Privacy Policy

Who this applies to

RollDesk serves two kinds of people. Business owners create a booking page, set their availability, and accept appointments and payments. Clients book and pay through a business’s RollDesk link. We collect information from both, and this policy covers each.

When you book with a business that uses RollDesk, that business is also responsible for the information they collect from you. We process bookings on their behalf.

Information we collect

Account information

When you create a RollDesk account, we collect your email address and a password. Passwords are securely hashed and never stored in plain text. If you sign in with Google or Apple instead, we receive your name and email from that provider but never your password.

Booking information

To schedule and confirm an appointment, we collect the details you provide: your name, contact information, the date and time you choose, and any notes you add to the booking.

Payment information

Payments are processed by Stripe. We never see or store your full card number, CVC, or other sensitive card details — Stripe handles that directly in compliance with PCI-DSS standards. We keep a transaction reference and a billing summary so businesses and clients have a record of what was paid.

RollDesk subscriptions purchased in the mobile app are billed by Apple or Google and managed through RevenueCat. We receive subscription and entitlement status, product and transaction identifiers, store and environment details, and a RollDesk workspace identifier used to associate the purchase with your account. We do not receive the payment card or store-account credentials used for that purchase.

Communication data

We use your email address to send booking confirmations, appointment reminders, and account-related messages.

Providing a phone number is always optional. If you do — as a business owner for booking alerts and your signup confirmation code, or as a client when booking an appointment — we also send those same booking-related notifications by text message (SMS) through Twilio, our SMS delivery provider. Texts are transactional only: booking requests, confirmations, reschedules, reminders, and cancellations. We never send marketing texts, and you can opt out at any time by replying STOP to any message — email remains the primary channel either way.

Mobile app

The RollDesk mobile app for iOS and Android lets business owners manage bookings, clients, and payments on the go. Sign-in mirrors the web — email and password, Google, or Apple Sign-In (iOS only). Your session is stored securely on your device using the operating system’s secure storage, never in plain text.

How we use your information

• To create and manage your account
• To schedule, confirm, and remind you of appointments
• To process payments and provide receipts
• To send transactional emails and text messages you’ve asked for
• To respond to support requests
• To keep the platform secure and operating reliably

We do not sell, rent, or trade your personal information, and we don’t share it with third parties for their own marketing.

Service providers

We rely on a small set of trusted providers to run RollDesk. Each operates under its own privacy policy, and we encourage you to review them.

Supabase

Authentication and database hosting

RevenueCat

Mobile subscription management

Apple and Google

Mobile app subscription billing and optional sign-in

Stripe

Client payment processing and payouts

MailerSend

Transactional email delivery

Twilio

Transactional text message (SMS) delivery

DigitalOcean

Application hosting

Cookies and analytics

We use essential session cookies for authentication only — no advertising trackers, and no third-party analytics cookies.

We also run our own lightweight, privacy-friendly analytics to understand how the site is used. It relies on a randomly generated session ID stored in your browser’s sessionStorage — not a cookie, and it clears when you close the tab. We look at things like page views and booking completions in aggregate. This data isn’t linked to your account and is never sold or shared.

Data retention

We keep your account and booking data for as long as your account is active, or as long as we need it to provide the service. You can request deletion of your account and its associated data at any time by contacting us.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Ask us to correct information that’s inaccurate
• Request deletion of your account and personal data
• Withdraw consent for optional communications

To exercise any of these, just reach out using the contact details below.

Data security

We use industry-standard safeguards: encrypted connections (HTTPS/TLS), hashed passwords, per-business data isolation, and role-based access controls. No system is ever completely immune to risk, but we take reasonable steps to protect your information.

Children

RollDesk isn’t directed to children under 13, and we don’t knowingly collect their personal information. If you believe a child has provided us information, contact us and we’ll remove it.

Changes to this policy

We may update this policy from time to time. When we do, we’ll revise the “Last updated” date at the top of this page. Continuing to use RollDesk after a change means you accept the updated policy.