Last updated: October 13, 2026
Bookiru is a booking app for Shopify stores. Merchants install it to let their customers book appointments, classes, rentals, and other services. This policy explains what information Bookiru handles, why, who it is shared with, how long it is kept, and how to have it deleted.
It covers two groups of people: merchants who install Bookiru, and the customers who book with those merchants.
• Bookiru uses customer names, email addresses, and phone numbers only to take, manage, and communicate about bookings
• We do not read customers' shipping or billing addresses from Shopify, and we never see payment details
• We never sell personal data, and we send no marketing of our own to a merchant's customers
• Booking data is sent to advertising or analytics platforms only if the merchant sets that up, and not for visitors who declined on the store's consent banner
• A store's data is deleted after the merchant uninstalls Bookiru
Each merchant decides what to offer and whom to take bookings from, and is responsible for their customers' personal data. Bookiru processes that data on the merchant's behalf and only to provide the app. If you booked with a store and have a question about your booking or your data, the store is usually the right first contact. You can also write to us at the address below.
When a merchant installs Bookiru, we receive and store from Shopify:
• The store's name, Shopify domain, email address, timezone, currency, and languages
• The access permissions the merchant approved, and a token that lets Bookiru use them
• The Shopify plan chosen for Bookiru, and counts of bookings and booking revenue used to apply that plan's limits
We also store what the merchant enters in Bookiru: services, opening hours, team members (their names, email addresses, and working hours), equipment, booking form questions, email templates, and settings.
Bookiru's charges are billed by Shopify. We never receive or store a merchant's card or bank details.
When someone books through a store that uses Bookiru, we store:
• Their name, email address, and phone number, where they give them or Shopify provides them
• Their Shopify customer ID, where they have one
• The booking itself: the service, date and time, team member, quantity, and status
• Their answers to the booking form questions the merchant chose to ask, which can be anything the merchant asks for
• Their email address and chosen time, if they join a waitlist for a time that is full
• The language the booking calendar was shown in, so emails are sent in the same language
• The Shopify order the booking belongs to, its line totals, and whether it was paid, cancelled, or refunded
• Notes the merchant writes about the customer or the booking
• A copy of each booking email sent, and whether it was delivered, opened, bounced, or marked as spam
Bookiru also saves a small summary on the customer's record in the merchant's Shopify store: how many times they have booked, their last and next booking, their no-shows, and a tag. This stays in Shopify under the merchant's control.
If the merchant has connected an advertising or analytics platform (see below), Bookiru also stores with the booking the visitor's browser type, the address of the page they booked on, the identifiers Meta and Google set in their browser, and their choice on the store's consent banner.
We do not read shipping or billing addresses from Shopify, and we never see payment card details. Checkout and payment are handled by Shopify. An address is stored only if a merchant adds a question asking for one to their booking form.
Choosing a time holds it for a short while. To stop one visitor from holding many times at once, Bookiru keeps a scrambled, one-way code derived from the visitor's IP address or customer account. The code cannot be turned back into an IP address, and the IP address itself is not stored.
If the hold runs out without a booking, Bookiru records that a time was chosen and abandoned, so the merchant can see lost demand. For a visitor who was not signed in, nothing that identifies them is kept. We never email people about abandoned bookings. These records are deleted after 30 days.
Bookiru counts how often a booking calendar is opened. This is a daily total for each service and is not linked to any person.
• To show available times and take, move, and cancel bookings
• To send booking confirmations, reminders, reschedule, cancellation and refund notices, and waitlist invitations on the merchant's behalf
• To send a follow-up message after a booking, if the merchant turns this on. The merchant writes it, and it goes only to the customer who made that booking
• To show merchants their bookings, calendar, and customers
• To link bookings to Shopify orders, including refunds and deposits
• To apply plan limits and keep the service secure and working
• To respond to support requests
We do not use personal data for our own advertising, we do not build profiles of people across stores, and we make no automated decisions that have legal or similarly significant effects on anyone.
Bookiru does not use advertising or analytics on its own behalf. A merchant can choose to connect their own Meta or Google accounts so that bookings are reported to them as conversions. Only if a merchant sets this up:
• The booking calendar on the storefront loads the merchant's Meta Pixel or Google tag
• Bookiru can send booking events (confirmed, rescheduled, cancelled) to Meta and Google from its servers. For Meta, this includes one-way hashed versions of the customer's email, phone number, and name, and may include the visitor's browser type, the page they booked on, and Meta's own browser identifiers. For Google, it includes Google's browser identifiers, the service booked, and the booking's value
Where the store asks visitors for consent, Bookiru follows their choice: events are not sent to Meta for visitors who declined marketing, or to Google for visitors who declined analytics. Visitors who opted out of having their data sold or shared are not reported to either platform. Where a store does not ask, or the merchant enters a booking by hand, the events are sent. The merchant is responsible for their use of these platforms, which process the data under their own privacy policies.
Bookiru shares data with the following services only as needed to provide the app:
• Shopify provides the store, customer, and order data Bookiru works with, and receives the bookings, tags, and summaries Bookiru writes back
• Cloudflare hosts Bookiru and its database, and processes the network traffic sent to it
• Resend delivers booking emails, and receives the recipient's email address and the content of each message
• Meta and Google receive booking events only where a merchant has connected them, as described above
Bookiru also looks up currency exchange rates and public holiday dates from public services. No personal data is sent to them. After booking, a customer is offered "add to calendar" links; if a customer uses one, the booking's details are passed to the calendar they choose, such as Google Calendar or Outlook.
We do not share personal data with any other third parties, and we never sell it.
Bookiru's data is stored on Cloudflare's infrastructure, which may be located outside your country. Data is encrypted in transit and at rest.
• Bookings, customer details, and sent emails are kept for as long as the merchant has Bookiru installed, because they are the merchant's booking records
• When a merchant uninstalls Bookiru, access to the store ends immediately. Shopify then asks us to erase the store's data 48 hours later, and we delete it, unless the merchant has reinstalled in the meantime
• When a customer's data is erased at a merchant's or customer's request, their bookings are anonymised and their customer record, notes, emails, and waitlist entries are deleted
• Abandoned booking records are deleted after 30 days
• The contact details attached to a data access request are removed after 90 days
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict its use.
If you booked with a store, contact that store. The merchant can ask Shopify to send a data request or an erasure request for you, and Bookiru handles both: a data request is emailed to the store owner together with the bookings, booking form answers, waitlist entries, and customer record Bookiru holds about you, and an erasure request deletes or anonymises it. You can also contact us directly and we will work with the store to respond.
If you are a merchant, you can edit or delete most data inside Bookiru, uninstall the app to have your store's data deleted, or contact us.
Requests from Shopify and from storefronts are verified before Bookiru acts on them. Access to Bookiru's systems is limited to the people who need it to run the service and is protected by strong, unique passwords. If a security incident affects personal data, we will notify the affected merchants without undue delay.
Bookiru is a tool for businesses and is not directed at children. We do not knowingly collect personal information from children under 13. If you believe a child's information has been stored through a booking, contact the store or us and it will be deleted.
If we make material changes to this privacy policy, we will update this page and the "Last updated" date above. Continued use of the app after changes constitutes acceptance of the revised policy.
If you have any questions about this privacy policy or your data, please contact us at [email protected]