Privacy Policy

1. Who we are

Alignext is an online booking platform. References to "we", "us", or "Alignext" refer to the Alignext service operator. When you use Alignext, your data may be processed both by us (as platform operator) and by the business you are booking with (as independent data controller).

2. What data we collect

• Booking data: name, email, phone number provided when booking an appointment.
• Account data: email and password for business accounts.
• Usage data: timestamps and basic logs necessary for service operation.
• Cookies: necessary session cookies to run the service, and — only with your consent — analytics and advertising cookies (see section 8).

3. How we use your data

• To send booking confirmations and reminders.
• To allow the business to manage their appointments.
• To provide and maintain the platform.
• To provide optional AI-assisted features to the business (see section 7).

We do not sell your personal data to third parties, and we do not use it to train AI models.

4. Legal basis (GDPR)

Processing is based on contractual necessity (Art. 6(1)(b) GDPR) — to fulfill the booking you requested — and legitimate interests (Art. 6(1)(f)) for platform security and abuse prevention.

5. Data retention

Booking records are retained for up to 3 years for business accounting purposes. You may request earlier deletion (see section 6).

6. Your rights

Under GDPR you have the right to access, correct, or erase your personal data. To exercise these rights, contact the business you booked with directly, or email us at privacy@alignext.io.

7. AI-assisted features

Some optional features use a third-party AI provider to help the business you booked with run its operations:

• Business insights — we send aggregated statistics (such as the number of bookings per service or per staff member) to generate plain-language summaries for the business owner. Client contact details (name, email, phone) are not sent.
• Draft messages — when an owner requests it, we send the business name and a short prompt they type to generate a draft marketing email. Client contact details are not sent; any personalisation (e.g. the recipient's first name) is added by our platform afterwards, not by the AI.

These features use a third-party AI provider located in the USA (named in our DPA). Data sent to its API is not used to train AI models and is handled under a data-processing agreement with appropriate transfer safeguards (EU Standard Contractual Clauses). Legal basis: legitimate interests (Art. 6(1)(f) GDPR) of the business to operate and improve its services. We never use one business's data for the benefit of another.

8. Analytics & advertising

On our website (alignext.io) we use Google Analytics 4 and the Meta (Facebook) Pixel and Conversions API to understand how visitors use our marketing pages and to measure our advertising. These run only on our public marketing pages (not inside the booking widget or the business dashboard) and only after you accept cookies — you can decline in the cookie banner, and no analytics or advertising data is collected if you do.

Inside the business dashboard we use Microsoft Clarity for product analytics (session recordings and heatmaps) to see where the interface is confusing and improve it. Recordings are anonymized: all text and input fields are masked, so neither your personal data nor your clients' data appears in them. You can turn this off at any time under Settings → Profile → Features. Data is processed by Microsoft under Standard Contractual Clauses (SCC).

When enabled, we share limited data with Google and Meta acting as our processors: interaction/usage events, your IP address, device and browser information, and — when you create an account — a hashed (pseudonymised) version of your email address for conversion measurement. Google and Meta are located in the USA; transfers are made under EU Standard Contractual Clauses.

Legal basis: your consent (Art. 6(1)(a) GDPR / ePrivacy). You can withdraw consent at any time by rejecting cookies. For how Google and Meta process this data, see Google's policy and Meta's policy.

9. Categories of service providers

We rely on a small set of vetted processors to run the service. Each is bound by a data-processing agreement, and any transfers outside the EEA are made under EU Standard Contractual Clauses:

• Hosting — EU/EEA data centres.
• Email delivery — EU/EEA.
• Content delivery network — EU/global edge.
• Error monitoring — outside the EEA, under SCCs.
• AI-assisted features — outside the EEA, under SCCs; API data is not used to train AI models.
• Analytics & advertising (Google, Meta) — outside the EEA, under SCCs; only with your consent (see section 8).
• Calendar sync (Google Calendar) — only if a business connects it; access limited to the connected calendar (see section 10).

A current, named list of our sub-processors (with locations and transfer mechanisms) is available to our business customers in our Data Processing Agreement.

10. Google Calendar integration

If a business connects its Google Calendar, Alignext uses the Google Calendar (calendar.events) permission to (a) create, update and delete calendar events that mirror its Alignext bookings, and (b) read event changes to keep bookings in two-way sync. We access only the connected calendar and store only the Google event identifiers and an encrypted refresh token.

This data is used solely to provide the calendar-sync feature; it is never sold, never used for advertising or to train AI models, and is not shared with other businesses. You can disconnect the integration at any time from the business dashboard (the "Developer" section), which revokes access.

Alignext's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

11. Contact

Questions about this policy: privacy@alignext.io