Privacy Policy

SoloPayLink is a booking and payment platform that helps business owners create a public booking link. Customers can choose a time and pay online. Payments are processed by Stripe. Each business owner connects their own Stripe account. SoloPayLink does not store full card numbers, CVC, or bank login details.

SoloPayLink sits between a self-employed service provider and their customer, and nothing more. When you book, the business owner you booked with decides what they need to know about you, and SoloPayLink stores and moves it for them. For that information the business owner is the controller and SoloPayLink is their processor.

For the things SoloPayLink runs itself — owner accounts, sign-in, security logs, platform fees and fraud prevention — Solo Digital Ltd is the controller.

What we collect depends on how you use SoloPayLink.

• To create and display booking pages.
• To process payments via Stripe and record bookings.
• To show booking history to the correct business owner in the dashboard.
• To synchronise bookings with Google Calendar when a business owner chooses to connect their account.
• To maintain and improve the platform (security, debugging, abuse prevention).
• To check that a business account is eligible: business accounts are only available in the United Kingdom, Australia and New Zealand, so we may use the business country, phone number, currency, the approximate location of the device used to sign up or sign in (worked out from its IP address), and Stripe’s verification results to confirm where a business operates and to detect location masking such as VPNs. We may ask a business owner for proof of registration.
• To contact you about important updates or issues.
• To comply with legal and tax obligations (where applicable).
• To respond to privacy requests and support enquiries.

We also use booking contact details to send confirmations, reminders and payment links, and to send availability alerts when a customer joins a waitlist and agrees to receive them.

SoloPayLink allows business owners to optionally connect their Google Calendar to manage bookings.

• Google Calendar access is initiated only by the business owner through an explicit “Connect Google Calendar” action.
• We use Google Calendar access to create, update, and delete events for SoloPayLink bookings. We also read the connected account email and the names of calendars you can edit so you can identify the connection and choose its target. Existing appointment events remain in their recorded calendar when you choose a new target.
• This reflects SoloPayLink appointments in the connected calendar. Outside calendar events do not automatically block SoloPayLink availability; owners should add time off for those commitments.
• We do not use Google Calendar access for advertising, profiling, resale, or unrelated purposes.
• Business owners can disconnect Google Calendar access at any time from the dashboard.

Find my business on Google. When setting up, a business owner can choose to search for their business on Google Maps. We send Google only the business name and area the owner types, show the public listing details Google returns, and use only the details the owner ticks (such as business name, business type, address and opening hours) to fill in their booking page. The owner can change or remove these details before saving. We do not use this search for advertising or any other purpose.

Booking through an AI assistant. A customer can ask an AI assistant they choose (for example ChatGPT or Claude) to book with a SoloPayLink business. The assistant sends us the same details as our booking page — the service, the time, and the customer's name, email and phone — and the customer confirms with a code we email to them before paying on Stripe's secure payment page. We use these details only to make and manage that booking. The AI assistant's own handling of your information is covered by its provider's privacy policy.

SoloPayLink’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

SoloPayLink uses essential cookies and similar technologies for authentication, session security, fraud prevention, and core platform functionality. These technologies help keep sign-in, booking, and payment flows secure and reliable.

We rely on trusted third-party service providers such as Stripe and Google Cloud to help deliver hosting, authentication, infrastructure, and secure payment services. These providers may process technical information such as IP address, browser type, device information, and security-related event data when needed to operate the platform securely and reliably.

To protect bookings from bots and abuse, SoloPayLink uses Google reCAPTCHA Enterprise and Firebase App Check. They collect device and interaction signals and are subject to Google's Privacy Policy and Terms of Service.

If SoloPayLink uses optional analytics or similar non-essential technologies, we will request your consent before enabling them. You can also manage your cookie preferences through our cookie banner or browser settings. Disabling essential cookies may affect your ability to sign in, complete a booking, or use certain secure features of the platform.

SoloPayLink is hosted on Google Cloud / Firebase. Depending on Google’s infrastructure, personal information may be processed or stored in Australia or other jurisdictions where Google and its service providers operate. Stripe may also process and store payment information across multiple countries to operate its services.

Where data moves between countries we rely on the UK International Data Transfer Addendum or Standard Contractual Clauses with our providers.

We implement industry-standard security measures to protect personal information, including data obtained through Google APIs.

• All data is transmitted over secure HTTPS connections using TLS encryption.
• Data is stored using Google Cloud / Firebase infrastructure with access controls designed to limit unauthorized access.
• Access to user data is restricted to authorized systems and service components needed to operate SoloPayLink.
• We follow the principle of least privilege when accessing and processing user data.
• We do not sell Google user data and do not use Google user data for advertising purposes.

Business owners can view bookings made through their own links. Information may also be shared with authorities when required by law or to protect rights and safety. We do not sell personal information to third-party marketers.

The business's own website and tools. If the business you book with connects its own website, booking system or spreadsheet to SoloPayLink, we send your booking details there — your name and email, the service, date and time, payment status and, if the business chose it, your phone, address, note and answers to its booking questions. The business decides this, and its own privacy policy then covers what it does with them. Every message is signed so it cannot be faked, and the business can switch it off at any time.

Website pages we host for a business. If a business uses SoloPayLink to publish website pages, we host those pages at an address like solopaylink.com/site/name or name.solopay.link (or on the business's own domain). The pages show what the business chose to publish — its name, services and prices, opening hours, area, logo and public contact buttons. They are public and search engines can find them. We use Cloudflare to deliver them and to issue the secure certificate for an owner's own domain. We do not use cookies or advertising trackers on these pages.

SoloPayLink uses a small number of providers to run the service. Each one only receives what it needs:

• Stripe — payments, payouts and business verification. Card details go directly to Stripe and are never stored by SoloPayLink.
• Google Cloud and Firebase — hosting, database, file storage and sign-in.
• Resend — sending booking confirmations, reminders and receipts.
• Google Calendar — only if a business owner connects their calendar.
• Twilio — only if a business owner uses the optional Running Late SMS feature.
• Google (Gemini & Google Cloud) — acts as our primary infrastructure and Core AI ("AI CEO").
• Specialized AI Employees — Anthropic, Alibaba Cloud (Qwen), DeepSeek, OpenAI, and OpenRouter. See below.
• Cloudflare — delivering website pages and securing owners' own domains.
• Browser push services — when an owner enables device alerts, the browser’s push provider receives the subscription destination and notification payload.

Google Cloud, Firebase, and Google Gemini act as our primary infrastructure and core intelligence (our "AI CEO") to securely operate SoloPayLink.

To assist with specific platform operations, we utilize specialized "AI Employees" (Anthropic Claude, Alibaba Cloud Qwen, DeepSeek, OpenAI, and OpenRouter). Sensitive information is never passed to these AI Employees. Our internal security engine deterministically masks and redacts all personally identifiable information—including customer emails, phone numbers, payment details, and private addresses—before dispatching tasks to them.

AI drafts and suggestions are optional and should be reviewed before use. They do not authorize bookings, payments or refunds. If an AI feature is unavailable, the normal booking tools remain available.

• Paid plans: Stripe processes your card for a Pro or Business plan. We keep your Stripe customer and subscription references, your plan, its status and renewal date, and invoice amounts. We never see or store your full card number.
• AI website writer: when you press Write it for me, we send only your public business details (business name, type, service area, services and prices, opening hours, notes for customers) and the short instruction you type. No customer information is sent. The result is a draft that is saved only if you save it.
• Website photos: photos a business owner adds to their website are stored with Cloudflare R2 (in its Oceania region) and shown from media.solopay.link. Removing a photo in Your website deletes it from storage.
• Importing from your website: when you give us your website address during setup, we read that public page once to find your business details and show them to you. We do not keep a copy of the page, and nothing is saved until you confirm it. This does not prove that you own that website.
• The SoloPayLink directory: your business appears at solopaylink.com/find only if you switch on Show me in the directory. It shows your public booking details (name, type, area, services, prices, logo and booking link) — never your email, your customers or a street address. Switch it off at any time and the listing is removed.

We retain personal information for as long as reasonably necessary to provide SoloPayLink and meet legal, operational and security requirements.

• Closure and deletion requests: use the dashboard account-closure request or contact support. A request pauses new public bookings and starts a review of future appointments, unpaid balances, refunds and record-retention obligations. It does not immediately delete the account or its records. Once the recorded obligations permit completion, you can sign in again and explicitly authorize removal of your public profile, personal setup information, owned uploads, integration credentials and sign-in identity. Financial records are retained, and your Stripe account is managed separately. A failed or incomplete erasure remains visibly pending or under review.
• Booking and payment records: records needed for outstanding services, accounting, disputes, fraud prevention or legal obligations may need to be retained after a closure request. A minimal closed-account and booking-link reservation, including financial routing details needed for refunds, is retained. Retention is reviewed within 90 days after profile erasure and at least annually thereafter; these are review targets, not automatic destruction dates. Contact support to request review of particular records.
• Website delivery records: copies of booking messages sent to a business's website are deleted 30 days after they are delivered or given up.
• Codes and sessions: one-time codes and portal sessions stop granting access when consumed, revoked or expired. Portal sessions last at most 24 hours. Access expiration does not itself erase the underlying record. Our bounded cleanup worker removes records with an explicit expiry after an additional 24-hour grace period, unless a legal or retention hold applies; backlogs may take multiple runs.
• Setup: setup begins after sign-in. New anonymous setup drafts are not stored. Legacy drafts cannot be read through the client after their permitted lifetime of at most 45 minutes; records with an explicit expiry become eligible for the same cleanup after the 24-hour grace period.
• Email content: after 90 days from terminal processing, we redact message content, recipients and the serialized delivery request while preserving delivery and duplicate-prevention receipts. Unresolved delivery review, delayed delivery and legal holds remain preserved for review.
• Calendar: disconnecting stops future synchronization through the disconnected access. It does not by itself erase booking records or events already written to Google Calendar.

For a deletion or retention request, email support@solopaylink.com. We may need to verify your identity and identify records that must be retained before completing the request.

Business accounts on SoloPayLink are available only in the United Kingdom, Australia and New Zealand. Customers who book with those businesses may live anywhere, and we handle their information under this policy. Depending on where you live, privacy laws may give you rights to access, correct, delete, restrict or object to certain uses of your personal information, and to withdraw optional cookie consent.

For UK, European or other international visitors, optional cookies are intended to stay off unless accepted. You can manage cookie preferences from the cookie banner or cookies page. To make a privacy request, email support@solopaylink.com.

• United Kingdom — UK GDPR and the Data Protection Act 2018. You may complain to the Information Commissioner's Office (ico.org.uk).
• Australia — Privacy Act 1988 and the Australian Privacy Principles. You may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
• New Zealand — Privacy Act 2020. You may complain to the Office of the Privacy Commissioner (privacy.org.nz).

Company information is available on About Solo Digital Ltd. For privacy questions or requests, contact: