Privacy policy

The data controller is Petri Mátyás, sole proprietor, trading as MoreBookedNow, of 2092 Budakeszi, Tiefenweg utca 33/B, Hungary, Hungary. One person, not a company: the same person who answers your emails decides what happens to your information.

• Controller: Petri Mátyás, egyéni vállalkozó (sole proprietor), trading as MoreBookedNow
• Seat: 2092 Budakeszi, Tiefenweg utca 33/B, Hungary
• Hungarian tax number: 92378241-1-33
• Registration number: 62813976
• Email for anything in this policy: hello@morebookednow.com

We run morebookednow.com and the websites, assistants and messaging we build for our customers. This policy covers what we do with personal information on our own site and in our service. We have not appointed a data protection officer, because the scale of what we do does not require one; the address above reaches the controller directly.

If you're a customer of one of the businesses we build for, say you requested a quote on a plumber's site we run, that business is the one you have a relationship with. We process your details on their behalf, only for their business, and this policy explains how.

Free site check. The website address you enter, and the trade and city if you add them. We use it to read your site, run Google's speed test, look at your search results and produce the report. The report is stored so its link keeps working.

Demo site. Your business name, city, phone, email, your current website address if you have one, and the services you tick. We use it to build a preview site and to tell you when it's ready. To build it we also read your public website and your public Google Business listing: reviews, rating, photos and opening hours.

Contact form. Your name, phone, email, city and message. We use it to reply.

The assistant. What you type into the chat. We use it to answer you. Don't put anything sensitive in it; it's a place to ask about prices and plans.

Text messages. If you text our number, we keep the number and the conversation so we can reply and so a person can follow up. Conversations are deleted after 30 days.

Signing up. Your business name, your name, email, phone, city, and which plan you chose. Your card goes straight to Stripe from their form; we receive a token that lets Stripe bill you and the last four digits so you can recognise the card. We never receive the card number.

Running your site. Your logo, photos, service list, hours and prices, plus every lead that comes in: the visitor's name, phone, address and what they asked for. We use it to build and run the site, send you the lead, and, if you're on a plan that includes it, send review requests to your customers on your behalf.

Signing in. Your email address, to find your account and send you a link. The link is a random one-time code stored for 20 minutes and deleted the moment it is used. We hold no password for you, because there isn't one.

Technical. Our hosting provider logs the IP address and browser of each request for a short time, as every web host does. We use it to keep the site running, to stop abuse (the forms are rate-limited by IP) and for nothing else. We don't run analytics.

European law asks a controller to say, for each thing it does, what entitles it to do so. Ours are short:

• To run your service: we need your business details, your files and your leads to build and operate what you are paying for. That is performance of our contract with you.
• To reply to an enquiry, run a free site check or build a demo: you asked us to, which is either taking steps at your request before a contract or your consent, and you can withdraw it by telling us to stop.
• To keep the site up and stop abuse: our legitimate interest in the service working and not being flooded, weighed against how little the data is (an address, a request, kept briefly).
• To send you a link when you sign in: performance of the contract, because it is how you reach your own account.
• To keep invoices and accounting records: a legal obligation under Hungarian tax law, which is why those survive the deletion of everything else.

We do not sell personal information, we do not profile anyone, and we make no automated decision that has a legal or similarly serious effect on you.

This site sets one cookie, and only if you sign in to your account: it remembers that it is you, for 30 days, so you don't have to ask for a link on every visit. Signing out deletes it. There are no advertising trackers, no analytics scripts and no social media pixels.

We use your browser's local storage for one thing: remembering that you have a site check running, so we can tell you when it's ready if you move to another page. It contains the report's id and your website address, stays in your own browser, and clears itself after ten minutes (or an hour for a finished report). Nothing in it is sent to us or to anyone else.

Stripe's card form, shown on the sign-up page only, may set cookies of its own for fraud prevention. Those are covered by Stripe's privacy policy.

We don't sell, rent or trade personal information. We share it only with services that do a specific job for us, each of which is bound to use it only for that job:

• Vercel: hosts the website and runs our code.
• Upstash: the database where reports, demo sites, leads and text conversations are stored.
• Stripe: saves your card and takes payments.
• Resend: sends our emails, such as the contact form, the kickoff email and lead notifications.
• Twilio: sends and receives text messages.
• OpenAI: powers the assistant, writes the report text, rates screenshots in the site check and drafts review replies. Conversations sent to OpenAI's API are not used to train their models.
• Google: PageSpeed Insights tests site speed, the Places API supplies your public business listing, and Gemini generates demo photos.
• Serper: fetches Google search results for the visibility section of the site check.

Text messages: no mobile information is shared with third parties or affiliates for marketing or promotional purposes. Mobile numbers and SMS opt-in consent are not shared with anyone except the providers that deliver the messages. Reply STOP to any message to stop receiving them, or HELP for help.

We'll also share information if the law requires it, for instance a valid court order, or if it's needed to protect someone's safety. If we ever sell the business, your information goes with it and the buyer takes on this policy.

Most of these providers are American and process data in the United States, so information about you leaves the European Economic Area. Where a provider is certified under the EU–US Data Privacy Framework we rely on that; where it is not, our contract with them carries the European Commission's standard contractual clauses. Ask us and we will tell you which applies to which, and send you a copy of the clauses.

When you request a quote, call, or reply to a text from a business whose site we run, your details are collected for that business and stored on our platform. The business decides what to do with them; we only store them, show them to the business, and send the messages the business has asked us to send.

You may get a text from that business through our system: a text-back after a missed call, a reply to your quote request, or a request to leave a review after a job. Reply STOP to any of them and you won't get another from that business through us.

To see or delete what a business holds about you, ask the business. If you'd rather come to us, email us and we'll handle it with them.

• Demo sites: 30 days, then deleted automatically.
• Text conversations with our number: 30 days.
• Site-check reports: kept so the link works. Ask and we'll delete yours.
• Contact messages: as long as we're talking, then a year in our mailbox.
• Customer accounts, site content and leads: for as long as you're a customer, then 30 days so you can take an export, then deleted. We keep invoices and payment records for 7 years because tax law says so.
• Hosting logs: a few days.

Whoever you are and wherever you live, you can ask us to show you what we hold about you, correct it, delete it, restrict what we do with it, object to it, or send you a copy in a portable format. Email hello@morebookednow.com from the address we have for you and we'll do it within 30 days, usually much faster. There's no charge and no form. Where we rely on your consent you can withdraw it at any time, which stops us going forward without unpicking what was lawful before.

Because the controller is in Hungary, the GDPR applies to everything here, wherever you live. If you think we have got something wrong, tell us first — but you are entitled to go straight to the Hungarian supervisory authority instead: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11, naih.hu. If you live elsewhere in the EEA you may complain to your own national authority.

We don't use personal information for automated decisions that have a legal or similarly serious effect on you.

Everything travels over encrypted connections. Data is stored with providers who encrypt it at rest. Access on our side is limited to the people who need it to do the work. Cards never touch our systems.

No system is perfect. If we ever have a breach that affects you, we'll tell you promptly and honestly, and tell the authorities where the law requires it.

Our service is for businesses. We don't knowingly collect information from anyone under 18, and our sites aren't aimed at children. If you think a child has given us information, email us and we'll delete it.

If we change something that matters, such as a new kind of data we collect or a new provider that sees it, we'll email customers before it happens. Small changes take effect when they're posted. The date at the top is always the current version.

Petri Mátyás, sole proprietor, trading as MoreBookedNow, 2092 Budakeszi, Tiefenweg utca 33/B, Hungary. hello@morebookednow.com. A person reads it.