Privacy Policy

CB Booking Rentals & Tickets — Effective date: October 9, 2026

This policy applies to the app. The CleverBooster website has its own Privacy Policy, and use of the app is also governed by our Terms of Service.

This policy explains what personal data the CB Booking Rentals & Tickets Shopify app ("the app", "we", "us") processes, why, who we share it with, how long we keep it, and how people can exercise their rights. The app is provided by CleverBooster, a business based in Vietnam ("we").

The app lets Shopify merchants ("merchants") sell appointments, rentals and event tickets through their Shopify store. Merchants are the controllers of their customers' personal data; we process it on their behalf, only to provide the app's features. Under United States state privacy laws, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), we act as the merchant's "service provider" or "processor" for that data.

1. Data we process

1.1 Customers of merchants (people who make a booking)

When someone books through a merchant's store, booking page, self-service portal or point of sale, we store:

• name, email address and phone number;
• the booking itself (service, date and time, number of attendees, price, deposit and payment status);
• answers to the merchant's booking questions and any notes the customer writes, if the merchant uses them;
• the time zone of the customer's device (only to display times; it never changes the booking time);
• the customer's IP address and browser type (used only for security and rate limiting, and shown to the merchant when a customer reschedules or cancels on their own).

If a customer joins a waitlist, the same contact details, the requested date, and any waitlist messages are stored.

We do not store payment card details — payments are processed by Shopify. We do not collect customers' addresses or precise location.

Copies of the booking emails, SMS and WhatsApp messages sent to customers are kept so merchants can see what was sent and resend it. They are automatically erased after 12 months.

Optional AI features (off by default): if a merchant turns them on, the text of booking notes / waitlist messages is sent to our AI provider to suggest a category for the merchant's staff, and name, email and phone of two bookings may be compared to suggest that they belong to the same customer. These features only make suggestions to the merchant; they never make decisions about customers automatically.

1.2 Merchants and their staff

Store information from Shopify (store name, contact email, store address, time zone, currency), the merchant's app configuration, and — only if the merchant connects them — credentials for Google Calendar, Outlook Calendar and Zoom (stored encrypted), and API keys the merchant enters for Klaviyo, Google Analytics or their own SMTP server. For the optional staff portal: staff members' email addresses and hashed passwords.

1.3 Security and access records

We record which merchant admin, staff member or POS user viewed or exported customer personal data, and when (no personal data content is stored in these records). They are kept for 12 months.

2. How we use personal data

Only to provide the app to the merchant: create and manage bookings from Shopify orders, show bookings to the merchant and their staff, send the booking confirmations, reminders and notices the merchant enables, let customers view, reschedule or cancel their own bookings, collect deposit balances the customer agreed to at checkout, and keep the service secure. We do not sell personal data, use it for advertising, or combine data across merchants.

3. Who we share data with

We share data with these providers only to deliver the features above. We may also disclose personal data if required by law, subpoena or court order, or to protect the security of the service.

4. Retention and deletion

• Booking data is kept while the merchant uses the app, so the merchant can keep their business records.
• Temporary booking holds and customer self-service access tokens expire automatically.
• Notification copies are erased after 12 months; access records after 12 months.
• When Shopify notifies us that a customer asked to be forgotten (customers/redact), we erase that customer's name, email, phone, notes, booking answers, related AI suggestions and copies of messages sent to them, keeping only an anonymous record of the booking itself.
• When a merchant uninstalls the app, all of that store's data is deleted within 48 hours after Shopify's shop/redact notification.
• Encrypted backups are kept for 30 days.

5. Security

Data is encrypted in transit (HTTPS/TLS, including the connection to our database) and backups are encrypted. Calendar and video-conferencing credentials are encrypted in our database; passwords and login links are stored only as hashes. Each merchant can only access their own store's data. Access to production systems is restricted to authorised personnel. We maintain an incident response process and will notify affected merchants without undue delay, and no later than 72 hours after confirming an incident affecting personal data, so they can meet any notification duties they have to their customers and regulators, including under United States state data breach notification laws.

6. Cookies and similar technologies

The booking widget on a merchant's store uses its own first-party browser storage, not third-party advertising cookies:

• a cbsid cookie with a random session identifier and the campaign (UTM) parameters of the visit, used to keep the booking session together;
• local and session storage entries for the booking in progress (temporary slot holds, bundle selections and protection against duplicate submissions) and a short-lived copy of the store's widget settings;
• if the merchant configures their own Google Analytics 4 property, a random analytics client identifier and the booking-widget events sent to that property.

The app's checkout analytics pixel runs inside Shopify's customer privacy framework: it only receives events when the visitor has allowed analytics where consent is required, and it is declared to Shopify as not selling data. Merchants are responsible for their store's cookie banner and consent settings. The app does not respond to browser "Do Not Track" signals; because we do not sell or share personal data for cross-context behavioral advertising, there is nothing for a Global Privacy Control signal to opt out of in the app.

7. Children's privacy

The app is a business tool for merchants and is not directed to children. We do not knowingly collect personal data from children under 13 (or under 16 where local law sets a higher age), and we do not sell or share personal data of consumers under 16. Merchants who offer bookings for children (for example, classes or camps) must collect those bookings from a parent or guardian and obtain any consent required by the Children's Online Privacy Protection Act (COPPA) or similar laws. If you believe a child's data was provided to us, ask the merchant or contact us and we will delete it.

8. Google user data

The app's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When a merchant connects Google Calendar, the app requests the calendar.events.owned permission, which Google describes as seeing, creating, changing and deleting events on calendars the user owns. The app uses it only to create an event on the merchant's primary calendar for each booking, move that event when the booking is rescheduled and delete it when the booking is cancelled; it does not read, list or search the merchant's other events or calendars. Because the customer is added as a guest, Google Calendar may email the customer an invitation when the event is created and an update when it is moved. Disconnecting deletes the stored tokens; events already created stay in the merchant's calendar, and the merchant can also remove the app's access at https://myaccount.google.com/permissions. Google user data is used only to provide this calendar sync feature, is not transferred to others except as needed to provide it, for security, or to comply with law, is not used for advertising, and is not read by people except with the merchant's permission, for security, or to comply with law. The same limits apply to data from Microsoft Outlook and Zoom.

9. Your rights

Customers who want to exercise their privacy rights (such as under GDPR or United States state privacy laws) to access, correct or delete their data should contact the merchant they booked with; the merchant can do this from their Shopify admin and through Shopify's privacy request tools, which notify us automatically. If you contact us directly, we will forward your request to the merchant and help them respond. Merchants can contact us at admin@cleverbooster.com.

10. Additional information for United States residents

This section applies to residents of California and of other US states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Nebraska and Rhode Island).

Categories of personal information. In the last 12 months the app has processed the following categories, as defined by the CCPA, for the business purposes in section 2, from the sources in section 1 (the customer, the merchant and Shopify):

We do not collect precise geolocation, government identifiers, financial account or card numbers, biometric, health or other sensitive data, and we ask merchants not to request them in booking questions.

No sale or sharing. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. We use sensitive personal information only to authenticate users and keep the service secure, so there is no right to limit its use to exercise.

Your rights. Depending on your state, you may have the right to know or access the personal information processed about you, to receive it in a portable format, to correct it, to delete it, and to opt out of sale, sharing, targeted advertising and profiling. We will not discriminate against you for exercising these rights. Because the merchant decides how your booking data is used, please send requests to the merchant first; you may also email admin@cleverbooster.com. We verify requests by matching the email address or phone number on the booking, respond within 45 days (extendable once by 45 days where the law allows), and accept requests from an authorized agent with your signed permission. If a request is declined, you may appeal by replying to our response with the subject "Privacy appeal"; we will answer within the period your state's law requires (generally 45 to 60 days), and if you disagree you may contact your state Attorney General.

California "Shine the Light". We do not disclose personal information to third parties for their own direct marketing purposes.

Messages. Booking emails, SMS and WhatsApp messages are transactional notices sent on behalf of the merchant about a booking the customer made. Merchants are responsible for obtaining the consent required by the Telephone Consumer Protection Act (TCPA) and the CAN-SPAM Act. Customers can stop SMS by replying STOP (message and data rates may apply) and can ask the merchant to stop any other messages.

11. International data transfers

We are based in Vietnam, and our servers and service providers may be located in Vietnam, the United States or other countries. Personal data may therefore be processed outside the country where it was collected. We protect it as described in this policy wherever it is processed.

12. Changes

We will update this page when our practices change and note the new effective date. If a change materially affects how personal data is used, we will notify merchants through the app or by email before it takes effect.

13. Contact

CleverBooster (Vietnam) — admin@cleverbooster.com