Appty is operated by Rita Chiu, operating Appty as an individual in Hong Kong. Contact hello@getappty.com. We do not publish a postal address; please write to hello@getappty.com. Effective date: 15 October 2026.
This notice describes how Appty handles personal information. It is our notice. It is not a service provider's own notice to their clients.
Two roles
For your account (name, email, business details, settings, and the billing relationship with Appty), we decide why the information is used.
For client information you add, or that a client sends on your booking page, we handle the information for you and on your instructions. You are responsible for having a lawful basis to add your clients. Appty does not currently offer a separate signed data-processing addendum. Email hello@getappty.com if you need one.
Information we collect
- Your account information: name, email, business details, and settings.
- Client names, email addresses, and phone numbers.
- Booking and session details, including time, service, price, and payment status.
- Notes you enter.
- Messages and emails sent through Appty.
- Payment records held with Stripe. We do not store full card numbers.
- If you connect an AI assistant: the app name, when it was connected, when it was last used, and a log of the tool calls it made.
- Basic usage and log data, such as the pages requested and the time of a request, which we use to run and protect the service.
- Essential cookies that keep you signed in. See Cookies below.
Card numbers
Payment card data is collected and processed by Stripe. Appty does not store full card numbers. Card payments are direct charges on the service provider's connected Stripe account. Stripe's handling of that data is covered by the Stripe Services Agreement.
How we use it
We use the information to run bookings, payments, receipts, reminders, and your dashboard, to keep the service secure, to fix faults, and to reply when you email us. We do not sell personal information. We do not use advertising trackers.
Service providers
We use these providers to run Appty. They process information for that purpose:
- Supabase, for the database.
- Stripe, for payments and Stripe Connect. The service provider is the merchant of record for a card payment on their connected account.
- Resend, for email delivery when email sending is turned on. Otherwise a message stays in Appty's own outbox and is not handed to Resend.
- Vercel, for hosting, and Vercel Analytics for page views.
- Sentry, for error monitoring. Before an error report is sent, Appty removes the signed-in user, cookies, the request body, and the query string, drops authorization and cookie headers, and redacts email addresses and secret links such as pay, manage, and confirm links.
- Google, for calendar events and free/busy times, only when a provider connects Google Calendar. In that case we store the Google access token and refresh token so the connection can keep working.
AI assistants and connectors
A provider can connect an AI assistant to their own Appty account. After they approve the connection, that assistant can read that provider's bookings, clients, and unpaid balances, and it can take write actions on that account. A write action (booking, rescheduling, cancelling, or sending a pay link or invoice) is shown as a preview first and runs only after a confirm step. No money moves through the assistant. The client pays on Appty.
Public tools, used with no sign-in, see only what that provider's public booking page already shows. They do not return client names or private account fields.
Connection tokens and API keys are stored as hashes. The raw value of an API key is shown once, when it is created. To disconnect an assistant, open Dashboard > AI assistants and choose Disconnect, or revoke the API key. Either one stops that connection. Tool calls are written to an action log the provider can see on that same screen.
Appty does not use booking, client, or account data from these connections to train AI models. That is Appty's policy.
International transfers
These providers may process information in countries other than yours. Where the law requires a safeguard for that transfer, we rely on the safeguards the provider has in place and on the steps the applicable law requires.
Data retention
We keep personal information while the account and the bookings are needed to run the service, to deal with a dispute, and to meet a legal duty. You can ask us to delete a client's information by emailing hello@getappty.com, and we will do so unless we must keep it for a legal reason.
We keep account and booking records while the account is open, then for 24 months after it closes, unless a payment dispute or a legal duty needs a longer hold. Backup copies follow the host's normal backup cycle. One-time sign-in links expire and then cannot be used. AI connection tokens and API keys are stored as hashes and stop working when they expire, are disconnected, or are revoked.
Security
Access to personal information is limited to what is needed to run the service. Connections to the site are protected in transit by the host. Full card numbers stay with Stripe. Sign-in cookies are httpOnly. We do not claim a particular security certification on this page.
Children
Sessions arranged through Appty may involve minors. A booking for a minor should be made by a parent or guardian. Appty is not directed at children signing up for their own account. The minimum age for a service provider account is 18.
Your rights
You can ask for access, correction, deletion, or an export of your personal information. Email hello@getappty.com. If the information is session data the service provider holds, contact the service provider first. We will help pass the request on. A service provider can ask us to delete a client's information by emailing hello@getappty.com, and we will do so unless we must keep it for a legal reason.
Cookies
We use essential cookies so a service provider or a family view stays signed in, so a chosen booking-link name survives sign-up, so we can return you to the page you were opening, and so we can remember how a visitor first reached the site. The sign-in cookie lasts 30 days. We do not set an advertising cookie. Vercel Analytics is included for page views. The site code does not set an analytics cookie of its own.
Changes and contact
Questions about privacy go to hello@getappty.com. The Terms of Service explain the agreement for using Appty. We will tell service providers about a material change to this notice by email to the service provider's account address before the change takes effect.