not to be subject to solely automated decisions with legal or similarly significant effects.

Write to bookflowr@bookflowr.com indicating your name, account email, and your specific request. We will respond within 30 days. If you believe we have not handled your request properly, you may lodge a complaint with the supervisory authority in your country (in Spain, the AEPD — www.aepd.es).

If you reside in California (USA), the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) grant you additional rights:

• Right to know what personal information we have collected, the purpose of collection, and to whom it has been disclosed.
• Right to delete your personal information, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right not to be discriminated against for exercising your rights.
• Right to opt out of the sale or sharing of personal information: BK Modules LLC does not sell personal data.

To exercise these rights, contact us at bookflowr@bookflowr.com.

The Service is intended exclusively for individuals over 18 years of age. We do not knowingly collect personal data from individuals under 18 years old. If you believe a minor has provided us with data without parental or guardian consent, contact us at bookflowr@bookflowr.com and we will promptly delete such data.

We do not make decisions with significant legal effects based solely on automated processing. Fraud detection and validation mechanisms are used only as decision-support tools, always under the supervision of qualified human staff.

The BookflowR app for Android is the same service as the website and processes the same data, with these phone-specific points:

• Alerts (push notifications): if you turn them on, we store your phone's notification identifier (a Firebase Cloud Messaging token, a Google LLC service) and your alert preferences, to send you your business's alerts: new bookings, cancellations and messages. It is deleted when you switch accounts in the app, when you delete your account or when Google marks it as expired.
• Fingerprint or face unlock: the check is done by Android itself; we never receive or store your fingerprint or your face. If you turn on fingerprint sign-in, your phone keeps an access code for that device in its secure storage (our server only keeps a hash of it), which is revoked when you switch accounts in the app or delete your account.
• Microphone: only used while you dictate to the assistant. What you dictate is sent encrypted to our server, which turns it into text using OpenAI (which processes that audio on our behalf and does not use it to train its models); as soon as we have the text, the audio is discarded: we do not store it.
• Sign in with Google or Facebook: if you choose it, Google LLC or Meta Platforms Inc. share your name, email address and account identifier with us to create or open your BookflowR account.
• Downloads: what you download (marketing material, exports) is saved to your phone's Downloads folder.

The app shows no ads, does not use your phone's advertising ID, does not send usage events to third parties and does not back up your data to the cloud. You can delete your account from the profile in the app itself or as explained at https://bookflowr.com//en/account-deletion.

If you ask us to build your business website through the "All set" form, we process the business name, your name, your phone number, your email if you leave it and any setup details you choose to add (city, social profiles, services and prices, opening hours, logo and photos). We record which page the request came from and whether it arrived through the form or was entered by our team.

• Purpose: contacting you and preparing your page.
• Legal basis: your own request, as a pre-contractual step.
• Retention: for as long as needed to handle your request and meet our legal obligations; if you sign up, the retention periods of your account apply.
• Opting out: write to bookflowr@bookflowr.com and we will stop contacting you and sending you emails about this service. We keep only what is needed to honour your request. Your other rights are in section 7.

We may update this Policy to reflect legal, regulatory, or service changes. Substantial changes will be notified by email or via a panel notice at least fifteen (15) days in advance. The date at the top of this page indicates the last published update. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.