Sign in Get started

Legal

Privacy policy

This describes what AsaanBook actually stores and why. It is written from the system's own data model rather than from a template, so where it says a thing is not collected, it is not collected.

Last updated 5 September 2026.

Two different relationships

AsaanBook is used by businesses — clinics, salons, consultants — to take appointments from their own customers. That makes two relationships, and they are governed differently.

  • The business is our customer. We decide what we collect about the business itself, so for that data we are the controller.
  • The customer's customers are not ours. When a patient books with a clinic through AsaanBook, that clinic decides why the data is collected and what happens to it. The clinic is the controller and AsaanBook is a processor acting on its instructions. If you are a patient asking what happened to your data, the clinic is the right first contact — though we will always help.

What we collect from people booking an appointment

  • Name — as typed, so the business knows who is coming.
  • Phone number, stored in full international form. It is the only identifier: AsaanBook has no patient accounts and no passwords.
  • Email address, only if given, and only to send a copy of the booking.
  • Reason for the appointment, only if given. This is free text and optional.
  • The appointment itself — which business, which staff member, when.
  • WhatsApp conversation state where the assistant is used: the phone number, when the conversation started and ended, the chosen language, and whether it ended in a booking. The message contents are not stored.

Nothing else. There is no date of birth, no address, no medical record, no payment card, and no tracking of what a person does on the web.

What we collect from businesses

A business name, address and phone as published to its own customers; a sign-in email and a hashed password; opening hours and fees; and the WhatsApp number the assistant answers on. Passwords are stored as bcrypt hashes and cannot be read back by us or by anyone else.

This website

This site sets no cookies, runs no analytics and contains no tracking pixels. There is no advertising network, no Google Analytics, no Meta pixel and no session recording. Nothing is stored in your browser, which is why you are not being asked to accept anything.

No third party is involved either. The fonts are served from this domain rather than from Google's font CDN, because loading them from Google would have handed your IP address to Google in order to fetch a typeface. Loading this page contacts nobody but us.

How long things are kept

  • Appointments are never deleted. Cancelling marks the appointment cancelled and keeps the record, because a business needs to be able to answer "what happened to that booking?" months later.
  • Every change is logged — who changed what, when, and from which surface. That log is what makes the answer above possible.
  • Sign-in sessions expire on their own and are destroyed on sign-out.

If you want your data removed, ask the business you booked with. They can instruct us and we will act on it.

Who else sees it

  • The business you booked with. That is the point.
  • WhatsApp (Meta), if you book by message — because you are messaging the business on WhatsApp, and your message reaches them the same way any WhatsApp message does. Meta's own terms apply to that.
  • Our infrastructure providers, who host the system and cannot use the data for anything else: Supabase (database), Render (application), Google Cloud (the WhatsApp assistant), Vercel (this site and the app), and Resend (booking emails, where a business has enabled them).

We do not sell data, share it for advertising, or use it to train anything.

Where it is stored

Our servers are outside Pakistan and outside the United Kingdom — the WhatsApp assistant runs in the United States. If you are in the UK or the EU, that is an international transfer, and it is covered by the standard contractual terms our providers offer. Businesses that need the specifics for their own records should ask us.

Your rights

Depending on where you are, you may have the right to ask for a copy of your data, to have it corrected, to have it deleted, or to object to how it is used. In the UK and EU those rights come from UK GDPR and GDPR. Ask the business you booked with, or write to us and we will route it.

Contact

admin@asaanbook.online. AsaanBook is operated from Lahore, Pakistan and serves businesses in Pakistan and the United Kingdom.