Privacy Policy

1. Who we are and contact information

WantBook.ai (“WantBook”, “we”, “us”) operates a platform that makes businesses discoverable and bookable through compatible AI-powered experiences. The controller responsible for the processing described in this policy is nDRU 1.0 Kft., registered at Hajó utca 1., 1221 Budapest, Hungary, company registration number company registration number 01-09-374640, tax number 28802839-2-43.

For privacy questions or requests, contact hello@wantbook.ai.

2. Scope of this Privacy Policy

This policy applies to the WantBook website, the business dashboard and onboarding flow, the lead and booking journey, connected calendar integrations, and optional online payments. It does not apply to the independent practices of third-party AI platforms, businesses listed on WantBook, or other third-party services, which are governed by their own policies.

3. WantBook’s role and the Business Provider’s role

WantBook acts as controller for its website, user accounts, security, billing, platform administration, analytics, and the operation of the WantBook journey.

The business selected by a customer (the “Business Provider”) normally acts as an independent controller for the booking information it receives and uses to evaluate a request, communicate with the customer, provide the requested service, and maintain its legally required records.

Where contractually agreed with a Business Provider, WantBook may also process booking information on that provider’s behalf as a processor, under written instructions.

4. Description of WantBook’s services

• Businesses create profiles containing services, prices, locations, service areas, policies, availability, booking rules, customer questions, and payment preferences.
• WantBook structures business-approved information so it can be used by compatible AI-powered experiences.
• Customers may discover businesses through platforms such as ChatGPT, Claude, Gemini, or Grok. Those platforms control their own sources, responses, rankings, and presentation.
• WantBook does not automatically see every prompt, search, conversation, or business mention inside external AI platforms. WantBook only receives activity and information that enters the WantBook profile, lead, booking, calendar, or payment journey.
• Businesses may use request-only, manual-confirmation, or instant-booking workflows, and may connect Google Calendar or Microsoft Outlook to check availability and synchronize bookings.
• Online payments are optional and may involve full payment, deposits, fees, refunds, disputes, commissions, and payouts.
• The selected Business Provider receives the information necessary to respond to and fulfil the booking.

5. Categories of personal data collected

• Website, device, log, and cookie information
• Business account and administrator information
• Booking User information, including optional files or photos
• Referral and booking-intent information passed from AI-powered platforms
• Connected calendar account and availability information
• Payment and transaction information
• Support, sales, and marketing communications

6. Website, device, log, and cookie information

When you visit WantBook we process IP address, browser and device characteristics, pages viewed, referring URLs, timestamps, and error or diagnostic events. This information supports site delivery, security, abuse prevention, and aggregated analytics.

7. Business account and administrator information

For business users we process account email address, authentication events, name and role, company details including VAT or registration identifiers where provided, team member details, business locations, and the content of the business profile such as services, prices, opening hours, booking rules, customer questions, and uploaded media.

8. Booking User information

Depending on the business and the service requested, a Booking User may provide name, email address, phone number, service request details, location or address, preferred date and time, urgency, budget, party size, category-specific answers, accessibility or dietary requirements, and optional files or photos.

9. Information received from AI-powered or referral platforms

Third-party AI platforms process users’ prompts under their own privacy policies. WantBook does not automatically receive a user’s complete AI conversation history. WantBook may receive only referral information and booking intent that is intentionally passed into the WantBook journey, such as the requested service, location, timing, or profile identifier.

10. Google Calendar, Microsoft Outlook, and connected accounts

When a business connects an external calendar we process the connected account identifier and email address, selected calendar identifiers and settings, calendar time zone, free/busy information, event start and end times, information needed to manage WantBook-related events, OAuth access and refresh tokens, and connection, synchronization, and error status. Full details are in sections 16 and 17.

11. Payment and transaction information

Online payments are handled by Stripe, whose privacy policy is available at https://stripe.com/privacy. WantBook receives transaction metadata such as amount, currency, status, deposit or fee type, refund, dispute, commission, and payout records. WantBook does not store full card numbers.

12. Sensitive or special-category information

WantBook does not seek special-category data. Some bookings may involve information that is sensitive in context, such as accessibility needs, dietary requirements, or a healthcare appointment request. Businesses should only request what is necessary, and Booking Users should not submit more detail than the service requires. Where special-category data is processed we rely on explicit consent or another lawful basis.

13. Purposes and legal bases for processing

• Contract: creating accounts, publishing profiles, transmitting leads and bookings, synchronizing calendars, processing payments and payouts.
• Legitimate interests: platform security, fraud and abuse prevention, service improvement, aggregated analytics, business-to-business communication.
• Consent: non-essential cookies, marketing messages, connecting a calendar account, and any special-category data.
• Legal obligation: accounting, tax, and record-keeping duties.

14. How AI and automated rules are used

WantBook uses structured rules and automation to match requests to services, apply availability and booking rules, screen incomplete or suspicious submissions, and format profile information for compatible AI experiences. These processes do not produce legal or similarly significant decisions about individuals; where an automated rule blocks or filters a request, you may ask for human review at hello@wantbook.ai. Booking and calendar personal data is never used to train shared, general-purpose, or third-party AI or machine-learning models.

15. How and with whom information is shared

• The Business Provider selected by the Booking User
• Application hosting and database providers
• Lovable and its authorized subprocessors
• OAuth and connector infrastructure providers
• Google and Microsoft, when a calendar is connected
• Payment processors and financial partners
• Email, communications, security, analytics, and support providers
• Professional advisers and authorities where legally required

WantBook does not sell personal information and does not share personal information for cross-context behavioural advertising. A list of subprocessors is available at available on request from hello@wantbook.ai.

16. Google Calendar and Google Workspace API Data

Depending on the permissions you grant, WantBook may access the following Google data:

• Connected Google account identifier and email address
• Selected calendar identifiers and settings
• Calendar time zone
• Free/busy information
• Event start and end times
• Information necessary to create, update, reschedule, or cancel WantBook-related calendar events
• OAuth access and refresh tokens
• Connection, synchronization, and error status

How this information is used

• Let the business select its booking calendar
• Determine genuine availability
• Prevent scheduling conflicts and double-booking
• Create calendar events for WantBook bookings
• Update, reschedule, or cancel those events
• Maintain, secure, and troubleshoot the calendar connection

Limits and commitments

• WantBook does not receive your Google password.
• Unrelated calendar details are not displayed to Booking Users.
• WantBook uses free/busy information instead of accessing unrelated event content wherever possible.
• WantBook does not sell Google data.
• WantBook does not use Google data for advertising.
• WantBook does not disclose Google data to data brokers.
• WantBook does not use Google data for credit scoring, lending, employment, insurance, or surveillance.
• WantBook does not use Google Workspace data to train or improve general-purpose, shared, or third-party AI or machine-learning models.
• Human access to Google data is prohibited except with your specific consent for support, for security or abuse investigations, where legally required, or using properly anonymized and aggregated data for lawful internal operations.
• OAuth credentials are stored using secure connector infrastructure and are never exposed in public frontend code.
• Unrelated calendar data is processed transiently and is not retained as a permanent calendar copy.
• You can disconnect Google Calendar in WantBook (Dashboard → Settings → Availability) or revoke access in your Google Account. Disconnecting stops future API access but does not automatically remove calendar events already created.

WantBook’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

17. Microsoft Outlook and other calendar integrations

When Outlook is connected, WantBook may use Microsoft Graph to access the connected account identifier, the selected calendar, free/busy information, and the event information needed to create, update, reschedule, or cancel WantBook bookings. The same limits described in section 16 apply: no advertising use, no sale, no general-purpose AI model training, and no display of unrelated event details to Booking Users.

You can disconnect Outlook in WantBook (Dashboard → Settings → Availability) or revoke WantBook’s access from your Microsoft account permissions page.

18. Cookies and consent management

Essential cookies support authentication, security, and site functionality. Analytics or preference cookies are used only where permitted by your consent choices. You can review or change your choices at your browser settings, or by contacting hello@wantbook.ai, and you can also control cookies in your browser settings.

19. Data retention

20. International data transfers

Production data hosting: production data is hosted in the European Union. Some providers may process data outside the EEA or UK. Where that happens we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses together with the UK Addendum, plus supplementary measures where appropriate.

21. Security measures

• Encryption in transit, and encryption at rest for stored credentials and tokens
• Row-level access control on application data and least-privilege service access
• OAuth secrets held in server-side secret storage, never in frontend code
• Authentication, audit logging, and monitoring of administrative actions
• Regular dependency and configuration review

No internet transmission or storage method is completely secure, so we cannot guarantee absolute security.

22. User choices and privacy rights

• Access a copy of your personal data
• Correct inaccurate or incomplete data
• Delete data where no legal retention duty applies
• Restrict processing
• Object to processing based on legitimate interests
• Receive your data in a portable format
• Withdraw consent at any time
• Opt out of marketing messages
• Disconnect a connected calendar
• Request human review of applicable automated rules
• Complain to a supervisory authority

Send requests to hello@wantbook.ai. If your request concerns booking data held by a Business Provider, we will direct you to that provider or forward your request where we act as its processor.

23. GDPR and UK GDPR rights

If you are in the EEA, the UK, or Switzerland, you have the rights listed in section 22 under the GDPR or UK GDPR, and you may lodge a complaint with your local supervisory authority or with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH). We respond to verified requests within one month, extendable by two further months for complex requests.

24. Applicable U.S. state privacy rights

Residents of California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws may request access, correction, deletion, and portability, may appeal a refusal, and will not be discriminated against for exercising these rights. WantBook does not sell personal information and does not share personal information for cross-context behavioural advertising. Authorized agents may submit requests with proof of authority.

25. Children’s privacy

WantBook is a business service and is not directed at children. We do not knowingly collect personal data from children. Where a booking concerns a minor, the booking adult is responsible for the information submitted. If you believe a child’s data was submitted, contact hello@wantbook.ai and we will delete it.

26. Third-party websites and services

WantBook links to and integrates with third-party services, including AI platforms, calendar providers, and payment processors. Their processing is governed by their own privacy policies, and we are not responsible for their practices.

27. Changes to this policy

We may update this policy. Material changes will be announced on this page with an updated “Last updated” date, and where required we will notify account holders directly.

28. Contact and complaint information

nDRU 1.0 Kft., Hajó utca 1., 1221 Budapest, Hungary. Privacy contact: hello@wantbook.ai. If you are not satisfied with our response, you may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).